Scriptlets/.github/workflows/prepare-release.yml at master · AdguardTeam/Scriptlets · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
name: Prepare release

description: >-
  Opens a release PR that finalizes CHANGELOG.md for the given tag (via the
  shared create-release-pr.yml reusable workflow), then regenerates the
  auto-generated wiki/ and appends it to the PR's branch so both are reviewed
  and merged together. After merge, publish-release.yml takes over.

on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag WITH "v" prefix (e.g. v2.5.0, v2.5.0-beta.1)'
        required: true
        type: string

# `contents: write` — update-wiki commits/pushes the wiki to the release branch
# `id-token: write` — Octopass OIDC (the create-pr action inside the shared
#   workflow and protected-push in the update-wiki job both exchange the
#   id-token for a short-lived App installation token)
permissions:
  contents: write
  id-token: write

jobs:
  create-release-pr:
    uses: AdGuardSoftwareLimited/actions/.github/workflows/create-release-pr.yml@master
    with:
      team: extensions
      tag: ${{ inputs.tag }}

  # Regenerate the auto-generated wiki/ from JSDoc and append it to the release
  # PR's branch after the PR is open, so the wiki update is reviewed and merged
  # TOGETHER with the release. This way released code changes and docs are
  # always in sync.
  update-wiki:
    needs: create-release-pr
    runs-on: team-extensions
    steps:
      - name: Checkout release branch
        uses: actions/checkout@v5
        with:
          ref: release-bump/${{ inputs.tag }}
          fetch-depth: 0

      - name: Build wiki
        id: build-wiki
        continue-on-error: true
        run: >-
          DOCKER_BUILDKIT=1 docker build --progress plain
          --target wiki-output --output ./wiki-out .

      # Only append when the wiki was actually built; a transient build failure
      # (steps.build-wiki.outcome != 'success') is skipped so we don't try to
      # mv a non-existent wiki-out/ directory. The PR still contains just the
      # CHANGELOG bump.
      - name: Append regenerated wiki
        if: steps.build-wiki.outcome == 'success'
        run: |
          rm -rf wiki
          mv wiki-out/wiki wiki
          rm -rf wiki-out

      # Commit and push the wiki to the release branch. protected-push:
      #   - no-ops (has_changes=false, exit 0) when the rebuild is a no-op;
      #   - resolves the remote branch head and pushes with --force-with-lease
      #     (refuses to clobber a concurrent push);
      #   - authenticates with an Octopass token instead of GITHUB_TOKEN.
      - name: Commit and push wiki
        if: steps.build-wiki.outcome == 'success'
        uses: AdGuardSoftwareLimited/actions/actions/protected-push@master
        with:
          # Required: protected-push forwards this to Octopass as the target
          # repository for the minted token. Without it, Octopass gets an
          # empty repository and rejects the request ("invalid token scope
          # request").
          repository: ${{ github.repository }}
          branch: release-bump/${{ inputs.tag }}
          commit-message: 'docs: regenerate wiki docs for release'
          files: wiki