chore: release v6.3.0 #1647
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Required source-PR gate verifying that a conventional-commit declaration is consistent with its code and changelog entries. | |
| # Mergify queue candidates skip these policy jobs because their generated metadata does not describe a source change. | |
| name: PR Gate | |
| on: | |
| # `edited` re-runs the source gate when the declaration changes; labels re-evaluate release readiness. | |
| pull_request: | |
| types: [opened, synchronize, reopened, edited, labeled, unlabeled] | |
| branches: [main] | |
| push: | |
| branches: [main] | |
| # Keeps this aggregator reporting if GitHub's native merge queue is ever enabled, | |
| # matching the sibling required-check workflows; jobs skip and the result skip-passes. | |
| merge_group: | |
| # Cancel obsolete gate runs after new commits. Unrelated label events use a | |
| # separate group so they cannot cancel the required PR Gate run. | |
| concurrency: | |
| group: >- | |
| ${{ github.workflow }}-${{ github.head_ref || github.run_id }}-${{ | |
| (github.event.action == 'labeled' || github.event.action == 'unlabeled') && | |
| github.event.label.name != 'A-release' && | |
| 'ignored-label' || | |
| 'required' | |
| }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| pull-requests: read # dorny/paths-filter reads the changed-file list | |
| env: | |
| CLICOLOR: 1 | |
| jobs: | |
| changes: | |
| # Only the A-release label affects gate results; other label events are no-ops. | |
| if: >- | |
| (github.event.action != 'labeled' && github.event.action != 'unlabeled') || | |
| github.event.label.name == 'A-release' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| outputs: | |
| queue_candidate: ${{ steps.classify.outputs.queue_candidate || 'false' }} | |
| semver: ${{ steps.filter.outputs.semver || 'true' }} | |
| breaking: ${{ steps.title.outputs.breaking }} | |
| type: ${{ steps.title.outputs.type }} | |
| conventional: ${{ steps.title.outputs.conventional }} | |
| steps: | |
| - name: Identify Mergify queue candidates | |
| id: classify | |
| if: github.event_name == 'pull_request' | |
| env: | |
| PR_AUTHOR: ${{ github.event.pull_request.user.login }} | |
| HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }} | |
| HEAD_REF: ${{ github.event.pull_request.head.ref }} | |
| REPOSITORY: ${{ github.repository }} | |
| run: | | |
| queue_candidate=false | |
| if [[ "$PR_AUTHOR" == "mergify[bot]" ]] && | |
| [[ "$HEAD_REPOSITORY" == "$REPOSITORY" ]] && | |
| [[ "$HEAD_REF" == mergify/merge-queue/* ]]; then | |
| queue_candidate=true | |
| fi | |
| echo "queue_candidate=$queue_candidate" >> "$GITHUB_OUTPUT" | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| if: github.event_name == 'pull_request' && steps.classify.outputs.queue_candidate != 'true' | |
| with: | |
| persist-credentials: false | |
| - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 | |
| id: filter | |
| if: github.event_name == 'pull_request' && steps.classify.outputs.queue_candidate != 'true' | |
| with: | |
| filters: .github/path-filters.yml | |
| - name: Read the declaration from the PR title | |
| id: title | |
| if: github.event_name == 'pull_request' && steps.classify.outputs.queue_candidate != 'true' | |
| env: | |
| PR_TITLE: ${{ github.event.pull_request.title }} | |
| run: | | |
| breaking_marker='^[a-z]+(\([^)]*\))?!:' | |
| conventional_marker='^([a-z]+)(\([^)]*\))?!?: .+' | |
| breaking=false | |
| type= | |
| conventional=false | |
| if [[ "$PR_TITLE" =~ $breaking_marker ]]; then | |
| breaking=true | |
| fi | |
| if [[ "$PR_TITLE" =~ $conventional_marker ]]; then | |
| conventional=true | |
| type="${BASH_REMATCH[1]}" | |
| elif [[ "$PR_TITLE" =~ ^([a-z]+) ]]; then | |
| type="${BASH_REMATCH[1]}" | |
| fi | |
| { | |
| echo "breaking=$breaking" | |
| echo "type=$type" | |
| echo "conventional=$conventional" | |
| } >> "$GITHUB_OUTPUT" | |
| semver-checks: | |
| needs: changes | |
| # Real work runs only on contributor pull requests that change Rust and do not already declare | |
| # a break with `!`. A declared break is allowed through; release-plz majors the version at release. | |
| if: >- | |
| github.event_name == 'pull_request' && | |
| needs.changes.outputs.queue_candidate != 'true' && | |
| needs.changes.outputs.semver == 'true' && | |
| needs.changes.outputs.breaking == 'false' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 45 | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| # Check out the PR head, not the merge commit, so the API delta is the PR's own. | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Compute the baseline from the PR's fork point | |
| id: baseline | |
| env: | |
| BASE_REF: ${{ github.base_ref }} | |
| run: | | |
| # `fetch-depth: 0` populates the base branch without persisting credentials. | |
| echo "rev=$(git merge-base "origin/$BASE_REF" HEAD)" >> "$GITHUB_OUTPUT" | |
| - uses: ./.github/actions/setup-zebra-build | |
| - uses: obi1kenobi/cargo-semver-checks-action@6b69fcf40e9b5fb17adeb57e4b6ecd020649a239 # v2.9 | |
| with: | |
| # Gate the consumer-facing library crates only. zebrad is a binary whose build script | |
| # needs test-only protos absent from the baseline; zebra-test and zebra-utils are test | |
| # and tooling crates whose feature-gated APIs are not stability surfaces. | |
| exclude: zebrad, zebra-test, zebra-utils | |
| feature-group: default-features | |
| baseline-rev: ${{ steps.baseline.outputs.rev }} | |
| # This checks for changelog entries depending on the type of the PR (per title). | |
| # An entry is required for a crate if any file in the crate changed. | |
| # If the title indicates a breaking change, the changelog must also have a `### Breaking Changes` section. | |
| changelog-gate: | |
| needs: changes | |
| if: >- | |
| github.event_name == 'pull_request' && | |
| needs.changes.outputs.queue_candidate != 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Check declaration and package changelogs | |
| env: | |
| BASE_REF: ${{ github.base_ref }} | |
| BREAKING: ${{ needs.changes.outputs.breaking }} | |
| CONVENTIONAL: ${{ needs.changes.outputs.conventional }} | |
| DECLARED_TYPE: ${{ needs.changes.outputs.type }} | |
| run: | | |
| # `fetch-depth: 0` populates the base branch without persisting credentials. | |
| merge_base="$(git merge-base "origin/$BASE_REF" HEAD)" | |
| bash .github/scripts/validate-pr-changelogs.sh \ | |
| "$merge_base" HEAD "$CONVENTIONAL" "$DECLARED_TYPE" "$BREAKING" | |
| # No branch rule or Mergify condition pins this worker's display name; Mergify consumes `pr-gate-result`. | |
| release-readiness: | |
| name: Release readiness | |
| if: >- | |
| github.event_name == 'pull_request' && | |
| ((github.event.action != 'labeled' && github.event.action != 'unlabeled') || | |
| github.event.label.name == 'A-release') && | |
| startsWith(github.event.pull_request.head.ref, 'release-plz-') && | |
| contains(github.event.pull_request.labels.*.name, 'A-release') | |
| runs-on: ubuntu-latest-xl | |
| timeout-minutes: 90 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Resolve release comparison | |
| id: release-target | |
| env: | |
| BASE_REF: ${{ github.base_ref }} | |
| TARGET_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| base_tip="$(git rev-parse "origin/${BASE_REF}")" | |
| base_sha="$(git merge-base "${base_tip}" "${TARGET_SHA}")" | |
| if [[ "${base_sha}" != "${base_tip}" ]]; then | |
| echo "::error title=Release PR is behind main::Wait for release-plz to update this PR before review." | |
| exit 1 | |
| fi | |
| echo "base_sha=${base_sha}" >> "${GITHUB_OUTPUT}" | |
| # Checks if the changelogs have entries for the versions being released | |
| # (used in the in the release PR). | |
| - name: Validate release changelogs | |
| id: changelogs | |
| continue-on-error: true | |
| env: | |
| BASE_SHA: ${{ steps.release-target.outputs.base_sha }} | |
| TARGET_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: .github/scripts/validate-release-changelogs.sh "${BASE_SHA}" "${TARGET_SHA}" | |
| - name: Install Cargo 1.91 | |
| uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 | |
| with: | |
| toolchain: 1.91.0 | |
| cache-on-failure: true | |
| - name: Install libclang for librocksdb-sys bindgen | |
| run: | | |
| sudo timeout --kill-after=10s --foreground 180s apt-get \ | |
| -o Acquire::Retries=3 \ | |
| -o Acquire::http::Timeout=30 \ | |
| -o Acquire::https::Timeout=30 \ | |
| update | |
| sudo timeout --kill-after=10s --foreground 180s apt-get \ | |
| -o Acquire::Retries=3 \ | |
| -o Acquire::http::Timeout=30 \ | |
| -o Acquire::https::Timeout=30 \ | |
| install -y libclang-dev | |
| - name: Check desired release state | |
| id: cargo-release | |
| continue-on-error: true | |
| uses: ZcashFoundation/cargo-release@0083006dfd267ed560b4cf1aed347ef2f326162e # v0.1.0 | |
| with: | |
| phase: check | |
| base-sha: ${{ steps.release-target.outputs.base_sha }} | |
| target-sha: ${{ github.event.pull_request.head.sha }} | |
| github-token: ${{ github.token }} | |
| - name: Summarize release readiness | |
| if: always() | |
| env: | |
| CARGO_RELEASE_RESULT: ${{ steps.cargo-release.outcome }} | |
| CHANGELOG_RESULT: ${{ steps.changelogs.outcome }} | |
| PLAN: ${{ steps.cargo-release.outputs.plan }} | |
| REPORT: ${{ steps.cargo-release.outputs.report }} | |
| run: | | |
| { | |
| echo "## Release readiness" | |
| echo "| Validation | Result |" | |
| echo "| --- | --- |" | |
| echo "| Changelogs | \`${CHANGELOG_RESULT}\` |" | |
| echo "| Cargo release | \`${CARGO_RELEASE_RESULT}\` |" | |
| if [[ -n "${PLAN}" ]]; then | |
| echo '### Plan' | |
| echo '```json' | |
| jq . <<< "${PLAN}" || printf '%s\n' "${PLAN}" | |
| echo '```' | |
| fi | |
| if [[ -n "${REPORT}" ]]; then | |
| echo '### External state' | |
| echo '```json' | |
| jq . <<< "${REPORT}" || printf '%s\n' "${REPORT}" | |
| echo '```' | |
| fi | |
| } >> "${GITHUB_STEP_SUMMARY}" | |
| - name: Require successful release checks | |
| if: always() | |
| env: | |
| CARGO_RELEASE_RESULT: ${{ steps.cargo-release.outcome }} | |
| CHANGELOG_RESULT: ${{ steps.changelogs.outcome }} | |
| run: | | |
| if [[ "${CHANGELOG_RESULT}" != "success" || "${CARGO_RELEASE_RESULT}" != "success" ]]; then | |
| echo "::error title=Release readiness failed::Review each failed validation step and the job summary." | |
| exit 1 | |
| fi | |
| pr-gate-result: | |
| # Keep skipped unrelated-label runs from replacing the required check. | |
| name: >- | |
| ${{ | |
| (github.event.action == 'labeled' || github.event.action == 'unlabeled') && | |
| github.event.label.name != 'A-release' && | |
| 'Label does not affect the PR gate' || | |
| 'pr-gate-result' | |
| }} | |
| runs-on: ubuntu-latest | |
| if: >- | |
| always() && | |
| ((github.event.action != 'labeled' && github.event.action != 'unlabeled') || | |
| github.event.label.name == 'A-release') | |
| needs: [changes, semver-checks, changelog-gate, release-readiness] | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Decide whether the needed jobs succeeded or failed | |
| uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2 | |
| with: | |
| jobs: ${{ toJSON(needs) }} | |
| # Leave it for the PR author and reviewer to decide if the changelog | |
| # entries are good enough. | |
| allowed-failures: changelog-gate | |
| allowed-skips: semver-checks, changelog-gate, release-readiness |