Repository navigation
ci(performance): restore the 1.10 cold limit of the fresh ratio (#1287) #1226
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Please | |
| on: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| permissions: | |
| actions: write | |
| contents: write | |
| pull-requests: write | |
| statuses: write | |
| concurrency: | |
| group: release-please | |
| cancel-in-progress: false | |
| jobs: | |
| release-please: | |
| runs-on: ubuntu-24.04 | |
| outputs: | |
| prs_created: ${{ steps.release.outputs.prs_created }} | |
| release_branch: ${{ steps.release_branch.outputs.name }} | |
| release_pr: ${{ steps.release_branch.outputs.pr }} | |
| steps: | |
| - name: Create delivery token | |
| id: delivery-token | |
| uses: actions/create-github-app-token@v2 | |
| with: | |
| app-id: ${{ vars.CHIO_DELIVERY_APP_ID }} | |
| private-key: ${{ secrets.CHIO_DELIVERY_PRIVATE_KEY }} | |
| owner: ${{ github.repository_owner }} | |
| repositories: ${{ github.event.repository.name }} | |
| permission-actions: write | |
| permission-contents: write | |
| permission-issues: write | |
| permission-pull-requests: write | |
| - uses: googleapis/release-please-action@v4 | |
| id: release | |
| with: | |
| token: ${{ steps.delivery-token.outputs.token }} | |
| config-file: release-please-config.json | |
| manifest-file: .release-please-manifest.json | |
| - name: Publish created release | |
| if: steps.release.outputs.release_created == 'true' | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASE_TAG: ${{ steps.release.outputs.tag_name }} | |
| run: | | |
| gh workflow run publish.yml --repo "${GITHUB_REPOSITORY}" --ref main \ | |
| -f "tag=${RELEASE_TAG}" | |
| - name: Resolve release branch | |
| id: release_branch | |
| if: steps.release.outputs.prs_created == 'true' | |
| env: | |
| RELEASE_PRS: ${{ steps.release.outputs.prs }} | |
| run: | | |
| release_branch="$(jq -r '.[0].headBranchName // empty' <<< "${RELEASE_PRS}")" | |
| release_pr="$(jq -r '.[0].number // empty' <<< "${RELEASE_PRS}")" | |
| if [[ -z "${release_branch}" || -z "${release_pr}" ]]; then | |
| echo "Release Please reported a created PR without a head branch or number" >&2 | |
| exit 1 | |
| fi | |
| echo "name=${release_branch}" >> "${GITHUB_OUTPUT}" | |
| echo "pr=${release_pr}" >> "${GITHUB_OUTPUT}" | |
| - uses: actions/checkout@v4 | |
| if: steps.release.outputs.prs_created == 'true' | |
| with: | |
| ref: ${{ steps.release_branch.outputs.name }} | |
| token: ${{ steps.delivery-token.outputs.token }} | |
| - uses: astral-sh/setup-uv@v5 | |
| if: steps.release.outputs.prs_created == 'true' | |
| with: | |
| version: "0.12.3" | |
| - uses: dtolnay/rust-toolchain@master | |
| if: steps.release.outputs.prs_created == 'true' | |
| with: | |
| toolchain: stable | |
| - name: Install Python | |
| if: steps.release.outputs.prs_created == 'true' | |
| run: uv python install 3.12 | |
| - name: Refresh release lockfiles | |
| if: steps.release.outputs.prs_created == 'true' | |
| env: | |
| RELEASE_BRANCH: ${{ steps.release_branch.outputs.name }} | |
| # Release Please only bumps workspace versions, so updating the workspace entries of | |
| # Cargo.lock is enough and needs no compile; metadata --locked proves the lock is complete. | |
| run: | | |
| cargo update --workspace | |
| cargo metadata --locked --format-version 1 > /dev/null | |
| uv lock --python 3.12 | |
| uv sync --locked --all-groups --all-extras --python 3.12 | |
| if git diff --quiet -- Cargo.lock uv.lock; then | |
| exit 0 | |
| fi | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add Cargo.lock uv.lock | |
| git commit -m "chore: refresh release lockfiles" | |
| git push origin "HEAD:${RELEASE_BRANCH}" | |
| # A separate job so that "Re-run failed jobs" re-dispatches and re-evaluates every trusted check | |
| # and repaints their statuses and Verify on the current head of the release branch. | |
| release-checks: | |
| name: Release pull request checks | |
| needs: release-please | |
| if: needs.release-please.outputs.prs_created == 'true' | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ needs.release-please.outputs.release_branch }} | |
| - name: Run release pull request checks | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASE_BRANCH: ${{ needs.release-please.outputs.release_branch }} | |
| RELEASE_PR: ${{ needs.release-please.outputs.release_pr }} | |
| REQUEST_ID: ${{ github.run_id }}-${{ github.run_attempt }} | |
| run: | | |
| head_sha="$(git rev-parse HEAD)" | |
| recovery="rerun the failed Release Please job to re-check" | |
| post_status() { | |
| gh api --method POST "repos/${GITHUB_REPOSITORY}/statuses/${head_sha}" \ | |
| -f "state=$1" -f "context=$2" -f "description=$3" ${4:+-f "target_url=$4"} >/dev/null | |
| } | |
| fail_verify() { | |
| post_status failure Verify "$1; ${recovery}" "${2:-}" | |
| { | |
| echo "### Release pull request checks failed" | |
| echo | |
| echo "$1. After fixing or confirming a transient cause, use **Re-run failed jobs**" | |
| echo "on this workflow run: it re-dispatches every trusted check and repaints Verify." | |
| } >> "${GITHUB_STEP_SUMMARY}" | |
| exit 1 | |
| } | |
| # Verify is the required status. On Release Please branches this commit status is its | |
| # only source, because the Verify workflow reports its job under another name there, so | |
| # the pull request merges only after every trusted check passes on this head, which | |
| # already includes any lockfile refresh. The checks include building the distributions | |
| # that Publish reuses once the release is tagged. Verify's test suites skip release pull | |
| # requests, whose product code already passed them on main; release performance runs on | |
| # main after each merge and does not gate. Each dispatched run carries this attempt's | |
| # request id in its run name and is matched on it exactly. | |
| if ! python3 -m scripts.check_native_layering; then | |
| fail_verify "Release versions or Cargo.lock workspace versions disagree" | |
| fi | |
| workflows=(pull-request-metadata.yml version-guard.yml release-distributions.yml) | |
| contexts=("Pull Request Metadata" "Block automatic 1.0 releases" "Release distributions") | |
| for context in "${contexts[@]}"; do | |
| post_status pending "${context}" "Trusted release check is running" | |
| done | |
| post_status pending Verify "Validating trusted release metadata and distributions" | |
| dispatched_after="$(date -u -d '-2 minutes' +%Y-%m-%dT%H:%M:%SZ)" | |
| gh workflow run pull-request-metadata.yml --ref "${RELEASE_BRANCH}" \ | |
| -f "pr_number=${RELEASE_PR}" -f "request_id=${REQUEST_ID}" | |
| gh workflow run version-guard.yml --ref "${RELEASE_BRANCH}" \ | |
| -f "request_id=${REQUEST_ID}" | |
| gh workflow run release-distributions.yml --ref "${RELEASE_BRANCH}" \ | |
| -f "request_id=${REQUEST_ID}" | |
| for index in "${!workflows[@]}"; do | |
| workflow="${workflows[${index}]}" | |
| context="${contexts[${index}]}" | |
| run_id="" | |
| for _ in {1..30}; do | |
| run_id="$(gh run list --workflow "${workflow}" --branch "${RELEASE_BRANCH}" \ | |
| --event workflow_dispatch --limit 50 \ | |
| --json databaseId,headSha,displayTitle,createdAt \ | |
| --jq ".[] | select(.headSha == \"${head_sha}\" | |
| and (.displayTitle | endswith(\" [${REQUEST_ID}]\")) | |
| and .createdAt >= \"${dispatched_after}\") | .databaseId" | head -n 1)" | |
| [[ -n "${run_id}" ]] && break | |
| sleep 2 | |
| done | |
| if [[ -z "${run_id}" ]]; then | |
| post_status failure "${context}" "Trusted release check did not start" | |
| fail_verify "${context} did not start" | |
| fi | |
| run_url="$(gh run view "${run_id}" --json url --jq .url)" | |
| if gh run watch "${run_id}" --exit-status --interval 30; then | |
| post_status success "${context}" "Trusted release check passed" "${run_url}" | |
| else | |
| post_status failure "${context}" "Trusted release check failed" "${run_url}" | |
| fail_verify "${context} failed" "${run_url}" | |
| fi | |
| done | |
| # Keep this allowlist in sync with the release metadata check in verify.yml. | |
| unexpected_files="$(gh pr view "${RELEASE_PR}" --repo "${GITHUB_REPOSITORY}" \ | |
| --json files --jq '[.files[].path | select(. != ".release-please-manifest.json" and . != "CHANGELOG.md" and . != "pyproject.toml" and . != "uv.lock" and . != "Cargo.lock" and . != "Cargo.toml")] | join("\n")')" | |
| if [[ -n "${unexpected_files}" ]]; then | |
| echo "Release pull request contains non-metadata changes:" >&2 | |
| echo "${unexpected_files}" >&2 | |
| post_status failure Verify "Release pull request contains non-metadata changes" | |
| exit 1 | |
| fi | |
| post_status success Verify \ | |
| "Product changes passed verification before release metadata update" | |
| # The checks can wait longer than an installation token lives, so mint one just before use. | |
| - name: Create delivery token | |
| id: delivery-token | |
| uses: actions/create-github-app-token@v2 | |
| with: | |
| app-id: ${{ vars.CHIO_DELIVERY_APP_ID }} | |
| private-key: ${{ secrets.CHIO_DELIVERY_PRIVATE_KEY }} | |
| owner: ${{ github.repository_owner }} | |
| repositories: ${{ github.event.repository.name }} | |
| permission-actions: write | |
| permission-contents: write | |
| permission-issues: write | |
| permission-pull-requests: write | |
| - name: Enable release pull request auto-merge | |
| env: | |
| # The delivery app merges, so the resulting push to main starts the tag and publish runs. | |
| GH_TOKEN: ${{ steps.delivery-token.outputs.token }} | |
| RELEASE_PR: ${{ needs.release-please.outputs.release_pr }} | |
| PROCESSED_SHA: ${{ github.sha }} | |
| run: | | |
| # A commit merged to main while these checks ran is not in this release pull request yet. | |
| # Its own Release Please run is queued behind this one and refreshes and re-checks the | |
| # pull request, so merging now would tag a release whose changelog omits that commit. | |
| main_sha="$(gh api "repos/${GITHUB_REPOSITORY}/commits/main" --jq .sha)" | |
| if [[ "${main_sha}" != "${PROCESSED_SHA}" ]]; then | |
| gh pr merge "${RELEASE_PR}" --repo "${GITHUB_REPOSITORY}" --disable-auto 2>/dev/null || true | |
| echo "main moved from ${PROCESSED_SHA} to ${main_sha}; leaving the merge to the queued run" \ | |
| >> "${GITHUB_STEP_SUMMARY}" | |
| exit 0 | |
| fi | |
| gh pr merge "${RELEASE_PR}" --repo "${GITHUB_REPOSITORY}" --auto --squash |