Repository navigation
Release 0.195.7-next #370
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 🌍 Release | |
| run-name: Release ${{github.ref_name}} | |
| on: | |
| workflow_dispatch: | |
| release: | |
| types: [published] | |
| permissions: | |
| contents: write | |
| pages: write | |
| id-token: write | |
| pull-requests: write | |
| jobs: | |
| deploy-website: | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| steps: | |
| - name: Checkout released ref | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.release.tag_name || github.ref_name }} | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10.33.0 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "22" | |
| cache: pnpm | |
| cache-dependency-path: website/pnpm-lock.yaml | |
| - name: Install website dependencies | |
| run: | | |
| cd website | |
| pnpm install --frozen-lockfile | |
| - name: Build website | |
| env: | |
| TERRABUILD_DOCS_LAST_VERSION: ${{ github.event.release.tag_name || github.ref_name || 'current' }} | |
| run: | | |
| cd website | |
| pnpm build | |
| - name: Configure GitHub Pages | |
| uses: actions/configure-pages@v5 | |
| - name: Upload Pages artifact | |
| uses: actions/upload-pages-artifact@v4 | |
| with: | |
| path: website/build | |
| - name: Deploy to GitHub Pages | |
| id: deployment | |
| uses: actions/deploy-pages@v4 | |
| release-nuget: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Setup .NET Core | |
| uses: actions/setup-dotnet@v4 | |
| with: | |
| dotnet-version: 10.0.201 | |
| - name: Download Github Release artifacts | |
| uses: robinraju/release-downloader@v1.11 | |
| with: | |
| tag: ${{github.ref_name}} | |
| fileName: '*.nupkg' | |
| - name: NuGet Release | |
| run: dotnet nuget push Terrabuild.${{github.ref_name}}.nupkg --skip-duplicate --api-key ${{secrets.NUGET_KEY}} --source https://api.nuget.org/v3/index.json | |
| sign-and-notarize: | |
| runs-on: macos-latest | |
| steps: | |
| - name: Download Github Release artifacts | |
| uses: robinraju/release-downloader@v1.11 | |
| with: | |
| tag: ${{github.ref_name}} | |
| fileName: 'terrabuild-*-darwin-unsigned.zip' | |
| - name: Extract Binaries | |
| run: | | |
| mkdir -p .out/darwin | |
| unzip -d .out/darwin terrabuild-${{ github.ref_name }}-darwin-unsigned.zip | |
| test -f .out/darwin/entitlements.plist | |
| - name: Add Cert to Keychain | |
| uses: apple-actions/import-codesign-certs@v3 | |
| with: | |
| p12-file-base64: ${{ secrets.MAC_CERT_BASE64 }} | |
| p12-password: ${{ secrets.MAC_CERT_PASSWORD }} | |
| - name: Sign Binaries | |
| run: | | |
| codesign --force --timestamp --sign "Developer ID Application: Magnus Opera (${{ secrets.MAC_DEV_TEAM_ID }})" .out/darwin/arm64/terrabuild --options=runtime --no-strict --entitlements .out/darwin/entitlements.plist | |
| (cd .out/darwin/arm64; zip ../terrabuild-${{ github.ref_name }}-darwin-arm64.zip ./*) | |
| - name: Notarize arm64 | |
| uses: GuillaumeFalourd/notary-tools@v1 | |
| timeout-minutes: 5 | |
| with: | |
| product_path: ".out/darwin/terrabuild-${{github.ref_name}}-darwin-arm64.zip" | |
| apple_id: ${{ secrets.MAC_DEV_LOGIN }} | |
| password: ${{ secrets.MAC_DEV_PASSWORD }} | |
| team_id: ${{ secrets.MAC_DEV_TEAM_ID }} | |
| xcode_path: '/Applications/Xcode_16.4.app' | |
| staple: false | |
| - name: Upload signed macOS artifacts | |
| uses: softprops/action-gh-release@v2.0.6 | |
| with: | |
| tag_name: ${{ github.ref_name }} | |
| files: | | |
| .out/darwin/terrabuild-${{github.ref_name}}-darwin-arm64.zip | |
| - name: Remove unsigned macOS artifact | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const tag = context.ref.replace('refs/tags/', ''); | |
| const unsignedName = `terrabuild-${tag}-darwin-unsigned.zip`; | |
| const { data: release } = await github.rest.repos.getReleaseByTag({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| tag, | |
| }); | |
| const asset = release.assets.find(a => a.name === unsignedName); | |
| if (!asset) { | |
| core.info(`Unsigned artifact not found: ${unsignedName}`); | |
| return; | |
| } | |
| await github.rest.repos.deleteReleaseAsset({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| asset_id: asset.id, | |
| }); | |
| core.info(`Deleted unsigned artifact: ${unsignedName}`); | |
| update-homebrew-tap: | |
| uses: ./.github/workflows/release-homebrew-tap.yml | |
| needs: sign-and-notarize | |
| permissions: | |
| contents: read | |
| with: | |
| ref: ${{ github.ref }} | |
| version: ${{ github.ref_name }} | |
| dry-run: false | |
| secrets: inherit |