Skip to content

Commit 7a65575

Browse files
charlie-e2bcharlie-e2b
authored
fix: remove release from release please (#3245)
1 parent dbd098f commit 7a65575

4 files changed

Lines changed: 311 additions & 206 deletions

File tree

‎.github/workflows/publish.yml‎

Lines changed: 170 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,170 @@
1+
name: Publish release
2+
3+
on:
4+
push:
5+
tags:
6+
# Component release tags: <component>-v<version>. Created by the Release
7+
# Please workflow when a release PR merges, or pushed by hand to publish
8+
# a release candidate (e.g. client-proxy-v1.2.3-rc1). The glob is a
9+
# loose net on purpose; the resolve step below ignores tags whose
10+
# component prefix isn't a known package.
11+
- '*-v*'
12+
13+
workflow_dispatch:
14+
inputs:
15+
tag:
16+
description: >-
17+
Existing <component>-v<version> tag to (re-)publish, e.g.
18+
docker-reverse-proxy-v0.2.3. Recovery path for older tags — the run
19+
of the tag itself can also simply be re-run.
20+
type: string
21+
required: true
22+
23+
permissions:
24+
contents: read
25+
id-token: write
26+
27+
# One publish per tag at a time. The e2b-artifacts registry has
28+
# immutableTags=true, so a concurrent duplicate would fail anyway; this just
29+
# keeps it from racing.
30+
concurrency:
31+
group: ${{ github.workflow }}-${{ inputs.tag || github.ref_name }}
32+
33+
jobs:
34+
publish:
35+
name: Publish to e2b-artifacts
36+
runs-on: ubuntu-24.04
37+
steps:
38+
- name: Resolve package from tag
39+
id: pkg
40+
env:
41+
TAG: ${{ inputs.tag || github.ref_name }}
42+
GH_TOKEN: ${{ github.token }}
43+
run: |
44+
# Map the tag's component prefix to its build inputs. build_args
45+
# lists which --build-arg values the build step passes (their values
46+
# are computed there, after checkout). Unknown components are
47+
# skipped, not failed: the '*-v*' trigger can match unrelated tags.
48+
case "${TAG}" in
49+
docker-reverse-proxy-v*)
50+
component=docker-reverse-proxy
51+
# Build context is packages/ (the Dockerfile needs shared/ and db/).
52+
dockerfile=packages/docker-reverse-proxy/Dockerfile
53+
context=packages
54+
build_args="COMMIT_SHA VERSION"
55+
;;
56+
client-proxy-v*)
57+
component=client-proxy
58+
# Build context is packages/ (the Dockerfile needs shared/ and
59+
# clickhouse/).
60+
dockerfile=packages/client-proxy/Dockerfile
61+
context=packages
62+
build_args="COMMIT_SHA"
63+
;;
64+
clickhouse-migrator-v*)
65+
component=clickhouse-migrator
66+
# Self-contained: Dockerfile and build context both live in
67+
# packages/clickhouse (matching the package Makefile's
68+
# `docker build .`).
69+
dockerfile=packages/clickhouse/Dockerfile
70+
context=packages/clickhouse
71+
build_args=""
72+
;;
73+
*)
74+
# A stray tag caught by the loose glob is a no-op; an explicit
75+
# dispatch for one is a mistake and should fail loudly.
76+
if [ "${GITHUB_EVENT_NAME}" = "workflow_dispatch" ]; then
77+
echo "::error::tag '${TAG}' does not match a known component"
78+
exit 1
79+
fi
80+
echo "::notice::tag '${TAG}' does not match a known component; nothing to publish"
81+
exit 0
82+
;;
83+
esac
84+
version="${TAG#"${component}"-v}"
85+
if [ -z "${version}" ]; then
86+
echo "::error::tag '${TAG}' has an empty version"
87+
exit 1
88+
fi
89+
# On manual dispatch the tag is free text — fail here with a clear
90+
# message instead of an opaque git error at the checkout step.
91+
if [ "${GITHUB_EVENT_NAME}" = "workflow_dispatch" ] && \
92+
! gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${TAG}" --silent 2>/dev/null; then
93+
echo "::error::tag '${TAG}' does not exist in this repository"
94+
exit 1
95+
fi
96+
{
97+
echo "component=${component}"
98+
echo "version=${version}"
99+
# <host>/<project>/<repository>/<image>
100+
echo "image=us-docker.pkg.dev/e2b-artifacts/${component}/${component}"
101+
echo "dockerfile=${dockerfile}"
102+
echo "context=${context}"
103+
echo "build_args=${build_args}"
104+
} >> "${GITHUB_OUTPUT}"
105+
106+
- name: Checkout repository
107+
if: ${{ steps.pkg.outputs.component != '' }}
108+
uses: actions/checkout@v5
109+
with:
110+
# Build exactly what the tag points at (on a manual dispatch,
111+
# github.sha would be main's head instead).
112+
ref: ${{ inputs.tag || github.ref_name }}
113+
persist-credentials: false
114+
115+
- name: Authenticate to the e2b-artifacts project
116+
if: ${{ steps.pkg.outputs.component != '' }}
117+
uses: google-github-actions/auth@v3
118+
with:
119+
# Workload Identity Federation provider + service account for the
120+
# e2b-artifacts project. Provisioned out-of-repo (separate Terraform
121+
# modules / live repo); wired here via GitHub repo variables.
122+
workload_identity_provider: ${{ vars.E2B_ARTIFACTS_WIF_PROVIDER }}
123+
service_account: ${{ vars.E2B_ARTIFACTS_PUBLISH_SA }}
124+
125+
- name: Set up Cloud SDK
126+
if: ${{ steps.pkg.outputs.component != '' }}
127+
uses: google-github-actions/setup-gcloud@v3
128+
129+
- name: Configure Docker auth
130+
if: ${{ steps.pkg.outputs.component != '' }}
131+
run: gcloud auth configure-docker us-docker.pkg.dev --quiet
132+
133+
- name: Set up Docker Buildx
134+
if: ${{ steps.pkg.outputs.component != '' }}
135+
uses: docker/setup-buildx-action@v3
136+
137+
- name: Build and push released image
138+
if: ${{ steps.pkg.outputs.component != '' }}
139+
env:
140+
IMAGE: ${{ steps.pkg.outputs.image }}
141+
VERSION: ${{ steps.pkg.outputs.version }}
142+
DOCKERFILE: ${{ steps.pkg.outputs.dockerfile }}
143+
CONTEXT: ${{ steps.pkg.outputs.context }}
144+
BUILD_ARGS: ${{ steps.pkg.outputs.build_args }}
145+
# Notes:
146+
# - Image tag is v-prefixed (v${VERSION}) to match what customers pin
147+
# via <COMPONENT>_VERSION and the release tag convention.
148+
# - No :latest tag: the e2b-artifacts repo has immutableTags=true, so
149+
# a reused tag would fail on the second release. Customers pin
150+
# exact versions anyway.
151+
# - --provenance=false --sbom=false: Artifact Registry rejects
152+
# buildx's default OCI attestation manifest list (HTTP 400).
153+
run: |
154+
IMAGE_TAG="v${VERSION}"
155+
args=()
156+
for arg in ${BUILD_ARGS}; do
157+
case "${arg}" in
158+
COMMIT_SHA) args+=( --build-arg COMMIT_SHA="$(git rev-parse --short HEAD)" ) ;;
159+
VERSION) args+=( --build-arg VERSION="${IMAGE_TAG}" ) ;;
160+
esac
161+
done
162+
docker buildx build \
163+
--platform linux/amd64 \
164+
--provenance=false \
165+
--sbom=false \
166+
"${args[@]}" \
167+
--tag "${IMAGE}:${IMAGE_TAG}" \
168+
--push \
169+
-f "${DOCKERFILE}" \
170+
"${CONTEXT}"

0 commit comments

Comments
 (0)