From a436ff59e7e8f7ec5c948e0a05461165b9b5c5a0 Mon Sep 17 00:00:00 2001 From: Tim Smith Date: Sat, 22 Aug 2026 14:00:28 -0700 Subject: [PATCH] ci: add release-please automation and cut 1.0.0 Releases were entirely manual, and 1.0.0 -- which makes the driver work with modern Test Kitchen again -- is sitting unreleased on main while RubyGems still serves the broken 0.24.0. This adopts the same release-please setup the other test-kitchen drivers use, so merges to main open a release PR and merging that one tags the release and publishes the gem to RubyGems and GitHub Packages. The required PORTER_GITHUB_TOKEN, OWNER and RUBYGEMS_API_KEY secrets are already available to this repository at the organisation level. Taken from Corey Hemminger's earlier work in #36, with the action versions brought up to what kitchen-ec2 currently runs (release-please-action v5 and checkout v7 rather than v4). Two changes from the version kitchen-ec2 runs, both to avoid handing publishing credentials to code that can change underneath us: - Actions are pinned to commit SHAs rather than tags or branches. The two actionshub publish actions were referenced as @main, so whoever can push to those branches could change what runs with RUBYGEMS_API_KEY at any time. The version each SHA corresponds to is kept in a trailing comment, which is what Renovate reads to update them. - The workflow declares explicit permissions. This repository defaults workflow tokens to write, so without a permissions block the publish steps would run with a broadly scoped GITHUB_TOKEN. The manifest starts at 0.24.0, the last version actually published, and the Release-As footer below tells release-please to cut the next release as 1.0.0 to match the version already committed in cloudstack_version.rb and CHANGELOG.md. Release-As: 1.0.0 Co-authored-by: Corey Hemminger Co-Authored-By: Claude Opus 5 (1M context) --- .github/CODEOWNERS | 1 + .github/workflows/publish.yml | 46 +++++++++++++++++++++++++++++++++++ .release-please-manifest.json | 3 +++ release-please-config.json | 12 +++++++++ 4 files changed, 62 insertions(+) create mode 100644 .github/CODEOWNERS create mode 100644 .github/workflows/publish.yml create mode 100644 .release-please-manifest.json create mode 100644 release-please-config.json diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..b7175b0 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1 @@ +@test-kitchen/maintainers diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml new file mode 100644 index 0000000..622471f --- /dev/null +++ b/.github/workflows/publish.yml @@ -0,0 +1,46 @@ +--- +name: release-please + +"on": + push: + branches: [main] + +# Least privilege. release-please itself authenticates with +# PORTER_GITHUB_TOKEN; these permissions cover the GITHUB_TOKEN handed to +# the GitHub Packages publish step. +permissions: + contents: read + packages: write + +jobs: + release-please: + runs-on: ubuntu-latest + permissions: + contents: write + pull-requests: write + packages: write + steps: + # Actions are pinned to commit SHAs rather than tags or branches so a + # moved tag cannot change what runs with the publishing credentials. + # Renovate keeps the pins current. + - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5 + id: release + with: + token: ${{ secrets.PORTER_GITHUB_TOKEN }} + + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + if: ${{ steps.release.outputs.release_created }} + + - name: Build and publish to GitHub Package + uses: actionshub/publish-gem-to-github@86eb0ce1ced1072298bf68776a32a5c9703ad9aa # main + if: ${{ steps.release.outputs.release_created }} + with: + token: ${{ secrets.GITHUB_TOKEN }} + owner: ${{ secrets.OWNER }} + + - name: Build and publish to RubyGems + uses: actionshub/publish-gem-to-rubygems@f9126f7a2d36a4fd31a13e78fde5fbdcc4b7b251 # main + if: ${{ steps.release.outputs.release_created }} + with: + token: ${{ secrets.RUBYGEMS_API_KEY }} diff --git a/.release-please-manifest.json b/.release-please-manifest.json new file mode 100644 index 0000000..fc5553b --- /dev/null +++ b/.release-please-manifest.json @@ -0,0 +1,3 @@ +{ + ".": "0.24.0" +} diff --git a/release-please-config.json b/release-please-config.json new file mode 100644 index 0000000..5ec2750 --- /dev/null +++ b/release-please-config.json @@ -0,0 +1,12 @@ +{ + "packages": { + ".": { + "package-name": "kitchen-cloudstack", + "changelog-path": "CHANGELOG.md", + "release-type": "ruby", + "include-component-in-tag": false, + "version-file": "lib/kitchen/driver/cloudstack_version.rb" + } + }, + "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json" +}