565995e715
- Pin all third-party actions to SHA - Gate claude.yml triggers to internal authors with Harden-Runner egress audit - Ignore fork-PR lifecycle scripts - Narrow cross-repo dispatch payloads - Add 7d npm release-age gate - Add CODEOWNERS on .github/** and .yarnrc.yml --------- Co-authored-by: prastoin <paul@twenty.com>
64 lines
1.9 KiB
YAML
64 lines
1.9 KiB
YAML
name: "Release: on merge"
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
on:
|
|
pull_request:
|
|
types:
|
|
- closed
|
|
|
|
defaults:
|
|
run:
|
|
shell: bash --noprofile --norc -euo pipefail {0}
|
|
|
|
jobs:
|
|
tag_and_release:
|
|
timeout-minutes: 10
|
|
runs-on: ubuntu-latest
|
|
if: github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'release')
|
|
steps:
|
|
- name: Check PR Author
|
|
id: check_author
|
|
env:
|
|
PR_AUTHOR: ${{ github.event.pull_request.user.login }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ "$PR_AUTHOR" != "github-actions[bot]" ]]; then
|
|
echo "PR author ($PR_AUTHOR) is not trusted. Exiting."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
|
with:
|
|
ref: main
|
|
|
|
- name: Get version from PR title
|
|
id: extract_version
|
|
env:
|
|
PR_TITLE: ${{ github.event.pull_request.title }}
|
|
run: |
|
|
set -euo pipefail
|
|
VERSION=$(printf '%s' "$PR_TITLE" | sed -n 's/.*Release v\([0-9][0-9.]*\).*/\1/p')
|
|
if [ -z "$VERSION" ]; then
|
|
echo "No valid version found in PR title. Exiting."
|
|
exit 1
|
|
fi
|
|
printf 'VERSION=%s\n' "$VERSION" >> "$GITHUB_ENV"
|
|
|
|
- name: Push new tag
|
|
run: |
|
|
set -euo pipefail
|
|
git config --global user.name 'Github Action Deploy'
|
|
git config --global user.email 'github-action-deploy@twenty.com'
|
|
git tag "v${{ env.VERSION }}"
|
|
git push origin "v${{ env.VERSION }}"
|
|
|
|
- uses: release-drafter/release-drafter@09c613e259eb8d4e7c81c2cb00618eb5fc4575a7 # v5
|
|
if: contains(github.event.pull_request.labels.*.name, 'create_release')
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
with:
|
|
tag: v${{ env.VERSION }}
|