mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
Anso
21633b87e3
Release publish runs leave steps.release.outputs.pr empty, so fromJSON crashed even when the credit step was gated off. Credit external issue openers with an inline thanks suffix on logical changelog bullets instead of a Thanks section. Keep fatal API lookup logs status-only.
86 lines
3.5 KiB
YAML
86 lines
3.5 KiB
YAML
name: Release Please
|
|
|
|
concurrency:
|
|
group: release-please-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
# Manual recovery lever for cases where the action fails on a transient
|
|
# GitHub API issue (e.g. duplicate-release-tag during a retry) and exits
|
|
# before scanning main for new conventional commits. Re-running from the
|
|
# Actions tab requeues the same logic against the current main HEAD; no
|
|
# code push needed. Triggering manually does NOT skip the action's own
|
|
# state checks, so it cannot accidentally double-publish a release.
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
release-please:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
# Mint a short-lived installation token for the `sencho-token-app`
|
|
# GitHub App instead of using a long-lived user PAT. The token:
|
|
# - is scoped to this one repository (least privilege)
|
|
# - requests only the permissions release-please actually needs
|
|
# - is auto-revoked by the action's post step at job end
|
|
# - unlike GITHUB_TOKEN, CAN trigger downstream workflow runs, so the
|
|
# tag push from release-please still cascades to docker-publish.yml
|
|
- name: Generate GitHub App installation token
|
|
id: app-token
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
with:
|
|
app-id: ${{ secrets.APP_ID }}
|
|
private-key: ${{ secrets.APP_PRIVATE_KEY }}
|
|
owner: ${{ github.repository_owner }}
|
|
repositories: Sencho
|
|
permission-contents: write
|
|
permission-pull-requests: write
|
|
permission-issues: read
|
|
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
token: ${{ steps.app-token.outputs.token }}
|
|
|
|
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
|
with:
|
|
node-version-file: '.node-version'
|
|
|
|
- id: release
|
|
uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
|
|
with:
|
|
token: ${{ steps.app-token.outputs.token }}
|
|
config-file: release-please-config.json
|
|
manifest-file: .release-please-manifest.json
|
|
|
|
- name: Credit external contributors in changelog
|
|
if: ${{ steps.release.outputs.prs_created == 'true' }}
|
|
env:
|
|
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
|
|
GITHUB_REPOSITORY: ${{ github.repository }}
|
|
# fromJSON must tolerate empty pr: env is evaluated even when if: skips
|
|
# (publish runs leave pr unset). Empty object yields empty RELEASE_BRANCH.
|
|
RELEASE_BRANCH: ${{ fromJSON(steps.release.outputs.pr || '{}').headBranchName || '' }}
|
|
MAINTAINER_LOGINS: ""
|
|
run: |
|
|
if [ -z "$RELEASE_BRANCH" ]; then
|
|
echo "RELEASE_BRANCH is empty; aborting."
|
|
exit 1
|
|
fi
|
|
cp scripts/credit-changelog-contributors.mjs "$RUNNER_TEMP/"
|
|
git fetch origin "$RELEASE_BRANCH"
|
|
git checkout "$RELEASE_BRANCH"
|
|
node "$RUNNER_TEMP/credit-changelog-contributors.mjs"
|
|
if [ -n "$(git status --porcelain CHANGELOG.md)" ]; then
|
|
git config user.name "sencho-quartermaster[bot]"
|
|
git config user.email "275163604+sencho-quartermaster[bot]@users.noreply.github.com"
|
|
git add CHANGELOG.md
|
|
git commit -m "chore: credit external contributors in changelog"
|
|
git push origin "HEAD:$RELEASE_BRANCH"
|
|
fi
|