From c9c7430145c8ad7483184b6fd8d8e89edc1f4966 Mon Sep 17 00:00:00 2001 From: "ccf-lisa[bot]" <286799724+ccf-lisa[bot]@users.noreply.github.com> Date: Tue, 13 Oct 2026 13:23:12 -0300 Subject: [PATCH] chore: release-please and shared release workflows Add release-please (go, seeded at 0.0.0) and the shared release, preview and cut-prerelease callers pinned to workflows v1.5.2. The release jobs are skipped while the repo is a template, so they only run in repos created from it. Remove the old tag-push release and build-and-upload workflows. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/build-and-upload.yml | 28 -------------------------- .github/workflows/ci.yml | 6 +++--- .github/workflows/cut-prerelease.yml | 13 ++++++++++++ .github/workflows/preview.yml | 26 ++++++++++++++++++++++++ .github/workflows/release-please.yml | 21 +++++++++++++++++++ .github/workflows/release.yml | 20 ++++++++++++------ .goreleaser.yaml | 4 ++++ .release-please-manifest.json | 3 +++ README.md | 10 +++++++++ release-please-config.json | 21 +++++++++++++++++++ 10 files changed, 115 insertions(+), 37 deletions(-) delete mode 100644 .github/workflows/build-and-upload.yml create mode 100644 .github/workflows/cut-prerelease.yml create mode 100644 .github/workflows/preview.yml create mode 100644 .github/workflows/release-please.yml create mode 100644 .release-please-manifest.json create mode 100644 release-please-config.json diff --git a/.github/workflows/build-and-upload.yml b/.github/workflows/build-and-upload.yml deleted file mode 100644 index 3560bfd..0000000 --- a/.github/workflows/build-and-upload.yml +++ /dev/null @@ -1,28 +0,0 @@ -name: Build and Upload Artifacts - -on: - workflow_call: - -jobs: - release: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - uses: actions/setup-go@v5 - - name: Run GoReleaser - uses: goreleaser/goreleaser-action@v6 - with: - # 'latest', 'nightly', or a semver - version: '~> v2' - args: release --clean - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - name: Install gooci cli - run: go install github.com/compliance-framework/gooci@latest - - name: Authenticate gooci cli - run: gooci login ghcr.io --username ${{ github.actor }} --password ${{ secrets.GITHUB_TOKEN }} - - name: gooci Upload Version - run: gooci upload dist/ ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}:${{github.ref_name}} --annotate="org.ccf.plugin.protocol.version=2" - - name: gooci Upload Latest - if: "!github.event.release.prerelease" - run: gooci upload dist/ ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}:latest --annotate="org.ccf.plugin.protocol.version=2" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1c33d45..4277a73 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,7 +12,7 @@ permissions: {} jobs: ci: - uses: compliance-framework/workflows/.github/workflows/ci-go-plugin.yml@7b55019ed36050a57eb8273f6a67fd4b2395adb0 # v1.5.1 + uses: compliance-framework/workflows/.github/workflows/ci-go-plugin.yml@6e7fc9c04b59c7d1117938da397f8a6f8df036ab # v1.5.2 permissions: actions: read contents: read @@ -21,14 +21,14 @@ jobs: secrets: inherit release-checks: - uses: compliance-framework/workflows/.github/workflows/release-checks.yml@7b55019ed36050a57eb8273f6a67fd4b2395adb0 # v1.5.1 + uses: compliance-framework/workflows/.github/workflows/release-checks.yml@6e7fc9c04b59c7d1117938da397f8a6f8df036ab # v1.5.2 permissions: contents: read notify: needs: [ci, release-checks] if: always() - uses: compliance-framework/workflows/.github/workflows/notify-failure.yml@7b55019ed36050a57eb8273f6a67fd4b2395adb0 # v1.5.1 + uses: compliance-framework/workflows/.github/workflows/notify-failure.yml@6e7fc9c04b59c7d1117938da397f8a6f8df036ab # v1.5.2 with: needs: ${{ toJSON(needs) }} permissions: diff --git a/.github/workflows/cut-prerelease.yml b/.github/workflows/cut-prerelease.yml new file mode 100644 index 0000000..bee9f2a --- /dev/null +++ b/.github/workflows/cut-prerelease.yml @@ -0,0 +1,13 @@ +name: cut-prerelease +on: + workflow_dispatch: +permissions: + contents: read +jobs: + cut: + # Skipped while this is a template repo (plugin-template never releases); runs in repos created from it. + if: ${{ !github.event.repository.is_template }} + uses: compliance-framework/workflows/.github/workflows/cut-prerelease.yml@6e7fc9c04b59c7d1117938da397f8a6f8df036ab # v1.5.2 + permissions: + contents: read + secrets: inherit diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml new file mode 100644 index 0000000..6ed453c --- /dev/null +++ b/.github/workflows/preview.yml @@ -0,0 +1,26 @@ +# Publishes :pr- previews for PRs labelled `preview` (no :main previews for plugins). +name: preview + +on: + push: + branches: [main] + pull_request: + types: [opened, synchronize, reopened, labeled] + +permissions: + contents: read + +concurrency: + # A merged PR's events carry the base branch as github.ref, so key PR runs by number. + group: preview-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + preview: + uses: compliance-framework/workflows/.github/workflows/preview.yml@6e7fc9c04b59c7d1117938da397f8a6f8df036ab # v1.5.2 + with: + kind: go-plugin + on-main: false + permissions: + contents: read + packages: write diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml new file mode 100644 index 0000000..4108a42 --- /dev/null +++ b/.github/workflows/release-please.yml @@ -0,0 +1,21 @@ +# Opens/updates the release PR and, once it merges, tags and publishes the release. +name: release-please + +on: + push: + branches: [main] + +permissions: + contents: read + +concurrency: + group: release-please + +jobs: + release-please: + # Skipped while this is a template repo (plugin-template never releases); runs in repos created from it. + if: ${{ !github.event.repository.is_template }} + uses: compliance-framework/workflows/.github/workflows/release-please.yml@6e7fc9c04b59c7d1117938da397f8a6f8df036ab # v1.5.2 + permissions: + contents: read + secrets: inherit diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2a50955..20d99f7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,13 +1,21 @@ -name: New Release +# Publishes the plugin (goreleaser archives + gooci upload) when a release is published. +name: release on: - push: - tags: - - '*' + release: + types: [published] + +permissions: + contents: read jobs: release: + # Skipped while this is a template repo (plugin-template never releases); runs in repos created from it. + if: ${{ !github.event.repository.is_template }} + uses: compliance-framework/workflows/.github/workflows/release-go-plugin.yml@6e7fc9c04b59c7d1117938da397f8a6f8df036ab # v1.5.2 + with: + protocol-version: "2" permissions: + contents: write # goreleaser attaches the archives to the release packages: write - contents: write - uses: ./.github/workflows/build-and-upload.yml + secrets: inherit diff --git a/.goreleaser.yaml b/.goreleaser.yaml index c4ef88a..748835b 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -34,6 +34,10 @@ archives: {{- else }}{{ .Arch }}{{ end }} {{- if .Arm }}v{{ .Arm }}{{ end }} +release: + prerelease: auto + replace_existing_artifacts: true + changelog: sort: asc filters: diff --git a/.release-please-manifest.json b/.release-please-manifest.json new file mode 100644 index 0000000..e18ee07 --- /dev/null +++ b/.release-please-manifest.json @@ -0,0 +1,3 @@ +{ + ".": "0.0.0" +} diff --git a/README.md b/README.md index b0cf798..e5f334b 100644 --- a/README.md +++ b/README.md @@ -16,6 +16,16 @@ Once you are ready to serve the plugin, you need to build the binaries which can goreleaser release --snapshot --clean ``` +## Releasing + +For a repo created from this template: + +* Releases come from release-please PRs: merging one tags `vX.Y.Z` and publishes the plugin. +* Release candidates (`vX.Y.Z-rcN`) come from the `cut-prerelease` workflow. +* If the repo already has releases, set `.release-please-manifest.json` to its current version first. + +The release workflows are skipped in this template repo itself. + ## Usage You can use this plugin by passing it to the compliance agent or by specifying it in the agent config diff --git a/release-please-config.json b/release-please-config.json new file mode 100644 index 0000000..9efa578 --- /dev/null +++ b/release-please-config.json @@ -0,0 +1,21 @@ +{ + "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json", + "bump-minor-pre-major": true, + "initial-version": "0.1.0", + "changelog-sections": [ + { "type": "feat", "section": "Features" }, + { "type": "fix", "section": "Bug Fixes" }, + { "type": "perf", "section": "Performance Improvements" }, + { "type": "revert", "section": "Reverts" }, + { "type": "deps", "section": "Dependencies" }, + { "type": "chore", "section": "Miscellaneous Chores", "hidden": true }, + { "type": "ci", "section": "Continuous Integration", "hidden": true }, + { "type": "docs", "section": "Documentation", "hidden": true }, + { "type": "test", "section": "Tests", "hidden": true }, + { "type": "refactor", "section": "Code Refactoring", "hidden": true }, + { "type": "build", "section": "Build System", "hidden": true } + ], + "packages": { + ".": { "release-type": "go" } + } +}