terraphim-editor/.github/workflows/release.yml at main · terraphim/terraphim-editor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
name: Release candidate

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  candidate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Verify release source admission
        run: |
          python3 -m unittest discover -s tests -p 'test_release_*.py' -v
          python3 scripts/check-release-source.py
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown
      - name: Install pinned bundle tools
        uses: actions/setup-node@v4
        with:
          node-version: '22'
      - name: Prepare locked minifiers and matching bindgen CLI
        run: |
          mkdir -p target/release-tools/node
          cp scripts/ci/node/package.json scripts/ci/node/package-lock.json target/release-tools/node/
          npm ci --prefix target/release-tools/node --ignore-scripts --no-audit --no-fund
          echo "$PWD/target/release-tools/node/node_modules/.bin" >> "$GITHUB_PATH"
          cargo install wasm-bindgen-cli --version 0.2.129 --locked
      - name: Install Trunk
        uses: jetli/trunk-action@v0.4.0
        with:
          version: v0.21.14
      - name: Prepare locked registry dependencies
        run: bash scripts/ci/registry.sh
      - name: Build isolated candidate
        run: |
          SOURCE_HEAD="$(python3 scripts/check-release-source.py)"
          bash scripts/ci/run.sh --network cargo fetch --locked
          bash scripts/ci/run.sh trunk build --release --locked --dist "$PWD/target/release-staging-ci"
          python3 scripts/check-release-source.py --expected-head "$SOURCE_HEAD"
          python3 scripts/ci/rolegraph-production-check.py assets target/release-staging-ci
          python3 scripts/ci/runtime-assets-check.py --check target/release-staging-ci/vendor
      - name: Inventory and archive all admitted nested assets
        run: |
          python3 - <<'PY'
          import hashlib, importlib.util, json, pathlib, subprocess, tarfile
          spec = importlib.util.spec_from_file_location('publisher', 'scripts/publish-editor-dist.py')
          module = importlib.util.module_from_spec(spec)
          spec.loader.exec_module(module)
          stage = pathlib.Path('target/release-staging-ci').resolve()
          assets = module.inventory(stage)
          head = subprocess.check_output(['python3', 'scripts/check-release-source.py'], text=True).strip()
          manifest = {'schema': 1, 'sourceHead': head, 'assets': assets}
          output = pathlib.Path('target/candidate')
          output.mkdir()
          raw = (json.dumps(manifest, indent=2, sort_keys=True) + '\n').encode()
          (output / 'assets-manifest.json').write_bytes(raw)
          with tarfile.open(output / 'editor-candidate.tar.gz', 'w:gz') as archive:
              for name in sorted(assets):
                  archive.add(stage / name, arcname=name, recursive=False)
          (output / 'qualification.json').write_text(json.dumps({
              'status': 'candidate-only', 'fullParityAccepted': False,
              'manifestSha256': hashlib.sha256(raw).hexdigest(),
              'archiveSha256': hashlib.sha256((output / 'editor-candidate.tar.gz').read_bytes()).hexdigest(),
              'sourceHead': head,
          }, indent=2) + '\n')
          archive = output / 'editor-candidate.tar.gz'
          qualification = output / 'qualification.json'
          archive_sha = hashlib.sha256(archive.read_bytes()).hexdigest()
          release = {
              'schema': 1, 'releaseId': 'editor-' + head, 'channel': 'candidate',
              'artifacts': [{'host': 'browser', 'version': 'candidate-' + head[:12],
                  'sourceCommit': head, 'path': archive.name, 'bytes': archive.stat().st_size,
                  'sha256': archive_sha}],
              'evidence': [{'host': 'browser', 'kind': 'receipt', 'artifactSha256': archive_sha,
                  'path': qualification.name, 'bytes': qualification.stat().st_size,
                  'sha256': hashlib.sha256(qualification.read_bytes()).hexdigest()}],
              'limitations': [{'host': 'browser', 'requirement': 'all41', 'status': 'OPEN',
                  'issue': 'https://git.terraphim.cloud/terraphim/terraphim-editor/issues/122'}],
          }
          (output / 'release-manifest.json').write_text(json.dumps(release, indent=2) + '\n')
          PY
          python3 scripts/check-release-readiness.py target/candidate/release-manifest.json --root target/candidate --claim integrity
      - name: Retain candidate for qualification
        uses: actions/upload-artifact@v4
        with:
          name: editor-candidate-${{ github.sha }}
          path: target/candidate/
          if-no-files-found: error