dttung2905 commented on code in PR #53: URL: https://github.com/apache/terraform-provider-iceberg/pull/53#discussion_r3554690828
########## .github/workflows/tf-release.yml: ########## @@ -0,0 +1,171 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# On a release-candidate tag (e.g. v0.7.0-rc1), builds the source tarball and +# convenience binaries and publishes them as a GitHub prerelease. The release +# manager drives the rest from dev/release/release_rc.sh (see docs/releasing.md); +# CI never signs. + +name: Terraform Build Release Candidate + +on: + push: + tags: + # RC tags only; the final vX.Y.Z tag is published by release.sh. + - 'v*-rc*' + +concurrency: + group: ${{ github.repository }}-${{ github.ref }}-${{ github.workflow }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + source-release: + name: Build source distribution + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + fetch-depth: 0 + + - name: Determine version + id: version + env: + TAG: ${{ github.ref_name }} + run: | + # v0.7.0-rc1 -> version=0.7.0, rc=1 + version=${TAG#v} + version=${version%-rc*} + rc=${TAG##*-rc} + echo "version=${version}" >> "$GITHUB_OUTPUT" + echo "rc=${rc}" >> "$GITHUB_OUTPUT" + + - name: Build source tarball + env: + VERSION: ${{ steps.version.outputs.version }} + RC: ${{ steps.version.outputs.rc }} + run: | + # -rc in the filename, but unpacks to a dir without it so the tree + # matches the final release. + dir="apache-iceberg-terraform-${VERSION}" + tar_gz="apache-iceberg-terraform-${VERSION}-rc${RC}.tar.gz" + git archive --format=tar.gz --prefix="${dir}/" -o "${tar_gz}" HEAD + sha512sum "${tar_gz}" > "${tar_gz}.sha512" + + - name: Upload source artifact + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: source-release-candidate + path: apache-iceberg-terraform-*.tar.gz* + if-no-files-found: error + + binary-release: + name: Build provider binaries + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + fetch-depth: 0 + + - name: Determine version + id: version + env: + TAG: ${{ github.ref_name }} + run: | + version=${TAG#v} + version=${version%-rc*} + echo "version=${version}" >> "$GITHUB_OUTPUT" + + - name: Install Go + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 + with: + go-version: '1.25.1' Review Comment: This hardcoded go version might fail when go ver is bumped in go-ci.yml. Can we dynamically get it from go mod parse step and install it. Something like ``` - name: Read Go version from go.mod id: go-version run: | version=$(grep -E '^go ' go.mod | awk '{print $2}') echo "version=${version}" >> "$GITHUB_OUTPUT" ``` ########## dev/release/release_rc.sh: ########## @@ -0,0 +1,203 @@ +#!/usr/bin/env bash +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# +# Cuts a release candidate for the Apache Iceberg Terraform provider: +# +# 1. Tags v<version>-rc<rc> and pushes it, which triggers the +# "Terraform Build Release Candidate" workflow (../../.github/workflows/tf-release.yml). +# 2. Waits for that workflow to publish the GitHub prerelease, then downloads +# its artifacts. +# 3. Signs the source tarball (.asc) and the binary SHA256SUMS (.sig) with your +# KEYS-registered GPG key and uploads the signatures back to the prerelease. +# 4. Uploads the signed *source* release to the Apache dev SVN (the artifact the +# PMC votes on). Convenience binaries stay on the GitHub prerelease. +# 5. Prints the [VOTE] email for [email protected]. +# +# Usage: dev/release/release_rc.sh <version> <rc> +# e.g.: dev/release/release_rc.sh 0.7.0 1 +# +# Set RELEASE_PUSH_TAG=0 / RELEASE_SIGN=0 / RELEASE_UPLOAD=0 (or RELEASE_DEFAULT=0) +# to dry-run individual stages. + +set -eu + +SOURCE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +SOURCE_TOP_DIR="$(cd "${SOURCE_DIR}/../../" && pwd)" + +if [ "$#" -ne 2 ]; then + echo "Usage: $0 <version> <rc>" + echo " e.g.: $0 0.7.0 1" + exit 1 +fi + +version=$1 +rc=$2 + +: "${RELEASE_DEFAULT:=1}" +: "${RELEASE_PULL:=${RELEASE_DEFAULT}}" +: "${RELEASE_PUSH_TAG:=${RELEASE_DEFAULT}}" +: "${RELEASE_SIGN:=${RELEASE_DEFAULT}}" +: "${RELEASE_UPLOAD:=${RELEASE_DEFAULT}}" + +cd "${SOURCE_TOP_DIR}" + +if [ "${RELEASE_PULL}" -gt 0 ] || [ "${RELEASE_PUSH_TAG}" -gt 0 ]; then + git_origin_url="$(git remote get-url origin)" + if [ "${git_origin_url}" != "[email protected]:apache/terraform-provider-iceberg.git" ]; then + echo "This script must be run with a working copy of apache/terraform-provider-iceberg." + echo "The origin's URL: ${git_origin_url}" + exit 1 + fi +fi + +if [ "${RELEASE_PULL}" -gt 0 ]; then + # Refresh the current branch (main for major/minor, iceberg-terraform-X.Y.x + # for a patch release). Check out the correct branch before running. + echo "Ensuring the current branch is up to date" + git pull --rebase --prune +fi + +rc_tag="v${version}-rc${rc}" +if [ "${RELEASE_PUSH_TAG}" -gt 0 ]; then + echo "Tagging for RC: ${rc_tag}" + git tag -a -m "Apache Iceberg Terraform provider ${version} RC${rc}" "${rc_tag}" + git push origin "${rc_tag}" +fi + +rc_hash="$(git rev-list --max-count=1 "${rc_tag}")" + +repository="apache/terraform-provider-iceberg" + +# Names of the artifacts published by the workflow to the GitHub prerelease. +rc_tar_gz="apache-iceberg-terraform-${version}-rc${rc}.tar.gz" +sha256sums="terraform-provider-iceberg_${version}_SHA256SUMS" + +# id is both the local staging directory and the Apache dev SVN directory name. +# It carries the -rc suffix; the files inside are renamed to drop it below. +id="apache-iceberg-terraform-${version}-rc${rc}" + +if [ "${RELEASE_SIGN}" -gt 0 ]; then + echo "Looking for the release workflow run on ${repository}:${rc_tag}" + run_id="" + while [ -z "${run_id}" ]; do Review Comment: without timeout this can potentially loop forever or until the CI pipeline timeout. Can we add a timeout for this while loop ? ``` run_id="" max_attempts=60 # 60 × 5s = 5 minutes attempt=0 while [ -z "${run_id}" ]; do attempt=$((attempt + 1)) if [ "${attempt}" -gt "${max_attempts}" ]; then echo "Timed out after $((max_attempts * 5))s waiting for workflow tf-release.yml on tag ${rc_tag}." echo "Check: gh run list --repo ${repository} --workflow=tf-release.yml" exit 1 fi echo "Waiting for the run to start... (attempt ${attempt}/${max_attempts})" run_id=$(gh run list \ --repo "${repository}" \ --workflow=tf-release.yml \ --limit 20 \ --json 'databaseId,event,headBranch,status' \ --jq ".[] | select(.event == \"push\" and .headBranch == \"${rc_tag}\") | .databaseId" \ | head -1) [ -z "${run_id}" ] && sleep 5 done ``` ########## .github/workflows/tf-release.yml: ########## @@ -0,0 +1,171 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# On a release-candidate tag (e.g. v0.7.0-rc1), builds the source tarball and +# convenience binaries and publishes them as a GitHub prerelease. The release +# manager drives the rest from dev/release/release_rc.sh (see docs/releasing.md); +# CI never signs. + +name: Terraform Build Release Candidate + +on: + push: + tags: + # RC tags only; the final vX.Y.Z tag is published by release.sh. + - 'v*-rc*' + +concurrency: + group: ${{ github.repository }}-${{ github.ref }}-${{ github.workflow }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + source-release: + name: Build source distribution + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + fetch-depth: 0 + + - name: Determine version + id: version + env: + TAG: ${{ github.ref_name }} + run: | + # v0.7.0-rc1 -> version=0.7.0, rc=1 + version=${TAG#v} + version=${version%-rc*} + rc=${TAG##*-rc} + echo "version=${version}" >> "$GITHUB_OUTPUT" + echo "rc=${rc}" >> "$GITHUB_OUTPUT" + + - name: Build source tarball + env: + VERSION: ${{ steps.version.outputs.version }} + RC: ${{ steps.version.outputs.rc }} + run: | + # -rc in the filename, but unpacks to a dir without it so the tree + # matches the final release. + dir="apache-iceberg-terraform-${VERSION}" + tar_gz="apache-iceberg-terraform-${VERSION}-rc${RC}.tar.gz" + git archive --format=tar.gz --prefix="${dir}/" -o "${tar_gz}" HEAD + sha512sum "${tar_gz}" > "${tar_gz}.sha512" + + - name: Upload source artifact + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: source-release-candidate + path: apache-iceberg-terraform-*.tar.gz* + if-no-files-found: error + + binary-release: + name: Build provider binaries + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + fetch-depth: 0 + + - name: Determine version + id: version + env: + TAG: ${{ github.ref_name }} + run: | + version=${TAG#v} + version=${version%-rc*} + echo "version=${version}" >> "$GITHUB_OUTPUT" + + - name: Install Go + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 Review Comment: nit: Can you update this to match the higher version here ? https://github.com/apache/terraform-provider-iceberg/blob/65cffc9d09f746fa9590933b5328ffecc2370010/.github/workflows/go-ci.yml#L49 ########## .github/workflows/tf-release.yml: ########## @@ -0,0 +1,171 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# On a release-candidate tag (e.g. v0.7.0-rc1), builds the source tarball and +# convenience binaries and publishes them as a GitHub prerelease. The release +# manager drives the rest from dev/release/release_rc.sh (see docs/releasing.md); +# CI never signs. + +name: Terraform Build Release Candidate + +on: + push: + tags: + # RC tags only; the final vX.Y.Z tag is published by release.sh. + - 'v*-rc*' + +concurrency: + group: ${{ github.repository }}-${{ github.ref }}-${{ github.workflow }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + source-release: + name: Build source distribution + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 Review Comment: nit: Can you change it to v7.0.0 to match here https://github.com/apache/terraform-provider-iceberg/blob/65cffc9d09f746fa9590933b5328ffecc2370010/.github/workflows/go-ci.yml#L45 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
