mirror of
https://github.com/lukaszraczylo/semver-generator.git
synced 2026-10-12 00:45:45 +00:00
lukaszraczylo
f7ae4c042f
The release job moves the rolling v1 tag to the release commit. The update-action-version job then pins action.yml to the new image in a later commit. So v1 always pointed at a commit that pinned the previous image, and "@v1" users ran the previous release. The job now checks out the released commit, pushes the pin commit with "git push origin HEAD:main", and moves v1 onto it after that push succeeds. If main moved during the release, the push fails and v1 stays where it is. The job runs only for main, and a concurrency group queues overlapping release runs. Claude-Session: https://claude.ai/code/session_01Qq1gbqQek1Zjtofo4VDRdW
73 lines
2.5 KiB
YAML
73 lines
2.5 KiB
YAML
name: Test, build, release
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
paths-ignore:
|
|
- '**.md'
|
|
- '**/release.yaml'
|
|
branches:
|
|
- main
|
|
|
|
permissions:
|
|
id-token: write
|
|
contents: write
|
|
packages: write
|
|
|
|
concurrency:
|
|
group: release-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
release:
|
|
uses: lukaszraczylo/shared-actions/.github/workflows/go-release.yaml@main
|
|
with:
|
|
go-version: ">=1.25"
|
|
docker-enabled: true
|
|
rolling-release-tag: "v1"
|
|
semver-config: "config-release.yaml"
|
|
secrets: inherit
|
|
|
|
update-action-version:
|
|
needs: release
|
|
runs-on: ubuntu-latest
|
|
if: github.ref == 'refs/heads/main' && needs.release.outputs.version != ''
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ github.sha }}
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Update action.yml with release version
|
|
env:
|
|
VERSION: ${{ needs.release.outputs.version }}
|
|
run: |
|
|
echo "Updating action.yml to version: ${VERSION}"
|
|
sed -i "s|ghcr.io/lukaszraczylo/semver-generator:[^\"]*|ghcr.io/lukaszraczylo/semver-generator:${VERSION}|" action.yml
|
|
echo "Updated action.yml:"
|
|
grep "image:" action.yml
|
|
|
|
- name: Commit and push
|
|
run: |
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "github-actions[bot]@users.noreply.github.com"
|
|
git add action.yml
|
|
if git diff --staged --quiet; then
|
|
echo "No changes to commit"
|
|
else
|
|
git commit -m "chore: pin action.yml Docker image to v${{ needs.release.outputs.version }}"
|
|
# Push the pin commit onto main explicitly (not just "git push"):
|
|
# this checkout started from the released commit (github.sha), not
|
|
# main's tip, so if main moved in the meantime this push is a
|
|
# non-fast-forward and fails safely instead of overwriting it.
|
|
git push origin HEAD:main
|
|
# Only move the rolling tag once the pin commit is confirmed on
|
|
# main. The "release" job above already moved it to the release
|
|
# commit, but this job then commits action.yml's image pin on top
|
|
# of that, so without this the rolling tag would always be one
|
|
# commit behind, pinning the PREVIOUS image.
|
|
# "v1" must match the release job's rolling-release-tag input.
|
|
git tag -f v1 HEAD
|
|
git push -f origin refs/tags/v1
|
|
fi
|