release: 4.179.0 #73
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Exact-head release PR readiness | |
| on: | |
| pull_request_target: | |
| branches: [master] | |
| types: [opened, reopened, synchronize, ready_for_review] | |
| workflow_dispatch: | |
| inputs: | |
| pr_number: | |
| description: Release Please PR number | |
| required: true | |
| type: number | |
| expected_head: | |
| description: Exact 40-character PR head SHA | |
| required: true | |
| type: string | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| checks: read | |
| statuses: write | |
| actions: read | |
| concurrency: | |
| group: release-pr-readiness-${{ github.event.pull_request.number || inputs.pr_number }} | |
| cancel-in-progress: true | |
| jobs: | |
| release-provenance: | |
| if: >- | |
| github.event_name == 'workflow_dispatch' || | |
| github.event.pull_request.state == 'open' | |
| runs-on: ubuntu-latest | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| EVENT_PR_NUMBER: ${{ github.event.pull_request.number }} | |
| EVENT_HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| EVENT_HEAD_REF: ${{ github.event.pull_request.head.ref }} | |
| EVENT_HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }} | |
| EVENT_TITLE: ${{ github.event.pull_request.title }} | |
| INPUT_PR_NUMBER: ${{ inputs.pr_number }} | |
| INPUT_EXPECTED_HEAD: ${{ inputs.expected_head }} | |
| GH_TOKEN: ${{ github.token }} | |
| steps: | |
| - name: Resolve immutable candidate | |
| id: candidate | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| if [ "$EVENT_NAME" = "workflow_dispatch" ]; then | |
| PR_NUMBER="$INPUT_PR_NUMBER" | |
| HEAD_SHA="$INPUT_EXPECTED_HEAD" | |
| CANDIDATE=true | |
| else | |
| PR_NUMBER="$EVENT_PR_NUMBER" | |
| HEAD_SHA="$EVENT_HEAD_SHA" | |
| if [[ "$EVENT_HEAD_REF" == release-please--* ]] && \ | |
| [[ "$EVENT_TITLE" == release:\ * ]] && \ | |
| [ "$EVENT_HEAD_REPOSITORY" = "$GITHUB_REPOSITORY" ]; then | |
| CANDIDATE=true | |
| else | |
| CANDIDATE=false | |
| fi | |
| fi | |
| if [[ ! "$HEAD_SHA" =~ ^[0-9a-f]{40}$ ]]; then | |
| echo "Invalid immutable head SHA" >&2 | |
| exit 1 | |
| fi | |
| { | |
| echo "pr_number=$PR_NUMBER" | |
| echo "head_sha=$HEAD_SHA" | |
| echo "candidate=$CANDIDATE" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Mark non-release PR as not applicable | |
| if: steps.candidate.outputs.candidate == 'false' | |
| env: | |
| HEAD_SHA: ${{ steps.candidate.outputs.head_sha }} | |
| run: | | |
| gh api "repos/$GITHUB_REPOSITORY/statuses/$HEAD_SHA" \ | |
| --method POST \ | |
| --raw-field state=success \ | |
| --raw-field context=release-provenance \ | |
| --raw-field description='Not a Release Please PR; provenance gate not applicable' | |
| - name: Mark release provenance pending | |
| if: steps.candidate.outputs.candidate == 'true' | |
| env: | |
| HEAD_SHA: ${{ steps.candidate.outputs.head_sha }} | |
| run: | | |
| gh api "repos/$GITHUB_REPOSITORY/statuses/$HEAD_SHA" \ | |
| --method POST \ | |
| --raw-field state=pending \ | |
| --raw-field context=release-provenance \ | |
| --raw-field description='Attesting exact release head and immutable lineage' | |
| # pull_request_target executes trusted default-branch workflow code. Never | |
| # checkout or execute the pull-request head in this privileged job. | |
| - name: Check out trusted default-branch policy | |
| if: steps.candidate.outputs.candidate == 'true' | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ github.event.repository.default_branch || 'main' }} | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Attest exact release head without merging | |
| id: attest | |
| if: steps.candidate.outputs.candidate == 'true' | |
| continue-on-error: true | |
| env: | |
| MERGE_TOKEN: ${{ secrets.SDK_WRITE_TOKEN }} | |
| PR_NUMBER: ${{ steps.candidate.outputs.pr_number }} | |
| HEAD_SHA: ${{ steps.candidate.outputs.head_sha }} | |
| run: | | |
| python3 .github/scripts/release_pr_auto_merge.py \ | |
| --pr-number "$PR_NUMBER" \ | |
| --expected-head "$HEAD_SHA" \ | |
| --dry-run | |
| - name: Publish exact-head release provenance result | |
| if: always() && steps.candidate.outputs.candidate == 'true' | |
| env: | |
| HEAD_SHA: ${{ steps.candidate.outputs.head_sha }} | |
| OUTCOME: ${{ steps.attest.outcome }} | |
| run: | | |
| set -euo pipefail | |
| if [ "$OUTCOME" = "success" ]; then | |
| STATE=success | |
| DESCRIPTION='Exact release head, lineage, metadata, and checks are ready' | |
| else | |
| STATE=failure | |
| DESCRIPTION='Exact release readiness attestation failed closed' | |
| fi | |
| gh api "repos/$GITHUB_REPOSITORY/statuses/$HEAD_SHA" \ | |
| --method POST \ | |
| --raw-field state="$STATE" \ | |
| --raw-field context=release-provenance \ | |
| --raw-field description="$DESCRIPTION" | |
| [ "$STATE" = success ] |