wehub-resource-sync
70bf21e064
Handle Changesets / Handle Changesets (push) Waiting to run
Semgrep OSS scan / semgrep-oss (push) Waiting to run
Deploy (to testing) and Test Playground Preview Worker / Deploy Playground Preview Worker (testing) (push) Has been skipped
Deploy Workers Shared Staging / Deploy Workers Shared Staging (push) Failing after 0s
Prerelease / build (push) Has been skipped
83 lines
2.7 KiB
YAML
83 lines
2.7 KiB
YAML
name: Release a hotfix
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
pr-number:
|
|
description: "Which PR should be released?"
|
|
required: true
|
|
confirm:
|
|
description: "Confirm that the PR is up to date with the last published release, with the specific additional changes that should be released as part of this hotfix and the relevant package patch versions bumped"
|
|
type: boolean
|
|
required: true
|
|
label:
|
|
description: "Which dist-tag should this release have?"
|
|
type: string
|
|
default: hotfix
|
|
required: true
|
|
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
|
|
jobs:
|
|
hotfix-release:
|
|
name: Hotfix Release
|
|
if: ${{ inputs.confirm == true }}
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout Repo
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Check user for team affiliation
|
|
uses: tspascoal/get-user-teams-membership@ba78054988f58bea69b7c6136d563236f8ed2fc0 # v2
|
|
id: teamAffiliation
|
|
with:
|
|
GITHUB_TOKEN: ${{ secrets.READ_ONLY_ORG_GITHUB_TOKEN }}
|
|
username: ${{ github.actor }}
|
|
team: wrangler
|
|
|
|
- name: Stop workflow if user is not a wrangler team member
|
|
if: ${{ steps.teamAffiliation.outputs.isTeamMember == false }}
|
|
run: |
|
|
echo "You must be on the "wrangler" team to trigger this job."
|
|
exit 1
|
|
|
|
- name: "Checkout PR"
|
|
run: |
|
|
if ! [[ "$PR_NUMBER" =~ ^[0-9]+$ ]]; then
|
|
echo "::error::PR number must be numeric"
|
|
exit 1
|
|
fi
|
|
gh pr checkout "$PR_NUMBER"
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
|
|
PR_NUMBER: ${{ inputs.pr-number }}
|
|
|
|
- name: Install Dependencies
|
|
# Defense in depth: do not pass Turbo remote cache credentials and
|
|
# disable the pnpm store cache so release builds always resolve
|
|
# packages from the registry and rebuild every task from source,
|
|
# rather than restoring from a (potentially poisoned) cache.
|
|
uses: ./.github/actions/install-dependencies
|
|
with:
|
|
disable-cache: "true"
|
|
|
|
- name: Build all packages
|
|
run: pnpm run build
|
|
env:
|
|
CI_OS: ${{ runner.os }}
|
|
|
|
- name: Publish packages
|
|
run: |
|
|
if ! [[ "$NPM_TAG" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]; then
|
|
echo "::error::npm dist-tag contains unsupported characters"
|
|
exit 1
|
|
fi
|
|
pnpm publish -r --tag "$NPM_TAG" --filter wrangler --filter miniflare --filter create-cloudflare
|
|
env:
|
|
NPM_TAG: ${{ inputs.label }}
|