Migrate release process to GitHub actions (release-1.0)

.github/workflows/release.yml → .github/workflows/release-build-artifacts.yml

@@ -1,4 +1,4 @@
-name: Release
+name: Release - build and store artifacts
 on:
   push:
     tags:
@@ -11,38 +11,37 @@ defaults:
   run:
     shell: pwsh
 jobs:
-  release:
+  build-and-store-artifacts:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
       - name: Setup .NET SDK
-        uses: actions/setup-dotnet@v5.3.0
+        uses: actions/setup-dotnet@v6.0.0
         with:
           global-json-file: global.json
       - name: Build
         run: dotnet build src --configuration Release
       - name: Sign NuGet packages
         uses: Particular/sign-nuget-packages-action@v1.0.0
         with:
-          client-id: ${{ secrets.AZURE_KEY_VAULT_CLIENT_ID }}
-          tenant-id: ${{ secrets.AZURE_KEY_VAULT_TENANT_ID }}
-          client-secret: ${{ secrets.AZURE_KEY_VAULT_CLIENT_SECRET }}
-          certificate-name: ${{ secrets.AZURE_KEY_VAULT_CERTIFICATE_NAME }}
-      - name: Publish artifacts
-        uses: actions/upload-artifact@v7.0.1
+         client-id: ${{ secrets.AZURE_KEY_VAULT_CLIENT_ID }}
+         tenant-id: ${{ secrets.AZURE_KEY_VAULT_TENANT_ID }}
+         client-secret: ${{ secrets.AZURE_KEY_VAULT_CLIENT_SECRET }}
+         certificate-name: ${{ secrets.AZURE_KEY_VAULT_CERTIFICATE_NAME }}
+      - name: Publish NuGet packages to the workflow
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: nugets
           path: nugets/*
           retention-days: 1
       - name: Push packages to testing feed
         if: ${{ github.event_name == 'workflow_dispatch' }}
         run: dotnet nuget push nugets\*.nupkg --api-key ${{ secrets.FEEDZIO_PUBLISH_API_KEY }} --source "${{ vars.PARTICULAR_TESTING_FEED_URL }}"
-      - name: Deploy
+      - name: Create draft release and attach artifacts
         if: ${{ github.event_name == 'push' && github.ref_type == 'tag' }}
-        # Does not follow standard practice of targeting explicit versions because configuration is tightly coupled to Octopus Deploy configuration
-        uses: Particular/push-octopus-package-action@main
+        uses: particular/deployment-workflows/.github/actions/create-draft-release-with-assets@1.0.0
         with:
-          octopus-deploy-api-key: ${{ secrets.OCTOPUS_DEPLOY_API_KEY }}
+          asset-paths: "nugets/"

.github/workflows/release-deploy-production.yml

@@ -0,0 +1,46 @@
+name: Deploy Production
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        required: true
+        type: string
+env:
+  DOTNET_NOLOGO: true
+jobs:
+  check-authorized-user:
+    uses: Particular/deployment-workflows/.github/workflows/verify-authorized-user.yml@1.0.0
+  publish-release-notes:
+    needs: check-authorized-user
+    uses: Particular/deployment-workflows/.github/workflows/publish-release-notes.yml@1.0.0
+    with:
+      version: ${{ inputs.version }}
+    secrets: inherit
+  virus-scan:
+    needs: publish-release-notes
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Scan release for viruses
+        uses: Particular/virus-scan-action@main
+        with:
+          owner: ${{ github.repository_owner }}
+          repo: ${{ github.event.repository.name }}
+          tag: ${{ inputs.version }}
+          github-access-token: ${{ secrets.GITHUB_TOKEN }}
+          slack-token: ${{ secrets.SLACK_TOKEN }}
+          slack-channel: ${{ vars.VIRUS_REPORTING_SLACK_CHANNEL }}
+  push-nuget-packages:
+    permissions:
+      id-token: write
+      contents: read
+    runs-on: ubuntu-latest
+    needs: publish-release-notes
+    steps:
+        - name: Push NuGet packages
+          uses: particular/deployment-workflows/.github/actions/push-nuget-packages@1.0.0
+          with:
+            version: ${{ inputs.version }}
+            deploy-environment: production
+            api-key: required-but-real-value-not-needed-we-use-trusted-publishing-for-production

.github/workflows/release-deploy-staging.yml

@@ -0,0 +1,31 @@
+name: Deploy Staging
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        required: true
+        type: string
+env:
+  DOTNET_NOLOGO: true
+jobs:
+  check-authorized-user:
+    uses: Particular/deployment-workflows/.github/workflows/verify-authorized-user.yml@1.0.0
+  push-nuget-packages-staging:
+    needs: check-authorized-user
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: write
+    steps:
+      - name: Push NuGet packages
+        uses: Particular/deployment-workflows/.github/actions/push-nuget-packages@1.0.0
+        with:
+          version: ${{ inputs.version }}
+          deploy-environment: staging
+          api-key: ${{ secrets.FEEDZIO_PUBLISH_API_KEY }}
+  generate-release-notes:
+    needs: check-authorized-user
+    uses: Particular/deployment-workflows/.github/workflows/generate-release-notes.yml@1.0.0
+    with:
+      version: ${{ inputs.version }}
+    secrets: inherit

.release/.templates/default/create/footer.sbn

@@ -0,0 +1,10 @@
+{{ if config.create.include_footer }}
+
+### Where to get it
+
+<!-- TODO change the link for the apps that don't go to NuGet -->
+You can download this release from [NuGet](https://www.nuget.org/profiles/ParticularSoftware/).
+
+{{ end }}
+
+<!-- RELEASE NOTES GENERATED -->

.release/.templates/default/issue-note.sbn

@@ -0,0 +1,6 @@
+{{
+    if issue.is_pull_request
+}}- [__#{{ issue.public_number }}__]({{ issue.html_url }}) {{ issue.title }}
+{{  else
+}}- [__#{{ issue.public_number }}__]({{ issue.html_url }}) {{ issue.title }}
+{{  end -}}

.release/GitReleaseManager.yaml

@@ -0,0 +1,10 @@
+templates-dir: .templates
+create:
+  include-footer: true
+issue-labels-include:
+  - "Bug"
+  - "Feature"
+  - "Improvement"
+  - "Dependency CVE"
+issue-labels-exclude:
+  - "Refactoring"