Skip to content
Merged
Show file tree
Hide file tree
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 41 additions & 1 deletion .github/workflows/build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,17 @@ on:
push:
branches:
- release/**
workflow_call:
inputs:
skip-signing:
type: boolean
default: false
is-snapshot:
type: boolean
default: false
checkout-ref:
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we need this checkout-ref to share the version patched repo between workflows. see comment here for more details: https://github.com/getsentry/sentry-cli/pull/3212/changes#r2924915514

type: string
default: ''

jobs:
linux:
Expand Down Expand Up @@ -32,6 +43,8 @@ jobs:

steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
with:
ref: ${{ inputs.checkout-ref }}

- name: Add Rustup Target
run: |
Expand Down Expand Up @@ -68,6 +81,8 @@ jobs:

steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
with:
ref: ${{ inputs.checkout-ref }}
Comment thread
szokeasaurusrex marked this conversation as resolved.

- name: Add Rustup Target
run: rustup target add ${{ matrix.target }}
Expand Down Expand Up @@ -154,9 +169,13 @@ jobs:

steps:
- name: Checkout repository
if: ${{ !inputs.skip-signing }}
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
with:
ref: ${{ inputs.checkout-ref }}

- name: Install `rcodesign`
if: ${{ !inputs.skip-signing }}
run: |
curl -L https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F0.29.0/apple-codesign-0.29.0-x86_64-unknown-linux-musl.tar.gz \
-o rcodesign.tar.gz
Expand All @@ -166,6 +185,7 @@ jobs:
rm rcodesign.tar.gz

- name: Decode Apple signing certificate and API key
if: ${{ !inputs.skip-signing }}
env:
APPLE_CERT_DATA: ${{ secrets.APPLE_CERT_DATA }}
APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
Expand All @@ -179,6 +199,7 @@ jobs:
name: unsigned-bin-macos-${{ matrix.arch }}

- name: Sign binary
Comment thread
szokeasaurusrex marked this conversation as resolved.
if: ${{ !inputs.skip-signing }}
run: |
rcodesign sign \
--for-notarization \
Expand All @@ -188,17 +209,19 @@ jobs:
sentry-cli-Darwin-${{ matrix.arch }}

- name: Zip signed binary
if: ${{ !inputs.skip-signing }}
run: |
zip sentry-cli-Darwin-${{ matrix.arch }}.zip sentry-cli-Darwin-${{ matrix.arch }}

- name: Notarize binary
if: ${{ !inputs.skip-signing }}
run: |
rcodesign notary-submit \
--api-key-file ${{ env.APPLE_API_KEY_PATH }} \
--wait \
sentry-cli-Darwin-${{ matrix.arch }}.zip

- name: Upload signed binary
- name: Upload binary
Comment thread
runningcode marked this conversation as resolved.
Outdated
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # 7.0.0
with:
name: artifact-bin-macos-${{ matrix.arch }}
Comment thread
runningcode marked this conversation as resolved.
Expand All @@ -219,6 +242,8 @@ jobs:

steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
with:
ref: ${{ inputs.checkout-ref }}

# When rustup is updated, it tries to replace its binary, which on Windows is somehow locked.
# This can result in the CI failure, see: https://github.com/rust-lang/rustup/issues/3029
Expand Down Expand Up @@ -251,6 +276,8 @@ jobs:

steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
with:
ref: ${{ inputs.checkout-ref }}

- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # 6.2.0
with:
Expand Down Expand Up @@ -280,10 +307,13 @@ jobs:
if-no-files-found: 'error'

python-base:
if: ${{ !inputs.is-snapshot }}
name: python (base)
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
with:
ref: ${{ inputs.checkout-ref }}
- name: Add Rustup Target
run: rustup target add x86_64-unknown-linux-musl
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # 6.2.0
Expand All @@ -297,11 +327,14 @@ jobs:
if-no-files-found: 'error'

python:
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not publishing to pip

if: ${{ !inputs.is-snapshot }}
name: python
runs-on: ubuntu-24.04
needs: [linux, sign-macos-binaries, windows, python-base]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
with:
ref: ${{ inputs.checkout-ref }}
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # 6.2.0
with:
python-version: '3.11'
Expand All @@ -328,6 +361,8 @@ jobs:
needs: [linux, sign-macos-binaries, windows]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
with:
ref: ${{ inputs.checkout-ref }}
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # 6.2.0
with:
node-version: '20.10.0'
Expand Down Expand Up @@ -366,6 +401,7 @@ jobs:
if-no-files-found: 'error'

platform-specific-docker:
if: ${{ !inputs.is-snapshot }}
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

skip docker publishing

name: Build Docker Image (${{ matrix.platform }})
strategy:
matrix:
Comment thread
sentry[bot] marked this conversation as resolved.
Expand All @@ -380,6 +416,8 @@ jobs:
packages: write
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
with:
ref: ${{ inputs.checkout-ref }}

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # 3.12.0
Expand All @@ -402,6 +440,7 @@ jobs:
cache-to: type=gha,mode=max,scope=${{ matrix.platform }}

multiarch-docker:
if: ${{ !inputs.is-snapshot }}
name: Create Multi-Architecture Docker Image
needs: platform-specific-docker
runs-on: ubuntu-24.04
Expand All @@ -422,6 +461,7 @@ jobs:
ghcr.io/${{ github.repository }}:${{ github.sha }}-arm64

merge:
if: ${{ !inputs.is-snapshot }}
name: Create Release Artifact
runs-on: ubuntu-24.04
needs: [linux, sign-macos-binaries, windows, npm-distributions, node, python]
Expand Down
114 changes: 114 additions & 0 deletions .github/workflows/snapshot.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,114 @@
name: Snapshot Release

on:
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

manual trigger to test. we can change this to build on every push to master once we know it is working.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

l: I would be fine with just having it set to every push to master with this PR. We can revert if needed

workflow_dispatch:

permissions:
contents: write

jobs:
prepare:
name: Prepare Snapshot
runs-on: ubuntu-24.04
outputs:
version: ${{ steps.version.outputs.version }}
ref: ${{ steps.push.outputs.ref }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2

# Computes a semver-compliant snapshot version based on the current
# version in Cargo.toml. The minor version is bumped so that the
# snapshot sorts higher than the current release but lower than the
# next real release. For example, if Cargo.toml has 3.3.1, the
# snapshot version will be 3.4.0-snapshot.20260312.abc1234.
Comment thread
runningcode marked this conversation as resolved.
Outdated
- name: Compute snapshot version
id: version
run: |
CURRENT=$(grep '^version = ' Cargo.toml | head -1 | sed 's/version = "\(.*\)"/\1/')
Comment thread
runningcode marked this conversation as resolved.
Outdated
MAJOR=$(echo "$CURRENT" | cut -d. -f1)
MINOR=$(echo "$CURRENT" | cut -d. -f2)
NEXT_MINOR=$((MINOR + 1))
DATE=$(date -u +%Y%m%d)
SHORT_SHA=$(git rev-parse --short HEAD)
VERSION="${MAJOR}.${NEXT_MINOR}.0-snapshot.${DATE}.${SHORT_SHA}"
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
echo "current=$CURRENT" >> "$GITHUB_OUTPUT"
echo "Snapshot version: $VERSION"

- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # 6.2.0
with:
node-version: '20.10.0'

- name: Bump versions
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

so another way to do this would be to modify the versions in place in the action/workflow using sed and regexes.

this would remove the need to commit and create the snapshot branch somewhere but then we have two different mechanisms to patch the versions which could lead to drift. without modifying in place, there's no way to share the patched repo between workflows.

run: scripts/bump-version.sh "${{ steps.version.outputs.current }}" "${{ steps.version.outputs.version }}"

- name: Push snapshot branch
id: push
run: |
BRANCH="snapshot/${{ steps.version.outputs.version }}"
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git checkout -b "$BRANCH"
git add -A
git commit -m "snapshot: ${{ steps.version.outputs.version }}"
git push origin "$BRANCH"
echo "ref=$BRANCH" >> "$GITHUB_OUTPUT"

build:
name: Build
needs: prepare
uses: ./.github/workflows/build.yml
with:
skip-signing: true
is-snapshot: true
checkout-ref: ${{ needs.prepare.outputs.ref }}
secrets: inherit

publish-npm:
name: Publish to npm
needs: [prepare, build]
runs-on: ubuntu-24.04
steps:
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # 6.2.0
with:
node-version: '20.10.0'
registry-url: 'https://registry.npmjs.org'

- name: Download npm binary distributions
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # 8.0.0
with:
name: artifact-npm-binary-distributions
path: npm-distributions

- name: Download node package
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # 8.0.0
with:
name: artifact-pkg-node
path: node-package

- name: Publish platform packages
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
run: |
for pkg in npm-distributions/*.tgz; do
echo "Publishing $pkg"
npm publish "$pkg" --tag snapshot
done
Comment thread
cursor[bot] marked this conversation as resolved.

- name: Publish main package
Comment thread
sentry[bot] marked this conversation as resolved.
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
run: |
npm publish node-package/*.tgz --tag snapshot

cleanup:
name: Cleanup
needs: [prepare, publish-npm]
if: always()
runs-on: ubuntu-24.04
steps:
- name: Delete snapshot branch
Comment thread
szokeasaurusrex marked this conversation as resolved.
env:
GH_TOKEN: ${{ github.token }}
run: |
gh api -X DELETE "repos/${{ github.repository }}/git/refs/heads/${{ needs.prepare.outputs.ref }}" || true
Comment thread
cursor[bot] marked this conversation as resolved.
Outdated
Loading