feat: nightly releases

.github/workflows/automerge-nightly-pr.yml

@@ -0,0 +1,26 @@
+name: automerge-nightly-pr
+
+on:
+  pull_request:
+    types: [labeled]
+
+# This job relies on defining required checks in your branch protection settings
+# Settings > Branches > 'main' > Require status checks to pass before merging
+
+jobs:
+  automerge:
+    runs-on: ubuntu-latest
+    if: startsWith(github.event.pull_request.title, 'Release PR for') && endsWith(github.event.pull_request.title, 'nightly')
+    steps:
+      - name: Install plugin-release-management
+        run: npm install -g @salesforce/plugin-release-management --omit=dev
+      - name: Automerge
+        uses: nick-fields/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd
+        with:
+          max_attempts: 15
+          retry_wait_seconds: 120 # 15 attempts every two minutes
+          command: sf-release cli:release:automerge --owner salesforcecli --repo cli --pull-number ${{ github.event.pull_request.number }} --verbose
+          retry_on: error
+          timeout_minutes: 60
+        env:
+          GITHUB_TOKEN: ${{ secrets.SVC_CLI_BOT_GITHUB_TOKEN }}

.github/workflows/create-cli-release.yml

@@ -0,0 +1,139 @@
+name: create-cli-release
+on:
+  release:
+    # This works for both releases and prereleases https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#release
+    types: [published]
+
+jobs:
+  get-channel:
+    runs-on: ubuntu-latest
+    outputs:
+      channel: ${{ steps.release-channel.outputs.group1 }}
+      s3-channel: ${{ steps.s3-release-channel.outputs.s3-channel }}
+    steps:
+      - name: Get release channel Github release
+        id: release-channel
+        uses: actions-ecosystem/action-regex-match@9e6c4fb3d5e898f505be7a1fb6e7b0a278f6665b
+        with:
+          text: ${{ github.event.release.body }}
+          # https://regex101.com/r/tYAJ8L/1
+          regex: '!! Release as ([a-z-]+) !!'
+      - name: Confirm regex channel match
+        if: ${{ !steps.release-channel.outputs.group1 }}
+        uses: actions/github-script@v3
+        with:
+          script: |
+            core.setFailed('Release channel was not found in release body. Exiting')
+      - name: Get release channel for s3
+        id: s3-release-channel
+        run: |
+          CHANNEL=${{ steps.release-channel.outputs.group1 }}
+          S3_CHANNEL=${CHANNEL/latest/stable}
+          echo "s3-channel=$S3_CHANNEL" >> "$GITHUB_OUTPUT"
+      - name: Channel Notice
+        run: |
+          echo "::notice title=Channel::Channel found in Github Release: ${{ steps.release-channel.outputs.group1 }}"
+          echo "::notice title=S3 Channel::Channel that will be used in S3: ${{ steps.s3-release-channel.outputs.s3-channel }}"
+
+  npm-release:
+    uses: salesforcecli/github-workflows/.github/workflows/npmPublish.yml@main
+    needs: [get-channel]
+    secrets: inherit
+    with:
+      tag: ${{ needs.get-channel.outputs.channel }}
+      githubTag: ${{ github.event.release.tag_name }}
+
+  pack-verify-upload-tarballs:
+    needs: [get-channel, npm-release]
+    uses: salesforcecli/github-workflows/.github/workflows/tarballs.yml@main
+    with:
+      upload: true
+      cli: sf
+      version: ${{ github.event.release.tag_name }}
+      channel: ${{ needs.get-channel.outputs.s3-channel }}
+    secrets: inherit
+
+  archives-verify:
+    # Skip archive-verify on prereleases
+    if: ${{ contains(fromJSON('["latest", "latest-rc", "nightly"]'), needs.get-channel.outputs.channel) }}
+    runs-on: ubuntu-latest
+    needs: [get-channel, pack-verify-upload-tarballs]
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          node-version: lts/*
+          cache: npm
+      - run: npm install -g @salesforce/plugin-release-management --omit=dev
+      # Retry several times because the S3 cache can cause failures
+      - name: Version inspect (with retries)
+        uses: nick-fields/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd
+        with:
+          max_attempts: 5
+          retry_wait_seconds: 120
+          command: sf-release cli:versions:inspect -c ${{ needs.get-channel.outputs.s3-channel }} -l archive --cli sf
+          retry_on: error
+          timeout_minutes: 60
+
+  pack-upload-mac:
+    needs: [get-channel, pack-verify-upload-tarballs]
+    uses: salesforcecli/github-workflows/.github/workflows/packUploadMac.yml@main
+    with:
+      cli: sf
+      version: ${{ github.event.release.tag_name }}
+      channel: ${{ needs.get-channel.outputs.s3-channel }}
+    secrets: inherit
+
+  # The rename-mac-pkg job is only needed as long as the developer site is linking to the old sfdx.pkg file and the mac signing job is only signing the old file as well.
+  # It can be removed once those are updated to use the new name, sfdx-x64.pkg.
+  rename-mac-pkg:
+    needs: [get-channel, pack-upload-mac]
+    runs-on: ubuntu-latest
+    env:
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      AWS_EC2_METADATA_DISABLED: true
+    steps:
+      - uses: salesforcecli/github-workflows/.github/actions/renameMacPkg@main
+        with:
+          cli: sf
+          channel: ${{ needs.get-channel.outputs.s3-channel }}
+
+  pack-upload-win:
+    needs: [get-channel, pack-verify-upload-tarballs]
+    uses: salesforcecli/github-workflows/.github/workflows/packUploadWindows.yml@main
+    with:
+      cli: sf
+      version: ${{ github.event.release.tag_name }}
+      channel: ${{ needs.get-channel.outputs.s3-channel }}
+    secrets: inherit
+
+  # TODO: Add docker-build-full and docker-build-slim here
+  #       Also add them to the announce-rc-release-to-slack job "needs"
+
+  announce-rc-release-to-slack:
+    # Do not announce prereleases or nightlies
+    # https://docs.github.com/en/actions/learn-github-actions/expressions#contains
+    if: ${{ contains(fromJSON('["latest", "latest-rc"]'), needs.get-channel.outputs.channel ) }}
+    runs-on: ubuntu-latest
+    needs:
+      - get-channel
+      - pack-verify-upload-tarballs
+      - npm-release
+      - pack-upload-win
+      - pack-upload-mac
+      - rename-mac-pkg
+    steps:
+      - name: Announce RC Workflow
+        id: slack
+        uses: slackapi/[email protected]
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_RC_ANNOUNCEMENT_WORKFLOW_WEBHOOK }}
+        with:
+          # This data can be any valid JSON from a previous step in the GitHub Action
+          payload: |
+            {
+              "cli": "sf",
+              "npm-package": "@salesforce/cli",
+              "version": "${{ github.event.release.tag_name }}"
+            }

.github/workflows/create-github-release.yml

@@ -0,0 +1,105 @@
+name: create-github-release
+
+on:
+  pull_request:
+    branches:
+      - main
+      - release-base/*
+    types:
+      - closed
+
+jobs:
+  # This job determines the channel that will be released.
+  validate-channel:
+    # All release PRs must have the 'release' branch prefix
+    # They must start with the string 'Release PR for'.
+    # Must also be merged=true (this ignores PRs that are closed without merging)
+    if: startsWith(github.head_ref, 'release') && startsWith(github.event.pull_request.title, 'Release PR for') && github.event.pull_request.merged == true
+    runs-on: ubuntu-latest
+    outputs:
+      channel: ${{ steps.found-channel.outputs.channel }}
+    steps:
+      - name: Get release channel from PR title
+        id: release-channel
+        uses: actions-ecosystem/action-regex-match@9e6c4fb3d5e898f505be7a1fb6e7b0a278f6665b
+        with:
+          text: ${{ github.event.pull_request.title }}
+          # https://regex101.com/r/66VrAs/1
+          regex: 'as ([a-z-]+)$'
+
+      # Exit the build if no channel is match
+      - name: Confirm regex channel match
+        if: ${{ !steps.release-channel.outputs.group1 }}
+        uses: actions/github-script@v3
+        with:
+          script: |
+            core.setFailed('Release channel was not found in PR title. Exiting')
+
+      # Checkout needed to validate prerelease version in package.json
+      - name: Check out the repo
+        if: ${{ !contains(fromJSON('["latest", "latest-rc", "nightly"]'), steps.release-channel.outputs.group1) }}
+        uses: actions/checkout@v3
+
+      - name: Get prerelease from package.json
+        id: check-prerelease
+        if: ${{ !contains(fromJSON('["latest", "latest-rc", "nightly"]'), steps.release-channel.outputs.group1) }}
+        uses: salesforcecli/github-workflows/.github/actions/getPreReleaseTag@main
+
+      # Package.json version must contain "alpha" tag: example 1.2.3-beta.0 (beta)
+      # Package.json "alpha" tag must match PR title channel
+      - name: Validate prerelease tag
+        if: ${{ !contains(fromJSON('["latest", "latest-rc", "nightly"]'), steps.release-channel.outputs.group1) && (!steps.check-prerelease.outputs.tag || steps.check-prerelease.outputs.tag != steps.release-channel.outputs.group1) }}
+        uses: actions/github-script@v3
+        with:
+          script: |
+            core.setFailed('Prerelease requires a dist tag name in your package.json like beta in 1.1.1-beta.0')
+
+      # Echo and set the matched channel
+      - name: Set channel output
+        id: found-channel
+        run: |
+          echo "Found channel: ${{ steps.release-channel.outputs.group1 }}"
+          echo "::notice title=Channel::Channel found in PR title: ${{ steps.release-channel.outputs.group1 }}"
+          echo "channel=${{ steps.release-channel.outputs.group1 }}" >> "$GITHUB_OUTPUT"
+
+  create-tag-and-release-in-github:
+    needs: [validate-channel]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v3
+
+      - name: Conventional Changelog Action
+        id: changelog
+        uses: TriPSs/conventional-changelog-action@d360fad3a42feca6462f72c97c165d60a02d4bf2
+        # overriding some of the basic behaviors to just get the changelog
+        with:
+          git-user-name: svc-cli-bot
+          git-user-email: [email protected]
+          github-token: ${{ secrets.SVC_CLI_BOT_GITHUB_TOKEN }}
+          output-file: false
+          # always do the release, even if there are no semantic commits
+          skip-on-empty: false
+          # pjson version was already updated by the "cli:release:build" script, so don't base behavior on these commits
+          skip-version-file: true
+          # avoids the default `v` so all the later actions don't have to remove it
+          tag-prefix: ''
+      - uses: notiz-dev/github-action-json-property@2192e246737701f108a4571462b76c75e7376216
+        id: packageVersion
+        with:
+          path: 'package.json'
+          prop_path: 'version'
+      - name: Create Github Release
+        uses: actions/create-release@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.SVC_CLI_BOT_GITHUB_TOKEN }}
+        with:
+          tag_name: ${{ steps.packageVersion.outputs.prop }}
+          release_name: ${{ steps.packageVersion.outputs.prop }}
+          prerelease: ${{ !contains(fromJSON('["latest", "latest-rc", "nightly"]'), needs.validate-channel.outputs.channel) }}
+          # This channel value is read from the Github Release body to determine the channel. Be cautious editing
+          body: |
+            !! Release as ${{ needs.validate-channel.outputs.channel }} !!
+
+            Change log:
+            ${{ steps.changelog.outputs.clean_changelog }}

.github/workflows/just-nut.yml

@@ -0,0 +1,79 @@
+name: just-nut
+on:
+  workflow_dispatch:
+    inputs:
+      channel-or-version:
+        description: Version or channel of the CLI to test against (nightly, latest-rc, 2.1.1)
+        type: string
+        required: true
+      repository:
+        description: 'The repo that will be cloned (format: owner/repo).  This contains the NUTs you want to run.  Ex: salesforcecli/plugin-user'
+        type: string
+        required: true
+      command:
+        required: false
+        type: string
+        default: yarn test:nuts
+        description: 'command to execute (ex: yarn test:nuts)'
+      os:
+        required: false
+        description: 'runs-on property, ex: ubuntu-latest, windows-latest'
+        type: string
+        default: 'ubuntu-latest'
+  workflow_call:
+    inputs:
+      channel-or-version:
+        description: Version or channel of the CLI to test against (nightly, latest-rc, 2.1.1)
+        type: string
+        required: true
+      repository:
+        description: 'The repo that will be cloned (format: owner/repo).  This contains the NUTs you want to run.  Ex: salesforcecli/plugin-user'
+        type: string
+        required: true
+      command:
+        required: false
+        type: string
+        default: yarn test:nuts
+        description: 'command to execute (ex: yarn test:nuts)'
+      os:
+        required: false
+        description: 'runs-on property, ex: ubuntu-latest, windows-latest'
+        type: string
+        default: 'ubuntu-latest'
+
+jobs:
+  just-nut:
+    name: ${{inputs.repository}}
+    runs-on: ${{inputs.os}}
+    env:
+      TESTKIT_EXECUTABLE_PATH: sf
+      TESTKIT_AUTH_URL: ${{ secrets.TESTKIT_AUTH_URL}}
+      TESTKIT_HUB_USERNAME: ${{ secrets.TESTKIT_HUB_USERNAME}}
+      TESTKIT_JWT_CLIENT_ID: ${{ secrets.TESTKIT_JWT_CLIENT_ID}}
+      TESTKIT_JWT_KEY: ${{ secrets.TESTKIT_JWT_KEY}}
+      TESTKIT_HUB_INSTANCE: ${{ secrets.TESTKIT_HUB_INSTANCE}}
+      ONEGP_TESTKIT_AUTH_URL: ${{ secrets.ONEGP_TESTKIT_AUTH_URL }}
+      TESTKIT_SETUP_RETRIES: 2
+
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          repository: ${{inputs.repository}}
+          token: ${{ secrets.SVC_CLI_BOT_GITHUB_TOKEN }}
+          path: .
+      - uses: actions/setup-node@v3
+        with:
+          node-version: lts/*
+          cache: yarn
+      # TODO: Remove sfdx-cli install after parity
+      # many setup commands require sfdx executable
+      - run: npm install -g @salesforce/cli@${{ inputs.channel-or-version }} sfdx-cli --omit=dev
+      - run: yarn install
+      - name: Run NUT (with retries)
+        uses: nick-fields/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd
+        with:
+          max_attempts: 3
+          retry_wait_seconds: 1
+          command: ${{ inputs.command }}
+          retry_on: error
+          timeout_minutes: 60