Repository navigation
chore: bump 0.0.0-alpha.11 #14
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Tag-triggered release. Push a `v<semver>` tag and CI: | |
| # | |
| # 1. Builds every workspace. | |
| # 2. Runs all package tests. | |
| # 3. Builds the wsd linux-x64 SEA binary (build-only — proves the | |
| # release tag still produces a working binary; not published). | |
| # 4. Stamps the tag's version into the publishable package. | |
| # 5. Publishes @cloudflare/workspace under a dist-tag picked from | |
| # the version: prerelease tags (`-alpha.N`, `-beta.N`, `-rc.N`) | |
| # publish under the matching suffix (`alpha`, `beta`, `rc`) | |
| # so plain `npm i @cloudflare/workspace` doesn't pick them up; | |
| # stable tags (no suffix) publish under `latest`. | |
| # 6. Pushes the wsd binary image to two registries: ghcr.io (the | |
| # canonical public source the example Dockerfiles reference) | |
| # and registry.cloudflare.com (so wrangler / Containers can | |
| # pull from inside Cloudflare's platform without an outbound | |
| # hop). Stable releases also move each registry's `:latest` | |
| # tag; prereleases only push the version-specific tag. | |
| # | |
| # The wsd binary is shipped two ways: | |
| # - inside the @cloudflare/workspace npm tarball at dist/bin/ | |
| # wsd-linux-x64, so consumers installing the package get it for | |
| # free; and | |
| # - as a single-layer container image, mirrored to both | |
| # ghcr.io/cloudflare/workspace-wsd-linux-x64 and | |
| # registry.cloudflare.com/library/workspace-wsd-linux-x64. The | |
| # example Dockerfiles pin the GHCR coordinate (anonymous pulls, | |
| # no Cloudflare-account dependency); the CF copy is kept for | |
| # consumers that prefer to stay on the in-platform registry. | |
| # | |
| # npm packages use trusted publishing (OIDC); no NPM_TOKEN is | |
| # needed, only the workflow's `id-token: write` permission plus a | |
| # trusted publisher config on the @cloudflare scope that names | |
| # this repo + this workflow file. | |
| # | |
| # Image pushes need: | |
| # - `packages: write` on the workflow's GITHUB_TOKEN (auto- | |
| # injected; used to authenticate to ghcr.io). | |
| # - Repository secrets CLOUDFLARE_API_TOKEN (scoped for Container | |
| # Registry Write on the target account) and | |
| # CLOUDFLARE_ACCOUNT_ID (used by .github/cf-registry-login.sh to | |
| # mint a short-lived library_push credential). | |
| # | |
| # One manual step is needed once, after the first push of the GHCR | |
| # package: flip the package visibility to Public at | |
| # https://github.com/orgs/cloudflare/packages/container/workspace-wsd-linux-x64/settings | |
| # Subsequent pushes inherit the public visibility automatically. | |
| # | |
| # Triggers: | |
| # - push: tags ['v*'] — the normal release path | |
| # - workflow_dispatch — manual re-run for a tag that already | |
| # exists, useful when the first run | |
| # failed after a partial publish. | |
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: "Tag to release (must already exist, e.g. v0.1.0-alpha.1)" | |
| required: true | |
| type: string | |
| concurrency: | |
| group: ${{ github.workflow }} | |
| cancel-in-progress: false | |
| jobs: | |
| release: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 30 | |
| permissions: | |
| # Trusted publishing on npm requires the OIDC id-token. | |
| id-token: write | |
| contents: read | |
| # GHCR push uses GITHUB_TOKEN with `packages: write`. | |
| packages: write | |
| if: ${{ github.repository_owner == 'cloudflare' }} | |
| env: | |
| # Used everywhere a version string is needed below. The push | |
| # path takes it from the tag; the manual path takes it from | |
| # the dispatch input. | |
| RELEASE_TAG: ${{ inputs.tag || github.ref_name }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| # On workflow_dispatch we need to check out the named tag | |
| # explicitly; the workflow itself runs from the default | |
| # branch otherwise. | |
| ref: ${{ env.RELEASE_TAG }} | |
| fetch-depth: 1 | |
| - uses: ./.github/actions/install | |
| with: | |
| registry-url: "https://registry.npmjs.org" | |
| # wsd's tests spawn the binary, which dynamically links | |
| # libfuse2 (fuse-native) and uses fuse3 helpers for the | |
| # FUSE_MOUNT=shim userspace mount path. Without these the wsd test | |
| # suite fails with `libfuse.so.2: cannot open shared object | |
| # file`. Mirrors the install in ci.yml. | |
| - name: Install system dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y --no-install-recommends libfuse2t64 fuse3 | |
| - name: Build all workspaces | |
| run: npm run build --workspaces --if-present | |
| - name: Test | |
| run: npm test --workspaces --if-present | |
| - name: Build wsd binary | |
| run: npm run build:bin --workspace @cloudflare/workspace-wsd | |
| # Short-term bundling: ship the linux-x64 wsd binary inside | |
| # @cloudflare/workspace under dist/bin/ — not registered as a | |
| # "bin" entry, so npm install won't try to symlink it on | |
| # non-linux hosts. Docker workflows reach in and copy it out | |
| # explicitly. Replace with a proper platform-package install | |
| # once we have more than one target. | |
| - name: Stage binary into @cloudflare/workspace | |
| run: | | |
| mkdir -p packages/workspace/dist/bin | |
| cp artifacts/wsd/wsd-linux-x64 packages/workspace/dist/bin/wsd-linux-x64 | |
| chmod +x packages/workspace/dist/bin/wsd-linux-x64 | |
| - name: Sync versions | |
| run: node script/set-versions.mjs "${RELEASE_TAG}" | |
| # Pick the npm dist-tag and decide whether this release moves | |
| # the `:latest` pointers. A stable semver (no `-` suffix) | |
| # publishes under `latest` and bumps the image's :latest tag; | |
| # a prerelease publishes under its prerelease channel | |
| # (`alpha`, `beta`, `rc`) and leaves :latest alone so a stale | |
| # alpha can't displace a real release. | |
| - name: Compute release metadata | |
| id: release-meta | |
| run: | | |
| version="${RELEASE_TAG#v}" | |
| if [[ "$version" == *-* ]]; then | |
| suffix="${version#*-}" | |
| npm_tag="${suffix%%.*}" | |
| is_stable=false | |
| else | |
| npm_tag=latest | |
| is_stable=true | |
| fi | |
| echo "version=${version}" >> "$GITHUB_OUTPUT" | |
| echo "npm_tag=${npm_tag}" >> "$GITHUB_OUTPUT" | |
| echo "is_stable=${is_stable}" >> "$GITHUB_OUTPUT" | |
| - name: Publish @cloudflare/workspace | |
| run: npm publish --workspace @cloudflare/workspace --tag "${{ steps.release-meta.outputs.npm_tag }}" --provenance --access public | |
| # Stage the SEA binary into the wsd-linux-x64 package's bin/ | |
| # directory — that package's Dockerfile copies from `bin/wsd` | |
| # against a `scratch` base, producing a single-layer image | |
| # whose only purpose is to ship the binary at a known path. | |
| - name: Stage binary into @cloudflare/workspace-wsd-linux-x64 | |
| run: | | |
| mkdir -p packages/wsd-linux-x64/bin | |
| cp artifacts/wsd/wsd-linux-x64 packages/wsd-linux-x64/bin/wsd | |
| chmod +x packages/wsd-linux-x64/bin/wsd | |
| - name: Set up buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # Mint a short-lived credential and log docker in to the | |
| # Cloudflare registry. The login script handles transient | |
| # failures and surfaces permanent ones as ::error::. | |
| - name: Log in to registry.cloudflare.com | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| run: | | |
| source .github/cf-registry-login.sh | |
| cf_registry_credentials 30 '["pull", "push", "library_push"]' | |
| echo "$CF_REGISTRY_PASSWORD" | docker login registry.cloudflare.com \ | |
| -u "$CF_REGISTRY_USERNAME" --password-stdin | |
| # The version-specific tag always goes out to both registries. | |
| # The `:latest` tag only moves on stable releases; empty | |
| # trailing lines in the `tags` list are tolerated by | |
| # build-push-action. One buildx invocation pushes to both | |
| # registries in parallel, sharing the layer build. | |
| - name: Build and push wsd-linux-x64 image | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: packages/wsd-linux-x64 | |
| file: packages/wsd-linux-x64/Dockerfile | |
| platforms: linux/amd64 | |
| push: true | |
| tags: | | |
| ghcr.io/cloudflare/workspace-wsd-linux-x64:${{ steps.release-meta.outputs.version }} | |
| ${{ steps.release-meta.outputs.is_stable == 'true' && 'ghcr.io/cloudflare/workspace-wsd-linux-x64:latest' || '' }} | |
| registry.cloudflare.com/library/workspace-wsd-linux-x64:${{ steps.release-meta.outputs.version }} | |
| ${{ steps.release-meta.outputs.is_stable == 'true' && 'registry.cloudflare.com/library/workspace-wsd-linux-x64:latest' || '' }} | |
| provenance: false |