feat!: make guided setup reviewed and verifiable #12
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release | |
| on: | |
| push: | |
| tags: | |
| - "v[0-9]*.[0-9]*.[0-9]*" | |
| permissions: | |
| contents: read | |
| jobs: | |
| check: | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: astral-sh/setup-uv@v9.0.0 | |
| with: | |
| python-version: "3.14" | |
| enable-cache: true | |
| - run: uv sync --locked | |
| - name: Verify release version | |
| run: | | |
| VERSION="$(uv run evdb --version)" | |
| test "v${VERSION#evdb }" = "${GITHUB_REF_NAME}" | |
| - run: make check | |
| build: | |
| needs: check | |
| strategy: | |
| fail-fast: true | |
| matrix: | |
| include: | |
| - runner: ubuntu-22.04 | |
| arch: amd64 | |
| - runner: ubuntu-22.04-arm | |
| arch: arm64 | |
| runs-on: ${{ matrix.runner }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: astral-sh/setup-uv@v9.0.0 | |
| with: | |
| python-version: "3.14" | |
| enable-cache: true | |
| - run: uv sync --locked | |
| - run: make binary | |
| - name: Smoke test standalone executable | |
| run: | | |
| VERSION="$(dist/evdb --version)" | |
| test "v${VERSION#evdb }" = "${GITHUB_REF_NAME}" | |
| uv run pyi-archive_viewer -l dist/evdb > binary-members.txt | |
| grep -F "evdb/units/evdb-backup.service" binary-members.txt | |
| grep -F "evdb/units/evdb-backup.timer" binary-members.txt | |
| - name: Assemble release executable | |
| run: | | |
| ASSET="evdb_linux_${{ matrix.arch }}" | |
| install -d -m 0755 artifacts | |
| install -m 0755 dist/evdb "artifacts/${ASSET}" | |
| (cd artifacts && sha256sum "${ASSET}" > "${ASSET}.sha256") | |
| uv run python tools/check_release.py "artifacts/${ASSET}" "${GITHUB_REF_NAME}" | |
| working-directory: ${{ github.workspace }} | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: release-${{ matrix.arch }} | |
| path: artifacts/* | |
| if-no-files-found: error | |
| retention-days: 1 | |
| notes: | |
| needs: build | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| outputs: | |
| available: ${{ steps.result.outputs.available }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Set up Node.js for release notes | |
| id: node | |
| continue-on-error: true | |
| timeout-minutes: 5 | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: "24" | |
| - name: Install OpenCode for release notes | |
| id: opencode | |
| if: steps.node.outcome == 'success' | |
| continue-on-error: true | |
| timeout-minutes: 5 | |
| run: npm install --global opencode-ai@1.18.6 | |
| - name: Generate release notes | |
| id: generate | |
| continue-on-error: true | |
| timeout-minutes: 10 | |
| env: | |
| RELEASE_LLM_URL: ${{ secrets.RELEASE_LLM_URL }} | |
| RELEASE_LLM_KEY: ${{ secrets.RELEASE_LLM_KEY }} | |
| GH_TOKEN: ${{ github.token }} | |
| OPENCODE_CONFIG_CONTENT: >- | |
| {"provider":{"openai":{"options":{"baseURL":"{env:RELEASE_LLM_URL}","apiKey":"{env:RELEASE_LLM_KEY}"},"models":{"gpt-5.6-sol":{"name":"gpt-5.6-sol","limit":{"context":353000,"output":128000},"variants":{"high":{"reasoningEffort":"high"}}}}}}} | |
| run: | | |
| test "${{ steps.node.outcome }}" = "success" | |
| test "${{ steps.opencode.outcome }}" = "success" | |
| test -n "${RELEASE_LLM_URL}" | |
| test -n "${RELEASE_LLM_KEY}" | |
| opencode run --pure --command changelog "${GITHUB_REF_NAME}" | |
| python3 tools/release_notes.py release-notes.md | |
| - name: Upload OpenCode release notes | |
| id: upload | |
| if: steps.generate.outcome == 'success' | |
| continue-on-error: true | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: opencode-release-notes | |
| path: release-notes.md | |
| if-no-files-found: error | |
| retention-days: 1 | |
| - name: Record release note availability | |
| id: result | |
| if: always() | |
| env: | |
| GENERATED: ${{ steps.generate.outcome }} | |
| UPLOADED: ${{ steps.upload.outcome }} | |
| run: | | |
| if test "${GENERATED}" = "success" && test "${UPLOADED}" = "success"; then | |
| echo "available=true" >> "${GITHUB_OUTPUT}" | |
| else | |
| echo "available=false" >> "${GITHUB_OUTPUT}" | |
| echo "::notice::OpenCode release notes unavailable; GitHub automatic notes will be used" | |
| fi | |
| publish: | |
| needs: [build, notes] | |
| if: ${{ !cancelled() && needs.build.result == 'success' }} | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: write | |
| id-token: write | |
| attestations: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| pattern: release-* | |
| path: release | |
| merge-multiple: true | |
| - name: Add installer | |
| run: install -m 0755 install.sh release/install.sh | |
| - name: Attest release executables | |
| uses: actions/attest@v4 | |
| with: | |
| subject-path: release/evdb_linux_* | |
| - name: Download OpenCode release notes | |
| id: notes-download | |
| if: needs.notes.outputs.available == 'true' | |
| continue-on-error: true | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: opencode-release-notes | |
| path: . | |
| - name: Validate OpenCode release notes | |
| id: notes | |
| if: steps.notes-download.outcome == 'success' | |
| continue-on-error: true | |
| run: python3 tools/release_notes.py release-notes.md | |
| - name: Verify release tag is unchanged | |
| run: test "$(git rev-parse "refs/tags/${GITHUB_REF_NAME}^{commit}")" = "${GITHUB_SHA}" | |
| - name: Publish GitHub release with OpenCode notes | |
| if: steps.notes.outcome == 'success' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: >- | |
| gh release create "${GITHUB_REF_NAME}" release/* | |
| --verify-tag --notes-file release-notes.md --title "${GITHUB_REF_NAME}" | |
| - name: Publish GitHub release with automatic notes | |
| if: steps.notes.outcome != 'success' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| echo "::notice::OpenCode release notes unavailable; using GitHub automatic notes" | |
| gh release create "${GITHUB_REF_NAME}" release/* \ | |
| --verify-tag --generate-notes --title "${GITHUB_REF_NAME}" |