github-templates/examples/release-changesets.yml at main · aragon/github-templates · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
# Example: Changesets release of a single-package repo (scenario A frontend / B library / D
# indexer). Start (by hand), Refresh (on release-PR push), Finalize (on merge) and Cancel (on
# close). What hangs off the GitHub Release — a deploy, an npm publish, a manual promote — is the
# repo's own file (deploy-production.yml, publish-npm.yml).

name: Release

on:
  workflow_dispatch: {}
  pull_request:
    types: [opened, synchronize, reopened, closed]
    branches: [main]

permissions:
  contents: write
  pull-requests: write

jobs:
  start:
    if: github.event_name == 'workflow_dispatch'
    uses: aragon/github-templates/.github/workflows/release-start.yml@main
    with:
      engine: changesets
      op-release-token-path: op://kv_app_infra/ARABOT_PAT/credential
      op-gpg-key-path: op://kv_app_infra/arabot-1_SIGN_CERTS/private_key
      op-gpg-passphrase-path: op://kv_app_infra/arabot-1_SIGN_CERTS/credential
      op-slack-bot-token-path: op://kv_app_infra/SLACK_BOT_TOKEN/credential
      op-slack-channel-id-path: op://kv_app_infra/SLACK_CHANNEL_ID/credential
      op-linear-token-path: op://kv_app_infra/LINEAR_API_TOKEN/credential
    secrets:
      OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}

  # On every push to a release/* PR: regenerate the summary (incl. the ⚠️ open-tickets
  # warning) and rewrite the PR body. The reusable workflow green-skips other branches,
  # so the `if` here only saves the queued run.
  refresh:
    if: >
      github.event_name == 'pull_request'
      && github.event.action != 'closed'
      && startsWith(github.event.pull_request.head.ref, 'release/')
    uses: aragon/github-templates/.github/workflows/release-pr-refresh.yml@main
    with:
      op-release-token-path: op://kv_app_infra/ARABOT_PAT/credential
      op-linear-token-path: op://kv_app_infra/LINEAR_API_TOKEN/credential
      op-slack-bot-token-path: op://kv_app_infra/SLACK_BOT_TOKEN/credential
      op-slack-channel-id-path: op://kv_app_infra/SLACK_CHANNEL_ID/credential
    secrets:
      OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}

  # On merge of a release/* PR into main: tag + GitHub Release (the only tagging point).
  # `sha: head.sha` tags the staging-TESTED commit (recommended); use merge_commit_sha instead
  # when the repo squash-merges and the head commit never lands on main.
  finalize:
    if: >
      github.event_name == 'pull_request'
      && github.event.pull_request.merged == true
      && startsWith(github.event.pull_request.head.ref, 'release/')
    uses: aragon/github-templates/.github/workflows/release-finalize.yml@main
    with:
      sha: ${{ github.event.pull_request.head.sha }}
      pr-body: ${{ github.event.pull_request.body }}
      changesets-guard: all
      op-release-token-path: op://kv_app_infra/ARABOT_PAT/credential
      op-slack-bot-token-path: op://kv_app_infra/SLACK_BOT_TOKEN/credential
      op-slack-channel-id-path: op://kv_app_infra/SLACK_CHANNEL_ID/credential
    secrets:
      OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}

  cancel:
    if: >
      github.event_name == 'pull_request'
      && github.event.action == 'closed'
      && github.event.pull_request.merged == false
      && startsWith(github.event.pull_request.head.ref, 'release/')
    uses: aragon/github-templates/.github/workflows/release-pr-cancel.yml@main
    with:
      op-release-token-path: op://kv_app_infra/ARABOT_PAT/credential
      op-slack-bot-token-path: op://kv_app_infra/SLACK_BOT_TOKEN/credential
      op-slack-channel-id-path: op://kv_app_infra/SLACK_CHANNEL_ID/credential
    secrets:
      OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}