Skip to content

CLDSRV-1027: Release from the epic, no GitHub release #6339

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
anurag4DSB wants to merge 1 commit into from
+65 −15
Closed

CLDSRV-1027: Release from the epic, no GitHub release #6339

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
80 changes: 65 additions & 15 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,21 @@ jobs:
release:
runs-on: ubuntu-latest
steps:
# Epic copy: refuse a non-epic tag before any image is pushed.
- name: Refuse a tag that is not an epic tag
env:
GH_TOKEN: ${{ github.token }}
TAG: ${{ github.event.inputs.tag }}
run: |
if ! [[ "$TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+-bnaas\.[0-9]+$ ]]; then
echo "::error::$TAG is not an X.Y.Z-bnaas.N epic tag"
exit 1
fi

@claude claude Bot Oct 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This check doesn't catch a tag that already exists. Re-running with an existing epic tag (or using "Re-run all jobs") rebuilds and overwrites all the <tag> images, and only then fails at "Create the tag". Fail early if the tag exists, before any push:

Suggested change
fi
fi
if git ls-remote --exit-code --tags "https://github.com/$GITHUB_REPOSITORY" "refs/tags/$TAG" >/dev/null; then
echo "::error::tag $TAG already exists"
exit 1
fi

if gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$TAG" --silent 2>/dev/null; then
echo "::error::Tag $TAG already exists"
exit 1
fi

- name: Checkout
uses: actions/checkout@v4

Expand Down Expand Up @@ -78,15 +93,14 @@ jobs:
cache-from: type=gha,scope=federation
cache-to: type=gha,mode=max,scope=federation

- name: Create Release
uses: softprops/action-gh-release@v2
# Epic copy: create the tag only, with no GitHub release.
- name: Create the tag
env:
GITHUB_TOKEN: ${{ github.token }}
with:
name: Release ${{ github.event.inputs.tag }}
tag_name: ${{ github.event.inputs.tag }}
generate_release_notes: true
target_commitish: ${{ github.sha }}
GH_TOKEN: ${{ github.token }}
TAG: ${{ github.event.inputs.tag }}
run: |
gh api "repos/$GITHUB_REPOSITORY/git/refs" \
-f ref="refs/tags/$TAG" -f sha="$GITHUB_SHA"

trigger-kms-release:
runs-on: ubuntu-latest
Expand All @@ -100,12 +114,48 @@ jobs:
app-id: ${{ vars.ACTIONS_APP_ID }}
private-key: ${{ secrets.ACTIONS_APP_PRIVATE_KEY }}
owner: ${{ github.repository_owner }}
repositories: scality-kms
permission-contents: read

# Epic copy: build scality-kms here instead of starting a scality-kms
# release, which would create a GitHub release in scality-kms. The
# image holds the proprietary SafeNet library and this repository is
# public, so the clone keeps no token and the build log stays quiet.
- name: Checkout scality-kms
id: kms-checkout
uses: actions/checkout@v4
with:
repository: scality/scality-kms
ref: main
token: ${{ steps.app-token.outputs.token }}
path: scality-kms
persist-credentials: false

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- name: Login to Registry
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ github.token }}

- name: Trigger scality-kms release workflow
- name: Build and push scality-kms image
uses: docker/build-push-action@v5
env:
GH_TOKEN: ${{ steps.app-token.outputs.token }}
run: |
gh workflow run release.yaml \
--repo scality/scality-kms \
--ref main \
--field cloudserver-version=${{ github.event.inputs.tag }}
BUILDKIT_PROGRESS: quiet
DOCKER_BUILD_SUMMARY: false
DOCKER_BUILD_RECORD_UPLOAD: false
with:
push: true
context: scality-kms
provenance: false
build-args: |
CLOUDSERVER_TAG=${{ github.event.inputs.tag }}-federation
tags: |
ghcr.io/${{ github.repository_owner }}/scality-kms:${{ github.event.inputs.tag }}-federation
labels: |
git.repository=${{ github.repository }}
git.commit-sha=${{ github.sha }}
scality-kms.commit-sha=${{ steps.kms-checkout.outputs.commit }}
Loading