Release v0.2.0 #22
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish release | ||
|
Check warning on line 1 in .github/workflows/release-publish.yaml
|
||
| # Only merged source is executed. Validation of unmerged PRs lives in its own | ||
| # read-only pull_request workflow. This trigger also supports reviewed fork PRs. | ||
| on: | ||
| pull_request_target: | ||
| types: [closed] | ||
| branches: ["main"] | ||
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| concurrency: | ||
| group: release-publish | ||
| cancel-in-progress: false | ||
| env: | ||
| BUNDLE_WITH: maintenance | ||
| RELEASE_PR: ${{ github.event.pull_request.number }} | ||
| jobs: | ||
| inspect: | ||
| if: github.event.pull_request.merged == true | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| release: ${{ steps.inspect.outputs.release }} | ||
| commit: ${{ steps.inspect.outputs.commit }} | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
| with: | ||
| fetch-depth: 0 | ||
| persist-credentials: false | ||
| - uses: ruby/setup-ruby@v1 | ||
| with: | ||
| ruby-version: "3.4" | ||
| bundler-cache: true | ||
| - id: inspect | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| run: bundle exec bake gem:github:release:resolve | ||
| publish: | ||
| needs: inspect | ||
| if: needs.inspect.outputs.release == 'true' | ||
| runs-on: ubuntu-latest | ||
| environment: rubygems | ||
| permissions: | ||
| contents: write | ||
| pull-requests: read | ||
| actions: read | ||
| id-token: write | ||
| attestations: write | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
| with: | ||
| # Inspection verified this merged commit belongs to the default branch. | ||
| # Checkout v7 also blocks merged fork PRs without this explicit opt-in. | ||
| allow-unsafe-pr-checkout: true | ||
| ref: ${{ needs.inspect.outputs.commit }} | ||
| fetch-depth: 0 | ||
| persist-credentials: false | ||
| - uses: ruby/setup-ruby@v1 | ||
| with: | ||
| ruby-version: "3.4" | ||
| rubygems: '4.0.21' | ||
| bundler-cache: true | ||
| - name: Build or restore artifact | ||
| id: build | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| GEM_SIGNING_KEY: ${{ secrets.GEM_SIGNING_KEY }} | ||
| run: bundle exec bake gem:github:release:build | ||
| - name: Sign RubyGems attestation | ||
| if: steps.build.outputs.restored != 'true' | ||
| env: | ||
| PACKAGE: ${{ steps.build.outputs.package }} | ||
| run: gem exec sigstore-cli:0.2.3 sign "$PACKAGE" --bundle "$PACKAGE.sigstore.json" | ||
| - name: Attest gem and release receipt | ||
| if: steps.build.outputs.restored != 'true' | ||
| id: attest | ||
| uses: actions/attest@v4 | ||
| with: | ||
| subject-path: | | ||
| ${{ steps.build.outputs.package }} | ||
| pkg/release.json | ||
| - name: Retain provenance bundle | ||
| if: steps.build.outputs.restored != 'true' | ||
| env: | ||
| ATTESTATION_BUNDLE: ${{ steps.attest.outputs.bundle-path }} | ||
| run: cp "$ATTESTATION_BUNDLE" pkg/provenance.sigstore.json | ||
| - name: Preserve release before upload | ||
| if: steps.build.outputs.restored != 'true' | ||
| uses: actions/upload-artifact@v7 | ||
| with: | ||
| name: ${{ steps.build.outputs.artifact }} | ||
| path: pkg/ | ||
| if-no-files-found: error | ||
| retention-days: 90 | ||
| - uses: rubygems/configure-rubygems-credentials@main | ||
| - name: Verify, publish, and finalize | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| run: bundle exec bake gem:github:release:publish | ||
