This is an automated email from the ASF dual-hosted git repository. hsluoyz pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/casbin-admission-webhook.git
commit c2aece3da93c8abbf4e6c7fc1a18700c433b2793 Author: Yang Luo <[email protected]> AuthorDate: Wed Oct 7 10:48:54 2026 +0800 feat: release the webhook binary and Docker image only from a manually pushed tag --- .github/workflows/release.yml | 132 +++++++++++++++++++++++++++++------------- .releaserc.json | 50 ---------------- README.md | 1 - 3 files changed, 92 insertions(+), 91 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d7e418a..1617566 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,27 +1,74 @@ name: Release +# Releases are cut by hand: nothing here runs on a merge, only on a pushed tag. +# +# v1.4.0-rc1 -> GitHub pre-release (the candidate put up for the Apache vote) +# v1.4.0 -> GitHub release + push the Docker image +# +# Either way the release carries an Apache-style source tarball and the Linux +# webhook binary. The release manager downloads the tarball and signs / +# checksums it locally before starting the vote; nothing is signed here. + on: push: - branches: - - main - - master + tags: + - "v*" permissions: contents: write - issues: write - pull-requests: write + +env: + # Base name of the source release artifact, per Apache naming conventions. + ARTIFACT_BASENAME: apache-casbin-admission-webhook jobs: release: - name: Release + name: Release ${{ github.ref_name }} + if: github.repository == 'apache/casbin-admission-webhook' runs-on: ubuntu-latest - if: github.repository == 'casbin/casbin-admission-webhook' + outputs: + version: ${{ steps.version.outputs.base_version }} + prerelease: ${{ steps.version.outputs.prerelease }} steps: - - name: Checkout + - name: Checkout Repository uses: actions/checkout@v4 - with: - fetch-depth: 0 - persist-credentials: false + + - name: Resolve version from tag + id: version + run: | + set -euo pipefail + VERSION="${GITHUB_REF_NAME#v}" + # v1.4.0-rc1 -> 1.4.0. The tarball the PPMC votes on is the exact tarball + # that ships, so the candidate counter is never part of its name. + BASE_VERSION="${VERSION%%-rc*}" + if [ "$VERSION" = "$BASE_VERSION" ]; then + PRERELEASE=false + else + PRERELEASE=true + fi + # Anything that is neither vX.Y.Z nor vX.Y.Z-rcN is a typo, and a typo + # must not reach Docker Hub. + if ! echo "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)?$'; then + echo "::error::Tag $GITHUB_REF_NAME is not vX.Y.Z or vX.Y.Z-rcN." + exit 1 + fi + { + echo "base_version=$BASE_VERSION" + echo "prerelease=$PRERELEASE" + } >> "$GITHUB_OUTPUT" + echo "Tag $GITHUB_REF_NAME -> version $BASE_VERSION (pre-release: $PRERELEASE)" + + - name: Build source release tarball + id: package + run: | + set -euo pipefail + NAME="${ARTIFACT_BASENAME}-${{ steps.version.outputs.base_version }}-incubating-src" + ASSET="${RUNNER_TEMP}/${NAME}.tar.gz" + # git archive gives us exactly the tracked sources at this tag, unpacking + # into a single top-level directory named after the release. + git archive --format=tar.gz --prefix="$NAME/" -o "$ASSET" HEAD + echo "asset=$ASSET" >> "$GITHUB_OUTPUT" + ls -l "$ASSET" - name: Set up Go uses: actions/setup-go@v5 @@ -31,59 +78,64 @@ jobs: - name: Build binary run: make build - - name: Set up Node.js - uses: actions/setup-node@v4 - with: - node-version: 'lts/*' - - - name: Install semantic-release - run: | - npm install -g semantic-release@24 \ - @semantic-release/github@11 \ - @semantic-release/exec@6 \ - conventional-changelog-conventionalcommits@8 - - - name: Run semantic-release + - name: Publish GitHub release env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: npx semantic-release + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG: ${{ github.ref_name }} + ASSET: ${{ steps.package.outputs.asset }} + run: | + set -euo pipefail + FLAGS=(--title "$TAG" --generate-notes) + if [ "${{ steps.version.outputs.prerelease }}" = "true" ]; then + FLAGS+=(--prerelease) + fi + gh release create "$TAG" "$ASSET" "webhook#Webhook Binary (Linux AMD64)" "${FLAGS[@]}" docker: name: Build and Push Docker Image - runs-on: ubuntu-latest needs: release - if: github.repository == 'casbin/casbin-admission-webhook' + # Release candidates exist only for the vote; they never reach a registry. + if: needs.release.outputs.prerelease == 'false' + runs-on: ubuntu-latest + env: + VERSION: ${{ needs.release.outputs.version }} steps: - - name: Checkout - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - name: Get latest tag - id: get_tag + - name: Check the Docker Hub credentials are configured + id: gate + env: + DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} run: | - git fetch --tags - LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "v0.0.0") - echo "tag=${LATEST_TAG#v}" >> $GITHUB_OUTPUT - echo "latest_tag=${LATEST_TAG}" >> $GITHUB_OUTPUT + if [ -n "${DOCKERHUB_TOKEN}" ]; then + echo "enabled=true" >> "$GITHUB_OUTPUT" + else + echo "enabled=false" >> "$GITHUB_OUTPUT" + echo "::warning::DOCKERHUB_TOKEN is not set, so no Docker image was pushed for ${VERSION}." + fi + + - name: Checkout Repository + if: steps.gate.outputs.enabled == 'true' + uses: actions/checkout@v4 - name: Set up Docker Buildx + if: steps.gate.outputs.enabled == 'true' uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Log in to Docker Hub + if: steps.gate.outputs.enabled == 'true' uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Build and push Docker image + if: steps.gate.outputs.enabled == 'true' uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: . push: true tags: | casbin/casbin-admission-webhook:latest - casbin/casbin-admission-webhook:${{ steps.get_tag.outputs.tag }} + casbin/casbin-admission-webhook:${{ env.VERSION }} platforms: linux/amd64,linux/arm64 cache-from: type=gha cache-to: type=gha,mode=max diff --git a/.releaserc.json b/.releaserc.json deleted file mode 100644 index 5ee611d..0000000 --- a/.releaserc.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "branches": ["main", "master"], - "plugins": [ - [ - "@semantic-release/commit-analyzer", - { - "preset": "conventionalcommits", - "releaseRules": [ - {"type": "feat", "release": "minor"}, - {"type": "fix", "release": "patch"}, - {"type": "perf", "release": "patch"}, - {"type": "revert", "release": "patch"}, - {"type": "docs", "release": "patch"}, - {"type": "chore", "release": false}, - {"type": "refactor", "release": "patch"}, - {"type": "test", "release": false}, - {"type": "build", "release": false}, - {"type": "ci", "release": false} - ] - } - ], - [ - "@semantic-release/release-notes-generator", - { - "preset": "conventionalcommits", - "presetConfig": { - "types": [ - {"type": "feat", "section": "Features"}, - {"type": "fix", "section": "Bug Fixes"}, - {"type": "perf", "section": "Performance Improvements"}, - {"type": "revert", "section": "Reverts"}, - {"type": "docs", "section": "Documentation"}, - {"type": "refactor", "section": "Code Refactoring"}, - {"type": "test", "section": "Tests", "hidden": true}, - {"type": "build", "section": "Build System", "hidden": true}, - {"type": "ci", "section": "CI", "hidden": true} - ] - } - } - ], - [ - "@semantic-release/github", - { - "assets": [ - {"path": "webhook", "label": "Webhook Binary (Linux AMD64)"} - ] - } - ] - ] -} diff --git a/README.md b/README.md index dd44780..cb4550d 100644 --- a/README.md +++ b/README.md @@ -15,7 +15,6 @@ A Kubernetes Admission Webhook that uses [Casbin](https://casbin.org/) for Polic - ๐ **Easy Deployment**: Simple Kubernetes manifests and automated certificate generation - ๐งช **Well-tested**: Comprehensive unit tests and integration tests - ๐ฆ **Container-ready**: Pre-built Docker images available -- ๐ **CI/CD**: Automated releases with semantic versioning - ๐ก๏ธ **Secure**: Runs with minimal privileges and read-only root filesystem ## How It Works --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
