wehub-resource-sync
070959e133
landing-page-staging / Deploy landing page to staging (push) Has been skipped
landing-page-ci / Validate landing page (push) Failing after 4s
visual-baseline / Capture visual baselines (push) Has been cancelled
bake-plugin-previews / Bake plugin previews (push) Has been cancelled
223 lines
11 KiB
YAML
223 lines
11 KiB
YAML
name: cut-patch-release
|
|
# Every Thursday 09:00 Asia/Shanghai, cut the next PATCH release — but only once
|
|
# this week's minor (the branch cut-release created on Tuesday) has actually
|
|
# shipped stable.
|
|
#
|
|
# This is the Tuesday cut-release flow with three deltas:
|
|
# 1. It bumps the PATCH, not the minor: highest release/vX.Y.Z -> X.Y.(Z+1)
|
|
# (e.g. 0.14.0 -> 0.14.1). Like cut-release, the branch is cut from main HEAD.
|
|
# 2. A pre-flight guard: the current line's minor base X.Y.0 must be a PUBLISHED
|
|
# stable GitHub Release (tag open-design-vX.Y.0, isDraft=false, isPrerelease=false
|
|
# — i.e. release-stable ran `gh release edit --draft=false --latest`). If it is
|
|
# not published yet, do NOT cut a branch or build anything; instead post a
|
|
# Feishu notice that the patch cut was skipped, and stop.
|
|
# 3. On the happy path it is otherwise identical to cut-release: create
|
|
# release/vX.Y.(Z+1), bump apps/packaged/package.json, push with the App token
|
|
# (which triggers notify-release-feishu -> prerelease build + Feishu card), and
|
|
# create the "backport release/vX.Y.(Z+1)" label.
|
|
#
|
|
# "Cut a patch" here means "cut a new point-release branch + build a prerelease +
|
|
# announce it", exactly like Tuesday. It deliberately does NOT auto-promote to
|
|
# stable; that stays a human-gated release-stable dispatch.
|
|
#
|
|
# NOTE: schedule triggers only fire from the default branch (main), so this file
|
|
# must live on main to run on its cron.
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '0 1 * * 4' # 01:00 UTC = 09:00 Asia/Shanghai, Thursday
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: 'Full patch version x.y.z (empty = bump patch of the highest release branch)'
|
|
required: false
|
|
default: ''
|
|
force:
|
|
description: 'Skip the "Tuesday minor is published" guard and cut anyway'
|
|
required: false
|
|
type: boolean
|
|
default: false
|
|
|
|
permissions:
|
|
contents: read # actual writes go through the App token below
|
|
|
|
concurrency:
|
|
group: cut-patch-release
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
cut:
|
|
if: github.repository == 'nexu-io/open-design'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/create-github-app-token@v2
|
|
id: app
|
|
with:
|
|
app-id: ${{ secrets.RELEASE_BOT_APP_ID }}
|
|
private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
|
|
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: main # always cut from main HEAD, even on a manual dispatch from another branch
|
|
fetch-depth: 0
|
|
token: ${{ steps.app.outputs.token }}
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 24
|
|
|
|
- name: Compute next patch version
|
|
id: ver
|
|
env:
|
|
# Never interpolate the raw input into the shell; pass via env and validate.
|
|
INPUT_VERSION: ${{ inputs.version }}
|
|
run: |
|
|
set -euo pipefail
|
|
# Decide the final version V FIRST: a validated manual override wins,
|
|
# otherwise bump the patch of the highest release branch.
|
|
if [ -n "$INPUT_VERSION" ]; then
|
|
# Strict x.y.z, digits only — rejects shell metacharacters, newlines, etc.
|
|
if ! printf '%s' "$INPUT_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
|
|
echo "::error::Invalid version '$INPUT_VERSION' (expected x.y.z, digits only)"
|
|
exit 1
|
|
fi
|
|
V="$INPUT_VERSION"
|
|
else
|
|
latest=$(git ls-remote --heads origin 'release/v*' \
|
|
| sed -E 's#.*/release/v##' \
|
|
| grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' \
|
|
| sort -t. -k1,1n -k2,2n -k3,3n | tail -1)
|
|
if [ -z "$latest" ]; then
|
|
echo "::error::No release/vX.Y.Z branch found to base a patch on."
|
|
exit 1
|
|
fi
|
|
major=${latest%%.*}; rest=${latest#*.}; minor=${rest%%.*}; patch=${rest#*.}
|
|
V="${major}.${minor}.$((patch+1))"
|
|
fi
|
|
# V is now guaranteed to match ^[0-9]+\.[0-9]+\.[0-9]+$.
|
|
# Gate on the minor base of the FINAL V — never the highest branch — so a
|
|
# manual `version=` on a different line is checked against ITS own minor
|
|
# (e.g. version=0.15.1 gates open-design-v0.15.0, not the latest 0.14.0).
|
|
vmajor=${V%%.*}; vrest=${V#*.}; vminor=${vrest%%.*}
|
|
MINOR_BASE="${vmajor}.${vminor}.0"
|
|
echo "version=$V" >> "$GITHUB_OUTPUT"
|
|
echo "branch=release/v$V" >> "$GITHUB_OUTPUT"
|
|
echo "minor_base=$MINOR_BASE" >> "$GITHUB_OUTPUT"
|
|
echo "minor_tag=open-design-v$MINOR_BASE" >> "$GITHUB_OUTPUT"
|
|
echo "Cutting patch v$V (branch release/v$V); gating on stable v$MINOR_BASE"
|
|
|
|
# Guard: the minor this patch sits on (the Tuesday cut) must already be a
|
|
# PUBLISHED stable GitHub Release. release-stable publishes with
|
|
# `gh release edit --draft=false --latest` and rolls the tag back on failure,
|
|
# so a non-draft, non-prerelease release is the ground-truth "shipped" signal.
|
|
- name: Check the Tuesday minor is published
|
|
id: guard
|
|
env:
|
|
GH_TOKEN: ${{ steps.app.outputs.token }}
|
|
MINOR_TAG: ${{ steps.ver.outputs.minor_tag }}
|
|
FORCE: ${{ inputs.force }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ "${FORCE:-false}" = "true" ]; then
|
|
echo "force=true: skipping the publish guard"
|
|
echo "published=true" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
# "published" = the release exists AND is neither a draft nor a prerelease.
|
|
# gh's --jq evaluates `(.isDraft or .isPrerelease) | not` to true only when
|
|
# both are false. A missing release makes `gh release view` exit non-zero,
|
|
# so the `|| published=false` fallback treats "not found" as "not published".
|
|
published=$(gh release view "$MINOR_TAG" \
|
|
--repo nexu-io/open-design \
|
|
--json isDraft,isPrerelease \
|
|
--jq '(.isDraft or .isPrerelease) | not' 2>/dev/null) || published=false
|
|
echo "release $MINOR_TAG -> published=$published"
|
|
echo "published=$published" >> "$GITHUB_OUTPUT"
|
|
|
|
# ---- Skip path: minor not published yet -> notify Feishu and stop ----
|
|
# feishu-notice.ts imports only node:crypto (no workspace deps), so the
|
|
# setup-node above is all it needs — no pnpm install, same as feishu.ts.
|
|
- name: Notify Feishu that the patch cut was skipped
|
|
if: steps.guard.outputs.published != 'true'
|
|
env:
|
|
FEISHU_WEBHOOK: ${{ secrets.FEISHU_RELEASE_WEBHOOK }}
|
|
FEISHU_SIGN_SECRET: ${{ secrets.FEISHU_RELEASE_SIGN_SECRET }}
|
|
NOTICE_TITLE: "⏭️ 周四小版本已跳过"
|
|
NOTICE_TEMPLATE: "orange"
|
|
NOTICE_BODY: |
|
|
本周周二的 release **v${{ steps.ver.outputs.minor_base }}** 还没发布成功（stable GitHub Release 尚未 published），本次周四小版本 **v${{ steps.ver.outputs.version }}** 的自动切分支与构建已跳过。
|
|
|
|
待 v${{ steps.ver.outputs.minor_base }} promote 到 stable 后，可手动重新触发本工作流（或用 `force` 强制切分支）。
|
|
RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
|
|
run: node --experimental-strip-types tools/release/src/notifications/feishu-notice.ts
|
|
|
|
- name: Stop here when skipping
|
|
if: steps.guard.outputs.published != 'true'
|
|
run: |
|
|
echo "::notice::Tuesday minor v${{ steps.ver.outputs.minor_base }} is not published; patch cut skipped."
|
|
exit 0
|
|
|
|
# ---- Happy path: minor published -> cut the patch, same as cut-release ----
|
|
- name: Bail out if the branch already exists
|
|
if: steps.guard.outputs.published == 'true'
|
|
env:
|
|
BRANCH: ${{ steps.ver.outputs.branch }}
|
|
run: |
|
|
set -euo pipefail
|
|
if git ls-remote --exit-code --heads origin "$BRANCH" >/dev/null 2>&1; then
|
|
echo "::error::$BRANCH already exists, skipping"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Create branch + bump version + push
|
|
if: steps.guard.outputs.published == 'true'
|
|
env:
|
|
VERSION: ${{ steps.ver.outputs.version }}
|
|
BRANCH: ${{ steps.ver.outputs.branch }}
|
|
run: |
|
|
set -euo pipefail
|
|
git config user.name 'open-design-release-bot[bot]'
|
|
git config user.email 'open-design-release-bot[bot]@users.noreply.github.com'
|
|
git switch -c "$BRANCH"
|
|
( cd apps/packaged && npm pkg set version="$VERSION" )
|
|
# main leads stable by exactly this patch in steady state (finalize-release
|
|
# bumps main to X.Y.(Z+1) after X.Y.Z ships), so apps/packaged is often
|
|
# already at $VERSION and the bump is a no-op. --allow-empty commits a
|
|
# release marker anyway instead of dying on "nothing to commit"; either way
|
|
# the branch is cut + pushed, which is what triggers notify-release-feishu.
|
|
git commit --allow-empty -am "chore(release): v$VERSION"
|
|
git push origin "$BRANCH" # App token push -> triggers notify-release-feishu (prerelease + Feishu)
|
|
|
|
- name: Create backport label
|
|
if: steps.guard.outputs.published == 'true'
|
|
env:
|
|
GH_TOKEN: ${{ steps.app.outputs.token }}
|
|
VERSION: ${{ steps.ver.outputs.version }}
|
|
run: |
|
|
set -euo pipefail
|
|
gh label create "backport release/v$VERSION" \
|
|
--repo nexu-io/open-design \
|
|
--color 0E8A16 \
|
|
--description "Backport this fix to release/v$VERSION" \
|
|
--force
|
|
|
|
# Post an immediate "branch cut" card so the team is notified the moment the
|
|
# patch branch exists, without waiting ~20-40 min for notify-release-feishu to
|
|
# finish the prerelease build. The download card still follows from that build.
|
|
# feishu-notice.ts only imports node:crypto, so the setup-node above suffices.
|
|
- name: Notify Feishu that the branch was cut
|
|
if: steps.guard.outputs.published == 'true'
|
|
env:
|
|
FEISHU_WEBHOOK: ${{ secrets.FEISHU_RELEASE_WEBHOOK }}
|
|
FEISHU_SIGN_SECRET: ${{ secrets.FEISHU_RELEASE_SIGN_SECRET }}
|
|
NOTICE_TITLE: "🌿 已切出 release 分支 v${{ steps.ver.outputs.version }}(小版本 patch)"
|
|
NOTICE_TEMPLATE: "green"
|
|
NOTICE_BODY: |
|
|
**分支**:[`release/v${{ steps.ver.outputs.version }}`](${{ github.server_url }}/${{ github.repository }}/tree/release/v${{ steps.ver.outputs.version }})(从 main 切出,小版本 / patch)
|
|
|
|
**Backport label**:`backport release/v${{ steps.ver.outputs.version }}` —— 要回灌到这个版本的修复,给 PR 打这个 label。
|
|
|
|
Prerelease 打包已开始(约 20–40 分钟);完成后会再发一张带各平台下载链接的卡片。
|
|
RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
|
|
run: node --experimental-strip-types tools/release/src/notifications/feishu-notice.ts
|