ci: add all-GCP Artifact Registry release workflow (#21) #18
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # interlock release — rendered by distribution/render.mjs; hand-install into operatorstack/interlock's | |
| # .github/workflows/ (control plane can't be projected). Builds prebuilt binaries + bindings and | |
| # publishes them to GCP Artifact Registry (fronted by get.operatorstack.systems). No GitHub Releases. | |
| # | |
| # The AR project/location/repos come from repo VARIABLES (not hardcoded) so the private project id | |
| # never lands in public source. Set on operatorstack/interlock: | |
| # vars: WIF_PROVIDER, DEPLOYER_SA_EMAIL (the pkg-deployer SA), | |
| # AR_PROJECT, AR_LOCATION, AR_GENERIC_REPO, AR_NPM_REPO, AR_PYTHON_REPO | |
| name: release-interlock | |
| on: | |
| push: | |
| tags: ["v*"] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| id-token: write # Workload Identity Federation — no keys | |
| attestations: write # build provenance | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: { fetch-depth: 0 } | |
| - uses: actions/setup-go@v5 | |
| with: { go-version: "stable" } | |
| - uses: actions/setup-node@v4 | |
| with: { node-version: "22" } | |
| - uses: actions/setup-python@v5 | |
| with: { python-version: "3.11" } | |
| - id: auth | |
| uses: google-github-actions/auth@v2 | |
| with: | |
| workload_identity_provider: ${{ vars.WIF_PROVIDER }} | |
| service_account: ${{ vars.DEPLOYER_SA_EMAIL }} | |
| - uses: google-github-actions/setup-gcloud@v2 | |
| # google-github-actions/auth writes gha-creds-*.json into the workspace; exclude it so | |
| # goreleaser's clean-tree check does not fail with "git is in a dirty state". | |
| - name: keep the tree clean for goreleaser | |
| run: echo 'gha-creds-*.json' >> .git/info/exclude | |
| - name: build binaries + checksums + SBOM | |
| uses: goreleaser/goreleaser-action@v6 | |
| with: | |
| version: "~> v2" | |
| args: release --clean | |
| env: | |
| # goreleaser's changelog (use: github) calls the compare API even when the GitHub | |
| # release is disabled; without a token it 401s. contents:read is enough. | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: attest build provenance | |
| uses: actions/attest-build-provenance@v2 | |
| with: | |
| subject-path: "dist/interlock_*.tar.gz, dist/interlock_*.zip, dist/checksums.txt" | |
| - name: publish binaries -> Artifact Registry (generic) | |
| run: | | |
| set -euo pipefail | |
| VER="${GITHUB_REF_NAME}" | |
| for f in dist/interlock_*.tar.gz dist/interlock_*.zip dist/checksums.txt; do | |
| [ -e "$f" ] || continue | |
| gcloud artifacts generic upload \ | |
| --project="${{ vars.AR_PROJECT }}" --location="${{ vars.AR_LOCATION }}" \ | |
| --repository="${{ vars.AR_GENERIC_REPO }}" \ | |
| --package=interlock --version="${VER}" --source="$f" | |
| done | |
| - name: update latest channel manifest | |
| run: | | |
| set -euo pipefail | |
| printf '{"version":"%s"}\n' "${GITHUB_REF_NAME}" > latest.json | |
| gcloud artifacts generic upload \ | |
| --project="${{ vars.AR_PROJECT }}" --location="${{ vars.AR_LOCATION }}" \ | |
| --repository="${{ vars.AR_GENERIC_REPO }}" \ | |
| --package=interlock-channel --version=latest --source=latest.json | |
| - name: publish npm binding (@operatorstack/interlock) | |
| working-directory: clients/typescript | |
| run: | | |
| set -euo pipefail | |
| gcloud artifacts print-settings npm \ | |
| --project="${{ vars.AR_PROJECT }}" --location="${{ vars.AR_LOCATION }}" \ | |
| --repository="${{ vars.AR_NPM_REPO }}" --scope=@operatorstack > .npmrc | |
| npx -y google-artifactregistry-auth .npmrc | |
| npm publish | |
| - name: publish python binding (interlock-protocol) | |
| working-directory: clients/python | |
| run: | | |
| set -euo pipefail | |
| pip install --quiet build twine keyrings.google-artifactregistry-auth | |
| python -m build | |
| twine upload \ | |
| --repository-url "https://${{ vars.AR_LOCATION }}-python.pkg.dev/${{ vars.AR_PROJECT }}/${{ vars.AR_PYTHON_REPO }}/" \ | |
| dist/* |