interlock/.github/workflows/release.yml at main · operatorstack/interlock · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
# interlock release — rendered by distribution/render.mjs; hand-install into operatorstack/interlock's
# .github/workflows/ (control plane can't be projected). Builds prebuilt binaries + bindings and
# publishes them to GCP Artifact Registry (fronted by get.operatorstack.systems). No GitHub Releases.
#
# The AR project/location/repos come from repo VARIABLES (not hardcoded) so the private project id
# never lands in public source. Set on operatorstack/interlock:
#   vars: WIF_PROVIDER, DEPLOYER_SA_EMAIL (the pkg-deployer SA),
#         AR_PROJECT, AR_LOCATION, AR_GENERIC_REPO, AR_NPM_REPO, AR_PYTHON_REPO
name: release-interlock

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: read
  id-token: write # Workload Identity Federation — no keys
  attestations: write # build provenance

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: actions/setup-go@v5
        with: { go-version: "stable" }
      - uses: actions/setup-node@v4
        with: { node-version: "22" }
      - uses: actions/setup-python@v5
        with: { python-version: "3.11" }

      - id: auth
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ vars.WIF_PROVIDER }}
          service_account: ${{ vars.DEPLOYER_SA_EMAIL }}
      - uses: google-github-actions/setup-gcloud@v2

      # goreleaser's `sboms` block shells out to syft; install it so the SBOM step succeeds.
      - name: install syft (SBOM)
        uses: anchore/sbom-action/download-syft@v0

      # google-github-actions/auth writes gha-creds-*.json into the workspace; exclude it so
      # goreleaser's clean-tree check does not fail with "git is in a dirty state".
      - name: keep the tree clean for goreleaser
        run: echo 'gha-creds-*.json' >> .git/info/exclude

      - name: build binaries + checksums + SBOM
        uses: goreleaser/goreleaser-action@v6
        with:
          version: "~> v2"
          args: release --clean
        env:
          # goreleaser's changelog (use: github) calls the compare API even when the GitHub
          # release is disabled; without a token it 401s. contents:read is enough.
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: attest build provenance
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: "dist/interlock_*.tar.gz, dist/interlock_*.zip, dist/checksums.txt"

      - name: publish binaries -> Artifact Registry (generic)
        run: |
          set -euo pipefail
          VER="${GITHUB_REF_NAME#v}"   # strip the leading v; goreleaser archives are named without it
          for f in dist/interlock_*.tar.gz dist/interlock_*.zip dist/checksums.txt; do
            [ -e "$f" ] || continue
            gcloud artifacts generic upload \
              --project="${{ vars.AR_PROJECT }}" --location="${{ vars.AR_LOCATION }}" \
              --repository="${{ vars.AR_GENERIC_REPO }}" \
              --package=interlock --version="${VER}" --source="$f"
          done

      # "latest" is resolved by the get-service from the AR version list — no channel manifest
      # (AR rejects non-semver version ids like "latest").

      - name: publish npm binding (@operatorstack/interlock)
        working-directory: clients/typescript
        run: |
          set -euo pipefail
          npm version "${GITHUB_REF_NAME#v}" --no-git-tag-version --allow-same-version
          gcloud artifacts print-settings npm \
            --project="${{ vars.AR_PROJECT }}" --location="${{ vars.AR_LOCATION }}" \
            --repository="${{ vars.AR_NPM_REPO }}" --scope=@operatorstack > .npmrc
          npx -y google-artifactregistry-auth .npmrc
          npm publish

      - name: publish python binding (interlock-protocol)
        working-directory: clients/python
        run: |
          set -euo pipefail
          sed -i "s/^version = .*/version = \"${GITHUB_REF_NAME#v}\"/" pyproject.toml
          pip install --quiet build twine keyrings.google-artifactregistry-auth
          python -m build
          twine upload \
            --repository-url "https://${{ vars.AR_LOCATION }}-python.pkg.dev/${{ vars.AR_PROJECT }}/${{ vars.AR_PYTHON_REPO }}/" \
            dist/*