Zanie Blue
6b1ebc33dc
The way this works is 1. `release-gate` is an environment which requires approval from another person in the organization 2. Once approved, the release can continue 3. GitHub then requires approval for every subsequent job, which we use the `release` environment for 4. We do not require team members to approve on the `release` environment because we run _many_ child jobs during releases 5. The `release` environment uses a deployment protection rule which queries a GitHub App we manage 6. The GitHub App checks if the `release-gate` job was successful in the same workflow and approves or denies accordingly The GitHub App's source is at https://github.com/open-security-tools/ost-environment-gate and includes another explanation of what's going on in this process. We don't make the release-gate block everything, so builds can start at least while we wait for the release-gate to be approved.
61 lines
2.2 KiB
YAML
61 lines
2.2 KiB
YAML
# Publish uv releases to a mirror
|
|
#
|
|
# Assumed to run as a subworkflow of .github/workflows/release.yml as a custom publish job
|
|
name: publish-mirror
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
plan:
|
|
required: true
|
|
type: string
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
publish-mirror:
|
|
runs-on: ubuntu-latest
|
|
environment:
|
|
name: release
|
|
env:
|
|
VERSION: ${{ fromJson(inputs.plan).announcement_tag }}
|
|
steps:
|
|
- name: "Download GitHub Artifacts"
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
|
|
with:
|
|
pattern: artifacts-*
|
|
path: artifacts
|
|
merge-multiple: true
|
|
- name: "Upload to R2"
|
|
env:
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.MIRROR_R2_ACCESS_KEY_ID }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.MIRROR_R2_SECRET_ACCESS_KEY }}
|
|
AWS_ENDPOINT_URL: https://${{ secrets.MIRROR_R2_CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com
|
|
AWS_DEFAULT_REGION: auto
|
|
R2_BUCKET: ${{ secrets.MIRROR_R2_BUCKET_NAME }}
|
|
PROJECT: uv
|
|
run: |
|
|
aws s3 cp --recursive --output table --color on \
|
|
--exclude '*' \
|
|
--include '*.zip' --include '*.zip.sha256' \
|
|
--include '*.tar.gz' --include '*.tar.gz.sha256' \
|
|
--include sha256.sum --include '*.ps1' --include '*.sh' \
|
|
--cache-control "public, max-age=31536000, immutable" \
|
|
artifacts/ \
|
|
s3://${R2_BUCKET}/github/$PROJECT/releases/download/$VERSION/
|
|
- name: "Upload latest installers to R2"
|
|
if: ${{ !fromJson(inputs.plan).announcement_is_prerelease }}
|
|
env:
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.MIRROR_R2_ACCESS_KEY_ID }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.MIRROR_R2_SECRET_ACCESS_KEY }}
|
|
AWS_ENDPOINT_URL: https://${{ secrets.MIRROR_R2_CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com
|
|
AWS_DEFAULT_REGION: auto
|
|
R2_BUCKET: ${{ secrets.MIRROR_R2_BUCKET_NAME }}
|
|
run: |
|
|
for installer in uv-installer.sh uv-installer.ps1; do
|
|
aws s3 cp --output table --color on \
|
|
--cache-control "public, max-age=300" \
|
|
"artifacts/${installer}" \
|
|
"s3://${R2_BUCKET}/installers/uv/latest/${installer}"
|
|
done
|