merge queue: checking main (1f55db2) and #10980 together #1232
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Required source-PR gate verifying that a conventional-commit declaration is consistent with its code and changelog entries. | |
| # Mergify queue candidates skip these policy jobs because their generated metadata does not describe a source change. | |
| name: PR Gate | |
| on: | |
| # `edited` re-runs the source gate when the declaration changes; labels re-evaluate release readiness. | |
| pull_request: | |
| types: [opened, synchronize, reopened, edited, labeled, unlabeled] | |
| branches: [main] | |
| push: | |
| branches: [main] | |
| # Keeps this aggregator reporting if GitHub's native merge queue is ever enabled, | |
| # matching the sibling required-check workflows; jobs skip and the result skip-passes. | |
| merge_group: | |
| # Ensures that only one workflow task will run at a time. Previous builds, if | |
| # already in process, will get cancelled. Only the latest commit will be allowed | |
| # to run, cancelling any workflows in between | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| pull-requests: read # dorny/paths-filter reads the changed-file list | |
| env: | |
| CLICOLOR: 1 | |
| jobs: | |
| changes: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| outputs: | |
| queue_candidate: ${{ steps.classify.outputs.queue_candidate || 'false' }} | |
| semver: ${{ steps.filter.outputs.semver || 'true' }} | |
| breaking: ${{ steps.title.outputs.breaking }} | |
| type: ${{ steps.title.outputs.type }} | |
| conventional: ${{ steps.title.outputs.conventional }} | |
| steps: | |
| - name: Identify Mergify queue candidates | |
| id: classify | |
| if: github.event_name == 'pull_request' | |
| env: | |
| PR_AUTHOR: ${{ github.event.pull_request.user.login }} | |
| HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }} | |
| HEAD_REF: ${{ github.event.pull_request.head.ref }} | |
| REPOSITORY: ${{ github.repository }} | |
| run: | | |
| queue_candidate=false | |
| if [[ "$PR_AUTHOR" == "mergify[bot]" ]] && | |
| [[ "$HEAD_REPOSITORY" == "$REPOSITORY" ]] && | |
| [[ "$HEAD_REF" == mergify/merge-queue/* ]]; then | |
| queue_candidate=true | |
| fi | |
| echo "queue_candidate=$queue_candidate" >> "$GITHUB_OUTPUT" | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| if: github.event_name == 'pull_request' && steps.classify.outputs.queue_candidate != 'true' | |
| with: | |
| persist-credentials: false | |
| - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 | |
| id: filter | |
| if: github.event_name == 'pull_request' && steps.classify.outputs.queue_candidate != 'true' | |
| with: | |
| filters: .github/path-filters.yml | |
| - name: Read the declaration from the PR title | |
| id: title | |
| if: github.event_name == 'pull_request' && steps.classify.outputs.queue_candidate != 'true' | |
| env: | |
| PR_TITLE: ${{ github.event.pull_request.title }} | |
| run: | | |
| breaking_marker='^[a-z]+(\([^)]*\))?!:' | |
| conventional_marker='^([a-z]+)(\([^)]*\))?!?: .+' | |
| breaking=false | |
| type= | |
| conventional=false | |
| if [[ "$PR_TITLE" =~ $breaking_marker ]]; then | |
| breaking=true | |
| fi | |
| if [[ "$PR_TITLE" =~ $conventional_marker ]]; then | |
| conventional=true | |
| type="${BASH_REMATCH[1]}" | |
| elif [[ "$PR_TITLE" =~ ^([a-z]+) ]]; then | |
| type="${BASH_REMATCH[1]}" | |
| fi | |
| { | |
| echo "breaking=$breaking" | |
| echo "type=$type" | |
| echo "conventional=$conventional" | |
| } >> "$GITHUB_OUTPUT" | |
| semver-checks: | |
| needs: changes | |
| # Real work runs only on contributor pull requests that change Rust and do not already declare | |
| # a break with `!`. A declared break is allowed through; release-plz majors the version at release. | |
| if: >- | |
| github.event_name == 'pull_request' && | |
| needs.changes.outputs.queue_candidate != 'true' && | |
| needs.changes.outputs.semver == 'true' && | |
| needs.changes.outputs.breaking == 'false' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 45 | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| # Check out the PR head, not the merge commit, so the API delta is the PR's own. | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Compute the baseline from the PR's fork point | |
| id: baseline | |
| env: | |
| BASE_REF: ${{ github.base_ref }} | |
| run: | | |
| # `fetch-depth: 0` populates the base branch without persisting credentials. | |
| echo "rev=$(git merge-base "origin/$BASE_REF" HEAD)" >> "$GITHUB_OUTPUT" | |
| - uses: ./.github/actions/setup-zebra-build | |
| - uses: obi1kenobi/cargo-semver-checks-action@6b69fcf40e9b5fb17adeb57e4b6ecd020649a239 # v2.9 | |
| with: | |
| # Gate the consumer-facing library crates only. zebrad is a binary whose build script | |
| # needs test-only protos absent from the baseline; zebra-test and zebra-utils are test | |
| # and tooling crates whose feature-gated APIs are not stability surfaces. | |
| exclude: zebrad, zebra-test, zebra-utils | |
| feature-group: default-features | |
| baseline-rev: ${{ steps.baseline.outputs.rev }} | |
| changelog-gate: | |
| needs: changes | |
| if: >- | |
| github.event_name == 'pull_request' && | |
| needs.changes.outputs.queue_candidate != 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Check declaration and package changelogs | |
| env: | |
| BASE_REF: ${{ github.base_ref }} | |
| BREAKING: ${{ needs.changes.outputs.breaking }} | |
| CONVENTIONAL: ${{ needs.changes.outputs.conventional }} | |
| DECLARED_TYPE: ${{ needs.changes.outputs.type }} | |
| run: | | |
| # `fetch-depth: 0` populates the base branch without persisting credentials. | |
| merge_base="$(git merge-base "origin/$BASE_REF" HEAD)" | |
| bash .github/scripts/validate-pr-changelogs.sh \ | |
| "$merge_base" HEAD "$CONVENTIONAL" "$DECLARED_TYPE" "$BREAKING" | |
| # No branch rule or Mergify condition pins this worker's display name; Mergify consumes `pr-gate-result`. | |
| release-readiness: | |
| name: Release readiness | |
| if: >- | |
| github.event_name == 'pull_request' && | |
| startsWith(github.event.pull_request.head.ref, 'release-plz-') && | |
| contains(github.event.pull_request.labels.*.name, 'A-release') | |
| runs-on: ubuntu-latest-xl | |
| timeout-minutes: 90 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Resolve release comparison | |
| id: release-target | |
| env: | |
| BASE_REF: ${{ github.base_ref }} | |
| TARGET_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| base_tip="$(git rev-parse "origin/${BASE_REF}")" | |
| base_sha="$(git merge-base "${base_tip}" "${TARGET_SHA}")" | |
| if [[ "${base_sha}" != "${base_tip}" ]]; then | |
| echo "::error title=Release PR is behind main::Wait for release-plz to update this PR before review." | |
| exit 1 | |
| fi | |
| echo "base_sha=${base_sha}" >> "${GITHUB_OUTPUT}" | |
| - name: Validate release changelogs | |
| id: changelogs | |
| continue-on-error: true | |
| env: | |
| BASE_SHA: ${{ steps.release-target.outputs.base_sha }} | |
| TARGET_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: .github/scripts/validate-release-changelogs.sh "${BASE_SHA}" "${TARGET_SHA}" | |
| - name: Install Cargo 1.91 | |
| uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 | |
| with: | |
| toolchain: 1.91.0 | |
| cache-on-failure: true | |
| - name: Install libclang for librocksdb-sys bindgen | |
| run: | | |
| sudo timeout --kill-after=10s --foreground 180s apt-get \ | |
| -o Acquire::Retries=3 \ | |
| -o Acquire::http::Timeout=30 \ | |
| -o Acquire::https::Timeout=30 \ | |
| update | |
| sudo timeout --kill-after=10s --foreground 180s apt-get \ | |
| -o Acquire::Retries=3 \ | |
| -o Acquire::http::Timeout=30 \ | |
| -o Acquire::https::Timeout=30 \ | |
| install -y libclang-dev | |
| - name: Check desired release state | |
| id: cargo-release | |
| continue-on-error: true | |
| uses: ZcashFoundation/cargo-release@34a37595755444456ce0e2d2b1258d9a29c14fac | |
| with: | |
| phase: check | |
| base-sha: ${{ steps.release-target.outputs.base_sha }} | |
| target-sha: ${{ github.event.pull_request.head.sha }} | |
| github-token: ${{ github.token }} | |
| - name: Summarize release readiness | |
| if: always() | |
| env: | |
| CARGO_RELEASE_RESULT: ${{ steps.cargo-release.outcome }} | |
| CHANGELOG_RESULT: ${{ steps.changelogs.outcome }} | |
| PLAN: ${{ steps.cargo-release.outputs.plan }} | |
| REPORT: ${{ steps.cargo-release.outputs.report }} | |
| run: | | |
| { | |
| echo "## Release readiness" | |
| echo "| Validation | Result |" | |
| echo "| --- | --- |" | |
| echo "| Changelogs | \`${CHANGELOG_RESULT}\` |" | |
| echo "| Cargo release | \`${CARGO_RELEASE_RESULT}\` |" | |
| if [[ -n "${PLAN}" ]]; then | |
| echo '### Plan' | |
| echo '```json' | |
| jq . <<< "${PLAN}" || printf '%s\n' "${PLAN}" | |
| echo '```' | |
| fi | |
| if [[ -n "${REPORT}" ]]; then | |
| echo '### External state' | |
| echo '```json' | |
| jq . <<< "${REPORT}" || printf '%s\n' "${REPORT}" | |
| echo '```' | |
| fi | |
| } >> "${GITHUB_STEP_SUMMARY}" | |
| - name: Require successful release checks | |
| if: always() | |
| env: | |
| CARGO_RELEASE_RESULT: ${{ steps.cargo-release.outcome }} | |
| CHANGELOG_RESULT: ${{ steps.changelogs.outcome }} | |
| run: | | |
| if [[ "${CHANGELOG_RESULT}" != "success" || "${CARGO_RELEASE_RESULT}" != "success" ]]; then | |
| echo "::error title=Release readiness failed::Review each failed validation step and the job summary." | |
| exit 1 | |
| fi | |
| pr-gate-result: | |
| runs-on: ubuntu-latest | |
| if: always() | |
| needs: [changes, semver-checks, changelog-gate, release-readiness] | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Decide whether the needed jobs succeeded or failed | |
| uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2 | |
| with: | |
| jobs: ${{ toJSON(needs) }} | |
| allowed-skips: semver-checks, changelog-gate, release-readiness |