v4.3.2 #31
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: publish-to-npm | |
| on: | |
| release: | |
| types: [released] | |
| # Support manual releases in case something goes wrong, or we need to do a test. | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: Tag to be published | |
| type: string | |
| required: true | |
| jobs: | |
| # Step 1: Verify that the tag we're trying to release is a valid candidate for publishing. | |
| verify-candidate-tag: | |
| runs-on: ubuntu-latest | |
| steps: | |
| # Check out the main branch, and get its head commit as output for later. | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: 'main' | |
| - run: echo "COMMIT_ID=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT | |
| id: get-branch-commit | |
| # Checkout the tag we want to release, and get its head commit as output for later. | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.release.tag_name || inputs.tag }} | |
| - run: echo "COMMIT_ID=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT | |
| id: get-tag-commit | |
| # If the two commits aren't identical, the tag isn't eligible for release. | |
| - name: Fail non-matching commits | |
| if: ${{ steps.get-branch-commit.outputs.COMMIT_ID != steps.get-tag-commit.outputs.COMMIT_ID }} | |
| run: | | |
| echo "Tag commit must match latest commit in main. Branch is ${{ steps.get-branch-commit.outputs.COMMIT_ID }}. Tag is ${{ steps.get-tag-commit.outputs.COMMIT_ID }}" | |
| exit 1 | |
| # Verify that the `package.json`'s version property is 4.Y.Z, as we want to restrict the `dev` and `release` | |
| # branches to publishing v4.x. | |
| - name: Verify major version | |
| run: | | |
| MAJOR_VERSION=`cat package.json | jq '.version | split(".") | .[0]' | xargs` | |
| [[ ${MAJOR_VERSION} == 4 ]] || (echo "package.json version must be 4.x" && exit 1) | |
| # Verify that the tag is of the format "vX.Y.Z", where the X, Y, and Z exactly match the corresponding values in | |
| # `package.json`'s version property. | |
| - name: Compare tag to package.json | |
| run: | | |
| TAG=${{ github.event.release.tag_name || inputs.tag }} | |
| PACKAGE_VERSION=v`cat package.json | jq '.version' | xargs` | |
| [[ ${TAG} == ${PACKAGE_VERSION} ]] || (echo "Tag name must match package.json version, prefixed by lowercase v" && exit 1) | |
| # Step 2: Publish the tag as a release candidate. | |
| publish-rc: | |
| needs: verify-candidate-tag | |
| uses: salesforcecli/github-workflows/.github/workflows/npmPublish.yml@main | |
| with: | |
| ctc: false # We've been told we don't have to care about this until someone makes us care. | |
| sign: true | |
| tag: latest-rc # Publish as a release candidate, so we can do our validations against it. | |
| githubTag: ${{ github.event.release.tag_name || inputs.tag }} | |
| secrets: inherit | |
| # Step 3: Run smoke tests against the release candidate. | |
| rc-test: | |
| needs: publish-rc | |
| strategy: | |
| # By default, if any job in a matrix fails, all other jobs are immediately cancelled. This option makes the jobs | |
| # run to completion instead. | |
| fail-fast: false | |
| matrix: | |
| os: [{vm: ubuntu-latest, exe: .sh}, {vm: macos-latest, exe: .sh}, {vm: windows-2019, exe: .cmd}] | |
| runs-on: ${{ matrix.os.vm }} | |
| steps: | |
| # We need to checkout the tag to get the smoke tests | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.release.tag_name || inputs.tag }} | |
| # We need Node LTS and Java v11 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 'lts/*' | |
| - uses: actions/setup-java@v4 | |
| with: | |
| distribution: 'temurin' | |
| java-version: '11' # For now, Java version is hardcoded. | |
| # Install SF, and the release candidate version. | |
| - run: npm install -g @salesforce/cli | |
| - run: sf plugins install @salesforce/sfdx-scanner@latest-rc | |
| # Log the installed plugins for easier debugging. | |
| - run: sf plugins | |
| # Attempt to run the smoke tests. | |
| - run: smoke-tests/smoke-test${{ matrix.os.exe }} sf | |
| # Upload the smoke test result as an artifact, so it's visible for later. | |
| - uses: actions/upload-artifact@v4 | |
| if: ${{ always() }} | |
| with: | |
| name: ${{ runner.os }}-smoke-test-results | |
| path: smoke-test-results | |
| # Step 4: Promote the release candidate to latest. | |
| promote-to-latest: | |
| needs: rc-test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 'lts/*' | |
| - run: | | |
| echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc | |
| npm dist-tag add @salesforce/sfdx-scanner@${{ github.event.release.tag_name || inputs.tag }} latest | |
| # Step 5: Create a Pull Request for merging `main` into `dev` | |
| create-main2dev-pull-request: | |
| needs: promote-to-latest | |
| runs-on: macos-latest | |
| env: | |
| GH_TOKEN: ${{ secrets.SVC_CLI_BOT_GITHUB_TOKEN }} | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| steps: | |
| # Check out `main` | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: 'main' | |
| # Create a new branch based on `main`, so that merge conflicts can be manually resolved if need be. | |
| - run: | | |
| NEW_VERSION=$(jq -r ".version" package.json) | |
| git checkout -b m2d/v$NEW_VERSION | |
| git push --set-upstream origin m2d/v$NEW_VERSION | |
| # Create a Pull Request from the new branch into `dev`. | |
| - run: | | |
| NEW_VERSION=$(jq -r ".version" package.json) | |
| # For whatever reason, the version of 'echo' on GHAs doesn't process backspace by default. | |
| # The non-POSIX-standard -e flag causes it to do that. | |
| echo -e "This branch and PR were automatically created following the successful release of v$NEW_VERSION.\n\ | |
| It must be MERGED into dev, NOT SQUASHED OR REBASED. Squashing or rebasing this branch onto dev can cause potentially irreconcilable merge conflicts later.\n\ | |
| As an additional safeguard and reminder, the title of this PR MUST include the word 'merging' in the description portion of the PR title, e.g., 'Main2Dev @W-XXXXXXX@ Merging main to dev after vX.Y.Z'.\n\ | |
| If there are conflicts between dev and this branch, you should do the following locally:\n\ | |
| - $ git checkout dev\n\ | |
| - $ git pull\n\ | |
| - $ git fetch --all\n\ | |
| - $ git checkout m2d/v$NEW_VERSION\n\ | |
| - $ git pull origin dev --no-rebase # You MUST include this flag, or someone's day will be ruined.\n\ | |
| - Resolve the merge conflicts manually. When in doubt, ask the code's author for help.\n\ | |
| - $ git commit\n\ | |
| - $ git push" > body.txt | |
| # Create the pull request. | |
| gh pr create -B dev -H m2d/v$NEW_VERSION --title "Filler title. Read description and rename." -F body.txt |