Skip to content

release-github.md

Latest commit

 

History

History
106 lines (86 loc) · 3.1 KB

release-github.md

File metadata and controls

106 lines (86 loc) · 3.1 KB
Raw

Releasing on GitHub

Using release-github.yml in callers

Several permissions are included in this workflow:

  • pull-requests: read
  • contents: write

They're invoked at the workflow level for the release job. Writing contents ensures that the workflow can create new assets for the release. Reading the PR is required by inputs.get_sbom, in that the endpoint to GET artifacts from the pull requests means that the SBOM can be retrieved and then uploaded as a release asset.

Explicit permissions

A minimal workflow will create a release on GitHub with tags for the given version and separately for latest.

jobs:
  release-github:
    uses: digicatapult/shared-workflows/.github/workflows/release-github.yml@main
    permissions:
      pull-requests: read
      contents: write

Minimal with dependencies

This kind of job in release.yml should be dependent on a build step succeededing, e.g. build-docker.yml via needs: [build-docker], to help avoid broken releases.

jobs:
  release-github:
    uses: digicatapult/shared-workflows/.github/workflows/release-github.yml@main
    needs: [build-docker]
    permissions:
      pull-requests: read
      contents: write

Minimal with SBOM assets

To attach an SBOM generated by the generate-sbom workflow as a release asset, get_sbom must be set to true.

jobs:
  release-github:
    uses: digicatapult/shared-workflows/.github/workflows/release-github.yml@main
    needs: [build-docker]
    permissions:
      pull-requests: read
      contents: write
    with:
      get_sbom: true

Multiple images with SBOM assets

For a release containing multiple images, call build-docker and generate-sbom once per image with distinct image, Dockerfile, and SBOM names. Set expected_sbom_count to the number of SBOMs that the release must contain.

jobs:
  build-api:
    uses: digicatapult/shared-workflows/.github/workflows/build-docker.yml@main
    permissions:
      contents: read
      packages: write
      security-events: write
    with:
      image_name: api
      docker_file: Dockerfile.api

  build-worker:
    uses: digicatapult/shared-workflows/.github/workflows/build-docker.yml@main
    permissions:
      contents: read
      packages: write
      security-events: write
    with:
      image_name: worker
      docker_file: Dockerfile.worker

  sbom-api:
    uses: digicatapult/shared-workflows/.github/workflows/generate-sbom.yml@main
    needs: [build-api]
    permissions:
      contents: read
    with:
      sbom_output_file: api.cdx.json

  sbom-worker:
    uses: digicatapult/shared-workflows/.github/workflows/generate-sbom.yml@main
    needs: [build-worker]
    permissions:
      contents: read
    with:
      sbom_output_file: worker.cdx.json

  release-github:
    uses: digicatapult/shared-workflows/.github/workflows/release-github.yml@main
    needs: [build-api, build-worker, sbom-api, sbom-worker]
    permissions:
      pull-requests: read
      contents: write
    with:
      get_sbom: true
      expected_sbom_count: 2