From d37646b765a4745140c9a14a7fcfe092812265bd Mon Sep 17 00:00:00 2001 From: Steffen Deusch Date: Tue, 10 Nov 2026 17:26:56 +0100 Subject: [PATCH] set up workload identity publish job for hex --- .github/verify-release-versions.sh | 38 ++++++++++++++++++++ .github/workflows/assets.yml | 4 +-- .github/workflows/ci.yml | 20 +++++------ .github/workflows/docs.yml | 4 +-- .github/workflows/github_release.yml | 3 ++ .github/workflows/npm-publish.yml | 5 ++- .github/workflows/publish.yml | 54 ++++++++++++++++++++++++++++ integration_test/.env | 2 +- 8 files changed, 114 insertions(+), 16 deletions(-) create mode 100755 .github/verify-release-versions.sh create mode 100644 .github/workflows/publish.yml diff --git a/.github/verify-release-versions.sh b/.github/verify-release-versions.sh new file mode 100755 index 0000000000..325360909c --- /dev/null +++ b/.github/verify-release-versions.sh @@ -0,0 +1,38 @@ +#!/usr/bin/env bash +# +# Verify that all package versions match a release tag +# +# Usage: ./verify-release-versions.sh +# Example: ./verify-release-versions.sh v1.8.9 + +set -euo pipefail + +TAG="${1:-}" + +if [[ -z "$TAG" ]]; then + echo "Usage: $0 " >&2 + echo "Example: $0 v1.8.9" >&2 + exit 1 +fi + +cd "$(dirname "$0")/.." + +TAG_VERSION="${TAG#v}" +FAILED=0 + +check_version() { + if [[ "$2" != "$TAG_VERSION" ]]; then + echo "::error file=$1::$1 has version '$2', but tag $TAG requires '$TAG_VERSION'." + FAILED=1 + fi +} + +mix_version() { + sed -n 's/^ *@version "\(.*\)"$/\1/p' "$1" +} + +check_version mix.exs "$(mix_version mix.exs)" +check_version installer/mix.exs "$(mix_version installer/mix.exs)" +check_version package.json "$(jq -r .version package.json)" + +exit "$FAILED" diff --git a/.github/workflows/assets.yml b/.github/workflows/assets.yml index 8e025ecbe3..d73baea69b 100644 --- a/.github/workflows/assets.yml +++ b/.github/workflows/assets.yml @@ -18,8 +18,8 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 15 env: - elixir: "1.20.4" - otp: "29.0.5" + elixir: "1.20.5" + otp: "29.1.2" permissions: contents: write # for stefanzweifel/git-auto-commit-action to push code in repo steps: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index edcb9a1f88..c7debbafb5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -24,8 +24,8 @@ jobs: - elixir: "1.18.4" otp: "27.3.4.13" - - elixir: "1.20.4" - otp: "29.0.5" + - elixir: "1.20.5" + otp: "29.1.2" lint: true runs-on: ubuntu-24.04 @@ -84,8 +84,8 @@ jobs: - elixir: "1.18.4" otp: "27.3.4.3" - - elixir: "1.20.4" - otp: "29.0.5" + - elixir: "1.20.5" + otp: "29.1.2" runs-on: ubuntu-24.04 timeout-minutes: 20 @@ -155,8 +155,8 @@ jobs: env: MIX_ENV: docs - elixir: "1.20.4" - otp: "29.0.5" + elixir: "1.20.5" + otp: "29.1.2" runs-on: ubuntu-24.04 timeout-minutes: 15 @@ -211,8 +211,8 @@ jobs: otp: "27.3.4.3" # keep version in sync with integration_test/.env - - elixir: "1.20.4" - otp: "29.0.5" + - elixir: "1.20.5" + otp: "29.1.2" env: ELIXIR_ASSERT_TIMEOUT: 10000 @@ -320,8 +320,8 @@ jobs: - name: Set up Elixir uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: - elixir-version: "1.20.4" - otp-version: "29.0.5" + elixir-version: "1.20.5" + otp-version: "29.1.2" - name: Download summary artifacts uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 18c91fcc0e..f92634e6b0 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -19,8 +19,8 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 15 env: - elixir: "1.20.4" - otp: "29.0.5" + elixir: "1.20.5" + otp: "29.1.2" steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/.github/workflows/github_release.yml b/.github/workflows/github_release.yml index 096d61a78e..58214ea122 100644 --- a/.github/workflows/github_release.yml +++ b/.github/workflows/github_release.yml @@ -22,6 +22,9 @@ jobs: with: persist-credentials: false + - name: Verify versions match the tag + run: bash .github/verify-release-versions.sh "$GITHUB_REF_NAME" + - name: Extract changelog for version run: bash .github/extract-changelog.sh "$GITHUB_REF_NAME" > release_notes.md diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 1c91392457..d1b48bf36d 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -22,6 +22,9 @@ jobs: with: persist-credentials: false + - name: Verify versions match the tag + run: bash .github/verify-release-versions.sh "$GITHUB_REF_NAME" + # no cache: input is set, so nothing is restored into the publishing job - name: Set up Node.js # zizmor: ignore[cache-poisoning] uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 @@ -38,7 +41,7 @@ jobs: run: | TAG=${GITHUB_REF#refs/tags/} # Update this condition when bumping the major version! - if [[ $TAG == v1.7.* ]]; then + if [[ $TAG == v1.8.* ]]; then echo "tag=old-version" >> $GITHUB_OUTPUT elif [[ $TAG == *-rc* ]]; then echo "tag=rc" >> $GITHUB_OUTPUT diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml new file mode 100644 index 0000000000..763612c3ff --- /dev/null +++ b/.github/workflows/publish.yml @@ -0,0 +1,54 @@ +# https://hex.pm/blog/announcing-workload-identity-and-staged-publishing +name: Release + +on: + push: + tags: + - "v*" + +permissions: + contents: read + +jobs: + publish: + runs-on: ubuntu-24.04 + # mix hex.publish --wait has no deadline and waits for a person to approve + # each staged release, so this uses the GitHub-hosted job limit + timeout-minutes: 360 + permissions: + contents: read + id-token: write # required for Hex workload identity + # The GitHub environment the workload identity names + environment: release + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Verify versions match the tag + run: bash .github/verify-release-versions.sh "$GITHUB_REF_NAME" + + - name: Set up Elixir + uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 + with: + elixir-version: "1.20.5" + otp-version: "29.1.2" + + # the docs alias also builds the JavaScript documentation with npm + # no cache: input is set, so nothing is restored into the publishing job + - name: Set up Node.js # zizmor: ignore[cache-poisoning] + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 + with: + node-version: "24.x" + + - name: Publish phoenix + run: | + mix deps.get + MIX_ENV=docs mix hex.publish --yes --wait + + - name: Publish phx_new + working-directory: installer + run: | + mix deps.get + MIX_ENV=docs mix hex.publish --yes --wait diff --git a/integration_test/.env b/integration_test/.env index 02a5f2e480..3ca9c1ff08 100644 --- a/integration_test/.env +++ b/integration_test/.env @@ -4,4 +4,4 @@ # Find Ubuntu image tags on Bob: # - Web UI: https://bob.hex.pm/docker?repo=hexpm/elixir&os=ubuntu&os_version=noble-&sort=elixir_version,erlang_version,os_version # - API: https://bob.hex.pm/api/docker?repo=hexpm/elixir&os=ubuntu&os_version=noble-&sort=elixir_version,erlang_version,os_version -ELIXIR_IMAGE_TAG=1.20.4-erlang-29.0.5-ubuntu-noble-20260810 +ELIXIR_IMAGE_TAG=1.20.5-erlang-29.1.2-ubuntu-noble-20261024.1