PHPC-1584: Sign releases #1544
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| name: "Sign artifact using garasign" | ||
| description: "Signs a release artifact" | ||
| inputs: | ||
| command: | ||
| description: "Command to run inside the container" | ||
| required: true | ||
| garasign_username: | ||
| description: "Garasign username" | ||
| required: true | ||
| garasign_password: | ||
| description: "Garasign password" | ||
| required: true | ||
| artifactory_username: | ||
| description: "Artifactory user" | ||
| required: true | ||
| artifactory_password: | ||
| description: "Artifactory password" | ||
| required: true | ||
| artifactory_image: | ||
| description: "Image to use for artifactory" | ||
| default: release-tools-container-registry-local/garasign-git | ||
| artifactory_registry: | ||
| description: "Artifactory registry to be used" | ||
| default: artifactory.corp.mongodb.com | ||
| skip_setup: | ||
| description: "Whether to skip setup" | ||
| default: "false" | ||
|
|
||
| runs: | ||
| using: composite | ||
| steps: | ||
| - name: Prepare garasign container | ||
| if: ${{ inputs.skip_setup == 'false' }} | ||
| uses: ./.github/actions/garasign/setup | ||
| with: | ||
| garasign_username: ${{ inputs.garasign_username }} | ||
| garasign_password: ${{ inputs.garasign_password }} | ||
| artifactory_username: ${{ inputs.artifactory_username }} | ||
| artifactory_password: ${{ inputs.artifactory_password }} | ||
| artifactory_registry: ${{ inputs.artifactory_registry }} | ||
|
|
||
| - name: "Run git command" | ||
| run: | | ||
| podman run \ | ||
| --env-file=envfile \ | ||
| --rm \ | ||
| -v $(pwd):$(pwd) \ | ||
| -w $(pwd) \ | ||
| ${{ inputs.artifactory_registry }}/${{ inputs.artifactory_image }} \ | ||
| /bin/bash -c "gpgloader && ${{ inputs.command }}" | ||
| shell: bash | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| name: "Sign artifact using garasign" | ||
jmikola marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| description: "Signs a release artifact" | ||
| inputs: | ||
| filename: | ||
| description: "File name to sign" | ||
| required: true | ||
| garasign_username: | ||
| description: "Garasign username" | ||
| required: true | ||
| garasign_password: | ||
| description: "Garasign password" | ||
| required: true | ||
| artifactory_username: | ||
| description: "Artifactory user" | ||
| required: true | ||
| artifactory_password: | ||
| description: "Artifactory password" | ||
| required: true | ||
| artifactory_image: | ||
| description: "Image to use for artifactory" | ||
| default: release-tools-container-registry-local/garasign-gpg | ||
| artifactory_registry: | ||
| description: "Artifactory registry to be used" | ||
| default: artifactory.corp.mongodb.com | ||
|
|
||
| runs: | ||
| using: composite | ||
| steps: | ||
| - name: Prepare garasign container | ||
| uses: ./.github/actions/garasign/setup | ||
| with: | ||
| garasign_username: ${{ inputs.garasign_username }} | ||
| garasign_password: ${{ inputs.garasign_password }} | ||
| artifactory_username: ${{ inputs.artifactory_username }} | ||
| artifactory_password: ${{ inputs.artifactory_password }} | ||
| artifactory_registry: ${{ inputs.artifactory_registry }} | ||
|
|
||
| - name: "Create detached signature" | ||
| run: | | ||
| podman run \ | ||
| --env-file=envfile \ | ||
| --rm \ | ||
| -v $(pwd):$(pwd) \ | ||
| -w $(pwd) \ | ||
| ${{ inputs.artifactory_registry }}/${{ inputs.artifactory_image }} \ | ||
| /bin/bash -c "gpgloader && gpg --detach-sign --armor --output ${{ inputs.filename }}.sig ${{ inputs.filename }}" | ||
| shell: bash | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| name: "Prepare garasign container" | ||
| description: "Prepares the garasign container used to sign artifacts" | ||
| inputs: | ||
| garasign_username: | ||
| description: "Garasign username" | ||
| required: true | ||
| garasign_password: | ||
| description: "Garasign password" | ||
| required: true | ||
| artifactory_username: | ||
| description: "Artifactory user" | ||
| required: true | ||
| artifactory_password: | ||
| description: "Artifactory password" | ||
| required: true | ||
| artifactory_registry: | ||
| description: "Artifactory registry to be used" | ||
| default: artifactory.corp.mongodb.com | ||
|
|
||
| runs: | ||
| using: composite | ||
| steps: | ||
| - name: Create the envfile | ||
| run: | | ||
| cat << EOF > envfile | ||
jmikola marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| GRS_CONFIG_USER1_USERNAME=${{ inputs.garasign_username }} | ||
| GRS_CONFIG_USER1_PASSWORD=${{ inputs.garasign_password }} | ||
| EOF | ||
| shell: bash | ||
|
|
||
| - name: Log in to artifactory | ||
| uses: redhat-actions/podman-login@v1 | ||
| with: | ||
| username: ${{ inputs.artifactory_username }} | ||
| password: ${{ inputs.artifactory_password }} | ||
| registry: ${{ inputs.artifactory_registry }} | ||
File renamed without changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| #!/usr/bin/env bash | ||
| set -e | ||
|
|
||
| PACKAGE_VERSION=$1 | ||
| GPG_KEY_ID=$2 | ||
|
|
||
| gpgloader | ||
|
|
||
| # Create signed "Package x.y.z" commit | ||
| echo "Create package commit" | ||
| git commit -m "Package ${PACKAGE_VERSION}" -s --gpg-sign=${GPG_KEY_ID} phongo_version.h | ||
|
|
||
| # Create signed "Release x.y.z" tag | ||
| echo "Create release tag" | ||
| git tag -F changelog -s --local-user=${GPG_KEY_ID} ${PACKAGE_VERSION} | ||
jmikola marked this conversation as resolved.
Show resolved
Hide resolved
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -21,7 +21,7 @@ jobs: | |
| submodules: true | ||
|
|
||
| - name: "Build Driver" | ||
| uses: ./.github/actions/linux/build | ||
| with: | ||
| version: "8.3" | ||
|
|
||
|
|
@@ -38,27 +38,41 @@ jobs: | |
| # PECL always uses the version for the package name. | ||
| # Read it from the version file and store in env to use when uploading artifacts | ||
| - name: "Read current package version" | ||
| run: | | ||
| PACKAGE_VERSION=$(./bin/update-release-version.php get-version) | ||
| echo "PACKAGE_VERSION=${PACKAGE_VERSION}" >> "$GITHUB_ENV" | ||
| echo "PACKAGE_FILE=mongodb-${PACKAGE_VERSION}.tgz" >> "$GITHUB_ENV" | ||
|
|
||
| - name: "Create detached signature for PECL package" | ||
| uses: ./.github/actions/garasign/gpg-sign | ||
| with: | ||
| filename: ${{ env.PACKAGE_FILE }} | ||
| garasign_username: ${{ secrets.GRS_CONFIG_USER1_USERNAME }} | ||
alcaeus marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| garasign_password: ${{ secrets.GRS_CONFIG_USER1_PASSWORD }} | ||
| artifactory_username: ${{ secrets.ARTIFACTORY_USER }} | ||
| artifactory_password: ${{ secrets.ARTIFACTORY_PASSWORD }} | ||
|
|
||
| - name: "Install release archive to verify correctness" | ||
| run: sudo pecl install ${{ env.PACKAGE_FILE }} | ||
|
|
||
| - name: "Upload artifacts" | ||
|
There was a problem hiding this comment. I realize these steps predate the PR, but can you remind me why we use both actions/upload-artifact and The only prior art that comes to mind was how we handle Windows DLLs by temporarily storing them on an action (from the build step) and having the release action transfer them to the GitHub release. There was a problem hiding this comment. Since this workflow is enabled for every tag, I wanted to upload the artifacts to the build as well in case we push a tag manually (e.g. for a pre-release) where there is no draft release yet. In that case, we'd still be able to download the artifacts manually and upload them to the release manually. I'm happy to remove this once we've covered every possible angle of the release process. |
||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: ${{ env.PACKAGE_FILE }} | ||
| path: | | ||
| ${{ env.PACKAGE_FILE }} | ||
| ${{ env.PACKAGE_FILE }}.sig | ||
| retention-days: 3 | ||
|
|
||
| - name: "Upload release artifacts" | ||
| run: gh release upload ${{ github.ref_name }} ${{ env.PACKAGE_FILE }} ${{ env.PACKAGE_FILE }}.sig | ||
| continue-on-error: true | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| build-windows: | ||
| name: "Create Windows package" | ||
| runs-on: windows-latest | ||
|
There was a problem hiding this comment. Using windows-latest is necessary to be able to share the cached build artifacts. |
||
| defaults: | ||
| run: | ||
| shell: cmd | ||
|
|
@@ -78,7 +92,7 @@ jobs: | |
|
|
||
| - name: "Build Driver" | ||
| id: build-driver | ||
| uses: ./.github/actions/windows/build | ||
| with: | ||
| version: ${{ matrix.php }} | ||
| arch: ${{ matrix.arch }} | ||
|
|
@@ -91,20 +105,68 @@ jobs: | |
| env: | ||
| BUILD_DIR: ${{ steps.build-driver.outputs.build-dir }} | ||
|
|
||
| - name: "Cache build artifacts for subsequent builds" | ||
| uses: actions/cache/save@v4 | ||
| with: | ||
| key: ${{ github.sha }}-${{ matrix.php }}-${{ matrix.ts }}-${{ matrix.arch }} | ||
| enableCrossOsArchive: true | ||
jmikola marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| path: | | ||
| php_mongodb.dll | ||
| php_mongodb.pdb | ||
|
|
||
| sign-and-publish-windows: | ||
| name: "Sign and Publish Windows package" | ||
| needs: [build-windows] | ||
| runs-on: "ubuntu-latest" | ||
|
|
||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| # Note: keep this in sync with the Windows matrix in windows-tests.yml | ||
| php: [ "7.4", "8.0", "8.1", "8.2", "8.3" ] | ||
| arch: [ x64, x86 ] | ||
| ts: [ ts, nts ] | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| submodules: true | ||
jmikola marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| - name: Restore cached build artifacts | ||
| id: cache-build-artifacts | ||
| uses: actions/cache/restore@v4 | ||
| with: | ||
| fail-on-cache-miss: true | ||
| key: ${{ github.sha }}-${{ matrix.php }}-${{ matrix.ts }}-${{ matrix.arch }} | ||
| enableCrossOsArchive: true | ||
jmikola marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| path: | | ||
| php_mongodb.dll | ||
| php_mongodb.pdb | ||
|
|
||
| - name: "Create detached DLL signature" | ||
| uses: ./.github/actions/garasign/gpg-sign | ||
| with: | ||
| filename: php_mongodb.dll | ||
| garasign_username: ${{ secrets.GRS_CONFIG_USER1_USERNAME }} | ||
| garasign_password: ${{ secrets.GRS_CONFIG_USER1_PASSWORD }} | ||
| artifactory_username: ${{ secrets.ARTIFACTORY_USER }} | ||
| artifactory_password: ${{ secrets.ARTIFACTORY_PASSWORD }} | ||
|
|
||
| - name: "Upload DLL and PDB files as build artifacts" | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: php_mongodb-${{ github.sha }}-${{ matrix.php }}-${{ matrix.ts }}-${{ matrix.arch }} | ||
jmikola marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| path: | | ||
| php_mongodb.dll | ||
| php_mongodb.dll.sig | ||
| php_mongodb.pdb | ||
| retention-days: 3 | ||
|
|
||
| - name: "Create and upload release artifact" | ||
| run: | | ||
| ARCHIVE=php_mongodb-${{ github.ref_name }}-${{ matrix.php }}-${{ matrix.ts }}-${{ matrix.arch }}.zip | ||
| zip ${ARCHIVE} php_mongodb.dll php_mongodb.dll.sig php_mongodb.pdb CREDITS CONTRIBUTING.md LICENSE README.md THIRD_PARTY_NOTICES | ||
| gh release upload ${{ github.ref_name }} ${ARCHIVE} | ||
| continue-on-error: true | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.