ci(release): auto-publish split bundles to Gitea package registry on version tags
.gitea/workflows/release.yml — on push tag v*: assert tag==VERSION, run the governance
gate (must be green), build core/devkit/platform-preview/all-in-one-demo (enterprise
skipped/refused), then PUT each .tar.gz (+.sha256) to the Gitea generic package registry
using ${{ secrets.GITEA_TOKEN }}. Portable via GITHUB_SERVER_URL/OWNER. Guide updated with
the one-time secret setup + release flow.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
6cb96ce249
commit
98d699d844
@@ -0,0 +1,78 @@
|
||||
# CASAN release — build split bundles + publish to the Gitea package registry.
|
||||
# Triggers on a version tag (vX.Y.Z). Verifies the gate, builds core/devkit/platform/
|
||||
# all-in-one-demo, and uploads each artifact to the Gitea generic package registry.
|
||||
# Enterprise (Level 4) is intentionally skipped (package-release.sh refuses it).
|
||||
#
|
||||
# Requires repo/org secret: GITEA_TOKEN (scope: write:package).
|
||||
name: CASAN Release
|
||||
|
||||
on:
|
||||
push:
|
||||
tags:
|
||||
- 'v*'
|
||||
|
||||
jobs:
|
||||
release:
|
||||
runs-on: ci-runner
|
||||
timeout-minutes: 60
|
||||
env:
|
||||
CASAN_CI_RUN_FRONTEND: "0"
|
||||
CASAN_CI_RUN_BACKEND: "0"
|
||||
CASAN_CI_RUN_INFRA_LAB: "0"
|
||||
CASAN_CI_STEP_TIMEOUT_SEC: "1200"
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Toolchain
|
||||
run: |
|
||||
set -euo pipefail
|
||||
command -v python3 >/dev/null || { apt-get update && apt-get install -y python3; }
|
||||
command -v curl >/dev/null || { apt-get update && apt-get install -y curl; }
|
||||
python3 --version
|
||||
|
||||
- name: Tag must match VERSION
|
||||
run: |
|
||||
set -euo pipefail
|
||||
TAG="${GITHUB_REF_NAME#v}"
|
||||
FILE_VER="$(cat VERSION)"
|
||||
echo "tag=$TAG version-file=$FILE_VER"
|
||||
[ "$TAG" = "$FILE_VER" ] || { echo "::error::tag v$TAG != VERSION $FILE_VER — bump VERSION before tagging"; exit 1; }
|
||||
|
||||
- name: Verify governance gate (must be green to release)
|
||||
run: bash packages/casan-harness/scripts/bash/ci-harness-gate.sh
|
||||
|
||||
- name: Build split bundles
|
||||
run: |
|
||||
set -euo pipefail
|
||||
for b in core devkit platform all-in-one-demo; do
|
||||
scripts/package-release.sh "$b"
|
||||
done
|
||||
# enterprise is future → refused on purpose; do not fail the release
|
||||
scripts/package-release.sh enterprise || echo "enterprise skipped (future, expected)"
|
||||
ls -lh dist/
|
||||
|
||||
- name: Publish bundles to Gitea package registry
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
[ -n "${GITEA_TOKEN:-}" ] || { echo "::error::secret GITEA_TOKEN not set (scope write:package)"; exit 1; }
|
||||
BASE="${GITHUB_SERVER_URL:-http://localhost:3000}"
|
||||
OWNER="${GITHUB_REPOSITORY_OWNER:-admin}"
|
||||
V="$(cat VERSION)"
|
||||
publish() { # <artifact-path> <package-name> <pkg-version>
|
||||
local f="$1" name="$2" ver="$3"
|
||||
echo "→ $BASE/api/packages/$OWNER/generic/$name/$ver/$(basename "$f")"
|
||||
curl -fsSL -X PUT -H "Authorization: token $GITEA_TOKEN" \
|
||||
--upload-file "$f" \
|
||||
"$BASE/api/packages/$OWNER/generic/$name/$ver/$(basename "$f")"
|
||||
curl -fsSL -X PUT -H "Authorization: token $GITEA_TOKEN" \
|
||||
--upload-file "$f.sha256" \
|
||||
"$BASE/api/packages/$OWNER/generic/$name/$ver/$(basename "$f").sha256"
|
||||
}
|
||||
publish "dist/casan-core-v$V.tar.gz" casan-core "$V"
|
||||
publish "dist/casan-devkit-v$V.tar.gz" casan-devkit "$V"
|
||||
publish "dist/casan-platform-preview-v$V.tar.gz" casan-platform "$V-preview"
|
||||
publish "dist/casan-all-in-one-demo-v$V.tar.gz" casan-all-in-one-demo "$V"
|
||||
echo "Published core, devkit, platform(preview), all-in-one-demo to $BASE (owner=$OWNER, v=$V)."
|
||||
@@ -67,7 +67,29 @@ curl -fsSL -XPOST -H "Authorization: token $GITEA_TOKEN" \
|
||||
`platform` as `-preview`, `all-in-one-demo` for demos. Never publish `enterprise`.
|
||||
- Keep `VERSION` and `packages/casan-harness/level5/harness-package.json` version in lockstep.
|
||||
|
||||
## Automating in CI
|
||||
Add a release job to `.gitea/workflows/` that runs after the gate, calls
|
||||
`scripts/package-release.sh`, and does the `curl` uploads with `${{ secrets.GITEA_TOKEN }}`.
|
||||
Keep it gated on tags (`on: push: tags: ['v*']`) so ordinary pushes don't publish.
|
||||
## Automated release (recommended — already wired)
|
||||
`.gitea/workflows/release.yml` does all of the above automatically on a version tag. You
|
||||
never hand a token to anyone — it lives in a CI secret.
|
||||
|
||||
**One-time setup**
|
||||
1. Create a token: Gitea → *Settings → Applications → Generate New Token*, scope
|
||||
`write:package` (+ `write:repository` if you also want release attachments).
|
||||
2. Add it as a secret: repo (or org) → *Settings → Actions → Secrets* → name `GITEA_TOKEN`.
|
||||
|
||||
**Cut a release**
|
||||
```bash
|
||||
# bump the version everywhere first
|
||||
echo 1.0.1 > VERSION # must match the tag
|
||||
# (also bump packages/casan-harness/level5/harness-package.json "version")
|
||||
git commit -am "release v1.0.1"
|
||||
git tag -a v1.0.1 -m "CASAN v1.0.1"
|
||||
git push origin main --follow-tags
|
||||
```
|
||||
On the tag push the workflow: checks `tag == VERSION` → runs the governance gate (must be
|
||||
green) → builds `core`/`devkit`/`platform-preview`/`all-in-one-demo` (enterprise skipped) →
|
||||
`curl` PUTs each `.tar.gz` (+ `.sha256`) to `.../api/packages/<owner>/generic/...`. Bundles
|
||||
appear under the repo's **Packages** tab. `GITHUB_SERVER_URL` / `GITHUB_REPOSITORY_OWNER`
|
||||
are provided by Gitea Actions, so the workflow is portable across Gitea hosts.
|
||||
|
||||
## Manual one-off (if you don't want to tag)
|
||||
Use the `curl` snippets in §2/§3 above with a local `GITEA_TOKEN`.
|
||||
|
||||
Reference in New Issue
Block a user