cli/.github/workflows/release-beta.yml at eae61bfad77f3cf8329cef9b3557fc58edab9cb9 · supabase/cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
name: Release (Beta)

on:
  pull_request_review:
    types:
      - submitted
  push:
    branches:
      - develop
  workflow_dispatch:

permissions:
  contents: read

jobs:
  approved:
    name: fast-forward
    if: |
      github.event.pull_request.head.ref == 'develop' &&
      github.event.pull_request.base.ref == 'main' &&
      github.event.review.state == 'approved'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
    outputs:
      release_tag: ${{ steps.latest-release.outputs.tagName }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - run: |
          git checkout main
          git merge --ff-only "${{ github.event.pull_request.head.sha }}"
          git push origin main
      - id: latest-release
        run: |
          latest=$(gh release list --limit 1 --json tagName --jq '.[].tagName')
          gh release edit $latest --latest --prerelease=false
          echo "tagName=$latest" >> $GITHUB_OUTPUT
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  tag:
    name: Move latest tag
    needs:
      - approved
    runs-on: ubuntu-latest
    permissions:
      contents: read
      # Required for npm OIDC
      id-token: write
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: latest
          registry-url: https://registry.npmjs.org
      - run: npm dist-tag add "supabase@${RELEASE_TAG#v}" latest
        env:
          RELEASE_TAG: ${{ needs.approved.outputs.release_tag }}

  deploy:
    needs:
      - approved
      - tag
    # Call workflow explicitly because events from actions cannot trigger more actions
    uses: ./.github/workflows/release.yml
    with:
      release: ${{ needs.approved.outputs.release_tag }}
    secrets: inherit

  release:
    name: semantic-release
    if: ${{ github.event_name != 'pull_request_review' }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      new-release-published: ${{ steps.semantic-release.outputs.new_release_published }}
      new-release-version: ${{ steps.semantic-release.outputs.new_release_version }}
      new-release-channel: ${{ steps.semantic-release.outputs.new_release_channel }}
    steps:
      - uses: actions/checkout@v6
      - id: semantic-release
        uses: cycjimmy/semantic-release-action@v6
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  goreleaser:
    name: GoReleaser
    needs:
      - release
    if: needs.release.outputs.new-release-published == 'true'
    permissions:
      contents: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true

      - uses: goreleaser/goreleaser-action@v6
        with:
          distribution: goreleaser
          version: ~> v2
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}

      - run: gh release edit v${{ needs.release.outputs.new-release-version }} --draft=false --prerelease
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  commit:
    name: Publish Brew and Scoop
    needs:
      - release
      - goreleaser
    if: needs.release.outputs.new-release-published == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true
      # use GitHub app to create a release token that can publish to homebrew-tap and scoop
      - name: Generate token
        id: app-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: |
            homebrew-tap
            scoop-bucket
      - run: go run tools/publish/main.go --beta "${{ needs.release.outputs.new-release-version }}"
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

  publish:
    name: Publish NPM
    needs:
      - release
      - goreleaser
    if: needs.release.outputs.new-release-published == 'true'
    permissions:
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: latest
          registry-url: https://registry.npmjs.org
      - run: npm --git-tag-version=false version ${{ needs.release.outputs.new-release-version }}
      - run: npm publish --tag ${{ needs.release.outputs.new-release-channel }}