mirror of
https://github.com/bherbruck/solidcraft.git
synced 2026-11-04 02:55:54 +00:00
jyviko
d84d00bb44
The gate passes no secrets to release.yml, so the macOS and Windows signing steps skip as they do on a fork (no signing secret, no SignPath quota), and the new packages_only input skips the release job (checksums, update signing, publishing). The call still grants contents: write, which GitHub checks for the skipped job before the run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
75 lines
2.7 KiB
YAML
75 lines
2.7 KiB
YAML
# The release gate: everything, in full and in parallel, on one branch's head, before that branch
|
|
# replaces main as a release (develop, rebased onto main). Run it by hand:
|
|
# gh workflow run release-gate.yml --ref develop
|
|
# It calls the workflows that own each check instead of copying their jobs:
|
|
# - ci.yml as Run workflow with cross-compilation: every native suite in full (not scoped), the
|
|
# reference tests, the doc tests, the GPU path tests, the action matrix (all 16 shards) and its
|
|
# determinism check, the property tests, the repository checks (web-offline among them),
|
|
# WebAssembly and RISC-V, Windows D3D12 FXC and Windows app startup;
|
|
# - kernel-rig.yml: every rig area against its KNOWN_FAILING and the ladder against its golden;
|
|
# - release.yml as a dry run (draft false, packages_only): the Linux, Flatpak, Snap, FreeBSD,
|
|
# macOS, Windows and web packages with their smoke tests and package checks, unsigned (no
|
|
# secrets are passed, so no signing secret or SignPath quota is used) and without the release
|
|
# job (checksums, update signing, publishing).
|
|
# The gate passes only when all three pass. Before main is replaced, tag the old main
|
|
# (main-before-develop-<date>) and push the tag.
|
|
name: Release gate
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: release-gate-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
ci:
|
|
name: CI
|
|
uses: ./.github/workflows/ci.yml
|
|
permissions:
|
|
contents: read
|
|
# Select checks reads this commit's other runs.
|
|
actions: read
|
|
with:
|
|
cross_compile: true
|
|
|
|
kernel-rig:
|
|
name: Kernel rig
|
|
uses: ./.github/workflows/kernel-rig.yml
|
|
permissions:
|
|
contents: read
|
|
|
|
packages:
|
|
name: Packages
|
|
uses: ./.github/workflows/release.yml
|
|
# No secrets: the signing steps skip without them. GitHub checks a called workflow's job
|
|
# permissions before the run, skipped jobs included, so the release job's contents: write must
|
|
# be granted here; packages_only skips that job, and no step that runs writes to the
|
|
# repository. actions: read is the Windows job's.
|
|
permissions:
|
|
contents: write
|
|
actions: read
|
|
with:
|
|
draft: false
|
|
packages_only: true
|
|
|
|
release-gate:
|
|
name: release-gate
|
|
needs: [ci, kernel-rig, packages]
|
|
if: always()
|
|
runs-on: blacksmith-2vcpu-ubuntu-2404
|
|
steps:
|
|
- name: Every part passed
|
|
env:
|
|
CI: ${{ needs.ci.result }}
|
|
KERNEL_RIG: ${{ needs.kernel-rig.result }}
|
|
PACKAGES: ${{ needs.packages.result }}
|
|
run: |
|
|
echo "ci=$CI kernel-rig=$KERNEL_RIG packages=$PACKAGES"
|
|
test "$CI" = success
|
|
test "$KERNEL_RIG" = success
|
|
test "$PACKAGES" = success
|