.github/workflows/release.yaml

name: Release
on:
  workflow_dispatch:
    inputs:
      version:
        type: string
        description: The version you intend to release without leading 'v' (eg x.y.z and not vx.y.z)
  pull_request:
    types: [closed]
  push:
    branches:
      - "release/**"
      - "next/**"
    tags:
      - v*
  release:
    types: [created]

env:
  VERSION: ${{ github.event.inputs.version }}
  APP_ID: 251311

jobs:
  prepare:
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.version != '' }}
    steps:
      - name: Generate token
        id: generate_token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
        with:
          app_id: ${{env.APP_ID}}
          private_key: ${{ secrets.TOKEN_EXCHANGE_GH_APP_PRIVATE_KEY }}
          permissions: >-
            {"contents": "write", "pull_requests": "write"}
      - name: Checkout repository code
        uses: actions/checkout@v4
        with:
          token: ${{ steps.generate_token.outputs.token }}
      - uses: actions/setup-go@v4
        with:
          go-version: "1.21.x"
      - name: Install Buf
        run: make installbuf
      - name: Update Buf Version
        run: make updateversion
      - name: Create PR
        id: cpr
        uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38
        with:
          add-paths: .
          commit-message: "Update version to v${{env.VERSION}}"
          branch: release/v${{env.VERSION}}
          delete-branch: true
          title: "Release v${{env.VERSION}}"
          body: |
            Release prepared for ${{env.VERSION}}

            Reminder: Update the changelog
          token: ${{ steps.generate_token.outputs.token }}
      - name: Slack Notification
        run: |
          jq --null-input '{ text: "BufCLI Release v${{env.VERSION}} has started: ${{ steps.cpr.outputs.pull-request-url }}" }' \
          | curl -sSL -X POST -H 'Content-Type: application/json' -d @- '${{ secrets.SLACK_RELEASE_NOTIFICATION_WEBHOOK }}'
  verify:
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'push' && startsWith(github.ref_name, 'release') }}
    steps:
      - name: Checkout repository code
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          fetch-depth: 0
      - name: Check changelog is modified
        run: |
          files=`(git fetch origin main:main) && (git diff --name-only main)`
          for file in $files; do
            if [ "$file" = "CHANGELOG.md" ]; then
              exit 0
            fi
          done
          echo ERROR: CHANGELOG has not been updated
          exit 1
  tag:
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release') }}
    steps:
      - name: Generate token
        id: generate_token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
        with:
          app_id: ${{env.APP_ID}}
          private_key: ${{ secrets.TOKEN_EXCHANGE_GH_APP_PRIVATE_KEY }}
          repositories: >-
            [ "${{ github.repository }}" ]
          permissions: >-
            {"contents": "write"}
      - name: Set VERSION variable from tag
        run: |
          VERSION=${{github.head_ref}}
          echo "VERSION=${VERSION##*/}" >> $GITHUB_ENV
      - name: Checkout repository code
        uses: actions/checkout@v4
        with:
          token: ${{ steps.generate_token.outputs.token }}
          fetch-depth: 0
      - name: Tag Release
        run: |
          git config --global user.password ${{ steps.generate_token.outputs.token }}
          git tag -d ${{env.VERSION}} 2> /dev/null || echo 'local ref does not exist'
          git push origin :${{env.VERSION}} 2> /dev/null || echo 'remote ref does not exist'
          git tag ${{env.VERSION}}
          git push origin ${{env.VERSION}}
  perform:
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'push' && startsWith(github.ref_name, 'v') && github.ref_type == 'tag'}}
    steps:
      - name: Generate token
        id: generate_token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
        with:
          app_id: ${{env.APP_ID}}
          private_key: ${{ secrets.TOKEN_EXCHANGE_GH_APP_PRIVATE_KEY }}
          repositories: >-
            [ "${{ github.repository }}" ]
          permissions: >-
            {"contents": "write", "pull_requests": "write"}
      - name: Checkout repository code
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          fetch-depth: 0
      - name: Set VERSION variable from tag
        run: |
          echo "VERSION=${{github.ref_name}}" >> $GITHUB_ENV
      - uses: actions/setup-go@v4
        with:
          go-version: "1.21.x"
      - name: Create assets
        env:
          RELEASE_MINISIGN_PRIVATE_KEY: ${{secrets.RELEASE_MINISIGN_PRIVATE_KEY}}
          RELEASE_MINISIGN_PRIVATE_KEY_PASSWORD: ${{secrets.RELEASE_MINISIGN_PRIVATE_KEY_PASSWORD}}
        run: make bufrelease
      - name: unset keys
        run: |
          unset RELEASE_MINISIGN_PRIVATE_KEY
          unset RELEASE_MINISIGN_PRIVATE_KEY_PASSWORD
      - name: Fetch Changelog
        run: .github/actions/changelog-action/entrypoint.sh > ${{env.VERSION}}-CHANGELOG.md
      - name: Release
        id: ghr
        uses: softprops/action-gh-release@v1
        with:
          token: ${{ steps.generate_token.outputs.token }}
          body_path: ${{env.VERSION}}-CHANGELOG.md
          files: |
            ${{github.workspace}}/.build/release/buf/assets/*
      - name: Slack Notification
        run: |
          jq --null-input '{ text: "BufCLI Release ${{env.VERSION}} is complete: ${{ steps.ghr.outputs.url }}" }' \
          | curl -sSL -X POST -H 'Content-Type: application/json' -d @- '${{ secrets.SLACK_RELEASE_NOTIFICATION_WEBHOOK }}'
  post-release:
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'release' }}
    outputs:
      version: ${{ steps.output_version.outputs.version }}
    steps:
      - name: Generate token
        id: generate_token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
        with:
          app_id: ${{env.APP_ID}}
          private_key: ${{ secrets.TOKEN_EXCHANGE_GH_APP_PRIVATE_KEY }}
          repositories: >-
            [ "${{ github.repository }}" ]
          permissions: >-
            {"contents": "write", "pull_requests": "write"}
      - name: Checkout repository code
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          fetch-depth: 0
      - name: Set NEXT VERSION variable from tag
        run: |
          NEXT_VERSION=$(echo ${{github.ref_name}} | awk -F. -v OFS=. '{$NF += 1 ; print}')
          echo "NEXT_VERSION=${NEXT_VERSION:1}-dev" >> $GITHUB_ENV
      - name: update version
        run: make updateversion VERSION=${{env.NEXT_VERSION}}
      - name: update home brew badge
        run: make updatehomebrewbadge VERSION=${{github.ref_name}}
      - name: create PR
        uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38
        with:
          add-paths: .
          commit-message: "Back to development"
          branch: next/${{env.NEXT_VERSION}}
          delete-branch: true
          base: main
          title: "Return to development"
          body: Release complete for ${{github.ref_name}}
          token: ${{ steps.generate_token.outputs.token }}
      - name: Output Version
        id: output_version
        uses: actions/github-script@v6
        with:
          script:
            core.setOutput('version', "${{github.ref_name}}".replace("v", ""));
  trigger-maven-update:
    runs-on: ubuntu-latest
    needs: post-release
    steps:
      - name: Generate token
        id: generate_token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
        with:
          app_id: ${{secrets.BUF_MAVEN_PUBLISH_APP_ID}}
          private_key: ${{ secrets.BUF_MAVEN_PUBLISH_APP_PRIVATE_KEY }}
          repositories: >-
            [ "bufbuild/buf-maven-publish" ]
          permissions: >-
            {"actions": "write"}
      - name: trigger maven update
        uses: actions/github-script@v6
        with:
          github-token: ${{steps.generate_token.outputs.token}}
          script: |
            github.rest.actions.createWorkflowDispatch({
              owner: "bufbuild",
              repo: "buf-maven-publish",
              workflow_id: "update-buf-version.yaml",
              ref: "main",
              inputs: {
                version: "${{needs.post-release.outputs.version}}"
              }
            })
  trigger-npm-publish:
    runs-on: ubuntu-latest
    needs: post-release
    steps:
      - name: Generate token
        id: generate_token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
        with:
          app_id: ${{secrets.BUF_NPM_PUBLISH_RELEASE_APP_ID}}
          private_key: ${{ secrets.BUF_NPM_PUBLISH_RELEASE_APP_PRIVATE_KEY }}
          repositories: >-
            [ "bufbuild/buf-npm-publish" ]
          permissions: >-
            {"actions": "write"}
      - name: trigger npm publish
        uses: actions/github-script@v6
        with:
          github-token: ${{steps.generate_token.outputs.token}}
          script: |
            github.rest.actions.createWorkflowDispatch({
              owner: "bufbuild",
              repo: "buf-npm-publish",
              workflow_id: "npm-publish.yaml",
              ref: "main",
              inputs: {
                version: "${{needs.post-release.outputs.version}}"
              }
            })
  trigger-homebrew-buf-release:
    runs-on: ubuntu-latest
    needs: post-release
    steps:
      - name: Generate token
        id: generate_token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
        with:
          app_id: ${{secrets.HOMEBREW_RELEASE_APP_ID}}
          private_key: ${{ secrets.HOMEBREW_RELEASE_APP_PRIVATE_KEY }}
          repositories: >-
            [ "bufbuild/homebrew-buf" ]
          permissions: >-
            {"actions": "write"}
      - name: trigger homebrew-buf release
        uses: actions/github-script@v6
        with:
          github-token: ${{steps.generate_token.outputs.token}}
          script: |
            github.rest.actions.createWorkflowDispatch({
              owner: "bufbuild",
              repo: "homebrew-buf",
              workflow_id: "release.yaml",
              ref: "main",
              inputs: {
                version: "${{needs.post-release.outputs.version}}"
              }
            })
  trigger-vim-buf-release:
    runs-on: ubuntu-latest
    needs: post-release
    steps:
      - name: Generate token
        id: generate_token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
        with:
          app_id: ${{secrets.VIM_BUF_RELEASE_APP_ID}}
          private_key: ${{ secrets.VIM_BUF_RELEASE_APP_PRIVATE_KEY }}
          repositories: >-
            [ "bufbuild/vim-buf" ]
          permissions: >-
            {"actions": "write"}
      - name: trigger vim-buf release
        uses: actions/github-script@v6
        with:
          github-token: ${{steps.generate_token.outputs.token}}
          script: |
            github.rest.actions.createWorkflowDispatch({
              owner: "bufbuild",
              repo: "vim-buf",
              workflow_id: "release.yaml",
              ref: "main",
              inputs: {
                version: "${{needs.post-release.outputs.version}}"
              }
            })
  trigger-buf-build-release:
    runs-on: ubuntu-latest
    needs: post-release
    steps:
      - name: Generate token
        id: generate_token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
        with:
          app_id: ${{secrets.BUF_BUILD_RELEASE_APP_ID}}
          private_key: ${{ secrets.BUF_BUILD_RELEASE_APP_PRIVATE_KEY }}
          repositories: >-
            [ "bufbuild/buf.build" ]
          permissions: >-
            {"actions": "write"}
      - name: trigger buf.build release
        uses: actions/github-script@v6
        with:
          github-token: ${{steps.generate_token.outputs.token}}
          script: |
            github.rest.actions.createWorkflowDispatch({
              owner: "bufbuild",
              repo: "buf.build",
              workflow_id: "release.yaml",
              ref: "main",
              inputs: {
                version: "${{needs.post-release.outputs.version}}"
              }
            })
  trigger-buf-setup-action-release:
    runs-on: ubuntu-latest
    needs: post-release
    steps:
      - name: Generate token
        id: generate_token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
        with:
          app_id: ${{secrets.BUF_SETUP_ACTION_RELEASE_APP_ID}}
          private_key: ${{ secrets.BUF_SETUP_ACTION_RELEASE_APP_PRIVATE_KEY }}
          repositories: >-
            [ "bufbuild/buf-setup-action" ]
          permissions: >-
            {"actions": "write"}
      - name: trigger buf-setup-action release
        uses: actions/github-script@v6
        with:
          github-token: ${{steps.generate_token.outputs.token}}
          script: |
            github.rest.actions.createWorkflowDispatch({
              owner: "bufbuild",
              repo: "buf-setup-action",
              workflow_id: "release.yaml",
              ref: "main",
              inputs: {
                version: "${{needs.post-release.outputs.version}}"
              }
            })