-
-
Notifications
You must be signed in to change notification settings - Fork 4.8k
94 lines (79 loc) · 3.28 KB
/
Copy pathrelease.yml
File metadata and controls
94 lines (79 loc) · 3.28 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
name: "Release"
on:
push:
tags:
- "*"
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
permissions: {}
env:
COMPOSER_FLAGS: "--ansi --no-interaction --no-progress --no-suggest --prefer-dist"
jobs:
build:
permissions:
contents: write # for gh to create a release
id-token: write # for actions/attest to create a attestation certificate
attestations: write # for actions/attest to upload the attestation
name: Upload Release Asset
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
with:
coverage: "none"
extensions: "intl"
ini-values: "memory_limit=-1"
php-version: "8.4"
tools: "composer:snapshot"
- name: "Install dependencies from composer.lock using composer binary provided by system"
run: 'composer install $COMPOSER_FLAGS'
- name: "Run install again using composer binary from source"
run: 'bin/composer install $COMPOSER_FLAGS'
- name: "Validate composer.json"
run: "bin/composer validate"
- name: Build phar file
run: "php -d phar.readonly=0 bin/compile"
- name: Generate build provenance attestation
uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
with:
subject-path: '${{ github.workspace }}/composer.phar'
- name: Configure GPG key and sign phar
run: |
mkdir -p ~/.gnupg/
chmod 0700 ~/.gnupg/
echo "$GPG_SIGNING_KEY" > ~/.gnupg/private.key
gpg --import ~/.gnupg/private.key
gpg -u contact@packagist.com --detach-sign --output composer.phar.asc composer.phar
env:
GPG_SIGNING_KEY: |
${{ secrets.GPG_KEY_161DFBE342889F01DDAC4E61CBB3D576F2A0946F }}
- name: Create release
env:
GH_TOKEN: ${{ github.token }}
REF_NAME: ${{ github.ref_name }}
run: gh release create "$REF_NAME" --title "$REF_NAME" --notes TODO --draft --verify-tag
- name: Upload release assets
env:
GH_TOKEN: ${{ github.token }}
REF_NAME: ${{ github.ref_name }}
run: gh release upload "$REF_NAME" composer.phar composer.phar.asc --clobber
# This step requires a secret token with `pull` access to composer/docker. The default
# secrets.GITHUB_TOKEN is scoped to this repository only which is not sufficient.
- name: "Open issue @ Docker repository"
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
REPO_OWNER: ${{ github.repository_owner }}
REPOSITORY: ${{ github.repository }}
REF_NAME: ${{ github.ref_name }}
with:
github-token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
script: |
// create new issue on Docker repository
github.rest.issues.create({
owner: process.env.REPO_OWNER,
repo: "docker",
title: `New Composer tag: ${process.env.REF_NAME}`,
body: `https://github.com/${process.env.REPOSITORY}/releases/tag/${process.env.REF_NAME}`,
});