chore(release): v2026.9.10 #36
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - "v*.*.*" | |
| permissions: {} | |
| # Releases serialize globally, not per tag: two tags pushed together each start a | |
| # run, and both publish to the same Homebrew and Scoop repositories. queue: max | |
| # because the default, single, cancels whichever release is already waiting when | |
| # the next one arrives — serializing by dropping a release is not serializing. | |
| concurrency: | |
| group: release | |
| queue: max | |
| cancel-in-progress: false | |
| jobs: | |
| verify: | |
| name: Verify release source | |
| permissions: | |
| contents: read | |
| uses: ./.github/workflows/ci.yml | |
| server-e2e: | |
| name: Verify release on a real server | |
| permissions: | |
| contents: read | |
| uses: ./.github/workflows/e2e-server.yml | |
| release: | |
| name: Publish signed release, Homebrew, and Scoop | |
| needs: [verify, server-e2e] | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 40 | |
| permissions: | |
| contents: write | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| cache-dependency-path: go.sum | |
| # Tags as well as main: lineage validation needs main, and the changelog | |
| # needs the preceding tag. checkout fetches only the tag being released, | |
| # so without this every release would log the whole history. | |
| - name: Fetch release lineage | |
| run: git fetch --force --tags origin +refs/heads/main:refs/remotes/origin/main | |
| - name: Validate tag and main lineage | |
| run: scripts/validate-release-tag.sh "${GITHUB_REF_NAME}" origin/main | |
| # Against the published release, not against local tags: a tag that exists | |
| # says nothing about whether its release ran, and a queued release is not | |
| # stale merely because a newer tag was created while it waited. | |
| - name: Refuse to publish behind the current release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: scripts/require-newest-release.sh "${GITHUB_REF_NAME}" "${GITHUB_REPOSITORY}" | |
| - name: Verify release credentials and publication targets | |
| env: | |
| GH_TOKEN: ${{ secrets.PACKAGE_REPOS_TOKEN }} | |
| MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }} | |
| MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }} | |
| MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }} | |
| MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }} | |
| MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }} | |
| run: | | |
| required=( | |
| GH_TOKEN | |
| MACOS_NOTARY_ISSUER_ID | |
| MACOS_NOTARY_KEY | |
| MACOS_NOTARY_KEY_ID | |
| MACOS_SIGN_P12 | |
| MACOS_SIGN_PASSWORD | |
| ) | |
| for name in "${required[@]}"; do | |
| if [ -z "${!name:-}" ]; then | |
| echo "Required release secret ${name} is not configured." >&2 | |
| exit 1 | |
| fi | |
| done | |
| for repository in labstack/homebrew-tap labstack/scoop-bucket; do | |
| access=$(gh api "repos/${repository}" --jq '[.default_branch, .permissions.push] | @tsv') | |
| if [ "$access" != $'main\ttrue' ]; then | |
| echo "PACKAGE_REPOS_TOKEN must have contents write access to ${repository}:main." >&2 | |
| exit 1 | |
| fi | |
| done | |
| - name: Require public discovery controller package | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| visibility=$(gh api orgs/labstack/packages/container/onebox-discovery --jq .visibility) | |
| if [ "$visibility" != public ]; then | |
| echo "The onebox-discovery package must be public before a release can reference it." >&2 | |
| exit 1 | |
| fi | |
| - name: Require public PostgreSQL 18 distribution | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| visibility=$(gh api orgs/labstack/packages/container/onebox-postgres --jq .visibility) | |
| if [ "$visibility" != public ]; then | |
| echo "The onebox-postgres package must be public before a release can reference it." >&2 | |
| exit 1 | |
| fi | |
| docker manifest inspect ghcr.io/labstack/onebox-postgres:18 >/dev/null | |
| - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 | |
| - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 | |
| - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # The runner pins this exact release tag in the managed proxy Compose | |
| # file. Publish the controller before the binary that references it. | |
| - name: Publish matching discovery controller | |
| uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 | |
| with: | |
| context: . | |
| file: build/package/onebox-discovery.Dockerfile | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ghcr.io/labstack/onebox-discovery:${{ github.ref_name }} | |
| provenance: mode=max | |
| sbom: true | |
| - name: Verify released controller is anonymously pullable | |
| run: | | |
| docker logout ghcr.io | |
| docker buildx imagetools inspect "ghcr.io/labstack/onebox-discovery:${GITHUB_REF_NAME}" | |
| - name: Publish immutable release | |
| uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3 | |
| with: | |
| distribution: goreleaser | |
| version: v2.18.0 | |
| args: release --clean | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PACKAGE_REPOS_TOKEN: ${{ secrets.PACKAGE_REPOS_TOKEN }} | |
| MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }} | |
| MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }} | |
| MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }} | |
| MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }} | |
| MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }} | |
| # The published artifacts, not a snapshot of them. Until this ran here, | |
| # nothing checked what a user actually downloads. | |
| - name: Verify published artifacts | |
| run: scripts/verify-release-dist.sh dist |