137 lines
5.2 KiB
YAML
137 lines
5.2 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
release:
|
|
# The temporary release runner is isolated from stale queued jobs that use
|
|
# the old ubuntu-24.04 label. Restore ubuntu-latest after this release when
|
|
# the repository's normal Linux runner is online again.
|
|
runs-on: kaidi-release:host
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Validate release tag
|
|
id: release_meta
|
|
run: |
|
|
GITEA_REF_NAME=${GITHUB_REF_NAME:-}
|
|
if [ -z "$GITEA_REF_NAME" ]; then GITEA_REF_NAME=${GITHUB_REF#refs/tags/}; fi
|
|
VERSION=${GITEA_REF_NAME#v}
|
|
test "$GITEA_REF_NAME" = "v$VERSION"
|
|
./scripts/check-semver.sh "$VERSION"
|
|
GITEA_SHA=$(git rev-parse "refs/tags/$GITEA_REF_NAME^{commit}")
|
|
test -z "$(git status --porcelain --untracked-files=all)"
|
|
{
|
|
printf 'version=%s\n' "$VERSION"
|
|
printf 'ref=%s\n' "$GITEA_REF_NAME"
|
|
printf 'revision=%s\n' "$GITEA_SHA"
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
- uses: actions/setup-java@v4
|
|
with:
|
|
distribution: temurin
|
|
java-version: '17'
|
|
cache: maven
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '22'
|
|
cache: npm
|
|
cache-dependency-path: frontend/package-lock.json
|
|
|
|
- name: Verify backend
|
|
env:
|
|
RELEASE_VERSION: ${{ steps.release_meta.outputs.version }}
|
|
run: ./backend/mvnw -f backend/pom.xml -Drevision="$RELEASE_VERSION" test
|
|
|
|
- name: Verify frontend
|
|
working-directory: frontend
|
|
run: |
|
|
HUSKY=0 npm ci
|
|
npm run lint -- --no-fix
|
|
npm run stylelint
|
|
npm test
|
|
npm run audit:dependencies
|
|
npm run build
|
|
if [ "${RUNNER_OS:-Linux}" = macOS ]; then
|
|
npx playwright install chromium
|
|
else
|
|
npx playwright install --with-deps chromium
|
|
fi
|
|
npm run test:e2e
|
|
npm run test:dist
|
|
|
|
- name: Verify release contracts and scripts
|
|
run: |
|
|
./scripts/check-openapi.sh openapi.yaml
|
|
./scripts/test-install-fixture.sh
|
|
./scripts/test-git-install-fixture.sh
|
|
./scripts/test-update-fixture.sh
|
|
./scripts/test-baota-start-fixture.sh
|
|
./scripts/test-purge-fixture.sh
|
|
./scripts/test-gitea-publish-fixture.sh
|
|
shellcheck deploy/install.sh deploy/install-from-git.sh deploy/update.sh deploy/baota-start.sh deploy/baota-init.sh \
|
|
deploy/purge.sh \
|
|
scripts/check-semver.sh \
|
|
scripts/package-release.sh scripts/publish-gitea-release.sh \
|
|
scripts/generate-release-key.sh scripts/test-install-fixture.sh \
|
|
scripts/test-git-install-fixture.sh \
|
|
scripts/test-update-fixture.sh scripts/test-gitea-publish-fixture.sh \
|
|
scripts/test-baota-start-fixture.sh scripts/test-purge-fixture.sh \
|
|
scripts/verify-release.sh
|
|
|
|
- name: Build and sign release assets
|
|
env:
|
|
RELEASE_SIGNING_KEY_B64: ${{ secrets.RELEASE_SIGNING_KEY_B64 }}
|
|
RELEASE_VERSION: ${{ steps.release_meta.outputs.version }}
|
|
KAIDI_TRUSTED_RELEASE_PUBLIC_KEY_SHA256: ${{ vars.KAIDI_RELEASE_PUBLIC_KEY_SHA256 }}
|
|
KAIDI_RELEASE_NOTES: Kaidi Finance ${{ steps.release_meta.outputs.ref }}
|
|
KAIDI_SOURCE_REVISION: ${{ steps.release_meta.outputs.revision }}
|
|
KAIDI_SOURCE_REF: ${{ steps.release_meta.outputs.ref }}
|
|
KAIDI_SOURCE_DIRTY: 'false'
|
|
run: |
|
|
test -n "$RELEASE_SIGNING_KEY_B64"
|
|
trap 'shred -u "$RUNNER_TEMP/release-key.pem" 2>/dev/null || rm -f "$RUNNER_TEMP/release-key.pem"' EXIT
|
|
if base64 --decode </dev/null >/dev/null 2>&1; then
|
|
printf '%s' "$RELEASE_SIGNING_KEY_B64" | base64 --decode > "$RUNNER_TEMP/release-key.pem"
|
|
else
|
|
printf '%s' "$RELEASE_SIGNING_KEY_B64" | base64 -D > "$RUNNER_TEMP/release-key.pem"
|
|
fi
|
|
chmod 600 "$RUNNER_TEMP/release-key.pem"
|
|
KAIDI_RELEASE_SIGNING_KEY="$RUNNER_TEMP/release-key.pem" \
|
|
./scripts/package-release.sh "$RELEASE_VERSION"
|
|
|
|
- name: Verify signed release assets
|
|
env:
|
|
KAIDI_TRUSTED_RELEASE_PUBLIC_KEY_SHA256: ${{ vars.KAIDI_RELEASE_PUBLIC_KEY_SHA256 }}
|
|
KAIDI_EXPECTED_SOURCE_REVISION: ${{ steps.release_meta.outputs.revision }}
|
|
KAIDI_EXPECTED_SOURCE_REF: ${{ steps.release_meta.outputs.ref }}
|
|
KAIDI_EXPECTED_SOURCE_DIRTY: 'false'
|
|
run: ./scripts/verify-release.sh dist/release
|
|
|
|
- name: Publish Gitea release
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.RELEASE_GITEA_TOKEN }}
|
|
GITEA_SERVER_URL: ${{ github.server_url }}
|
|
GITEA_REPOSITORY: ${{ github.repository }}
|
|
GITEA_REF_NAME: ${{ steps.release_meta.outputs.ref }}
|
|
GITEA_SHA: ${{ steps.release_meta.outputs.revision }}
|
|
run: ./scripts/publish-gitea-release.sh
|
|
|
|
- name: Upload Playwright report after failure
|
|
if: failure()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: playwright-report-${{ github.run_id }}
|
|
path: frontend/playwright-report
|
|
if-no-files-found: ignore
|
|
retention-days: 7
|