From bfaaaa26d6f5876530b2dd72c3365e2399019aab Mon Sep 17 00:00:00 2001 From: Burak Yigit Kaya Date: Mon, 12 Jan 2026 13:41:07 +0000 Subject: [PATCH] ci(release): Switch from action-prepare-release to Craft (#298) * ci(release): Switch from action-prepare-release to Craft This PR migrates from the deprecated action-prepare-release to the new Craft GitHub Actions (reusable workflow or composite action). Changes: - Migrate .github/workflows/release.yml to Craft reusable workflow * ci(release): Restore GitHub App token authentication The previous migration incorrectly removed the GitHub App token authentication step. This commit restores it by switching to the composite action pattern which preserves the auth flow. * fix: Pin actions to SHA and add permissions blocks * fix: Use correct action version SHAs (restore original versions) * fix: Use correct action version SHAs (restore original versions) * fix: Clean up action version comments * Update docker tag --------- Co-authored-by: Andrei Borza --- .github/workflows/build.yml | 24 +++++----- .github/workflows/changelog-preview.yml | 17 +++++++ .github/workflows/create-release-tags.yml | 2 +- .github/workflows/release.yml | 55 +++++++++++------------ .github/workflows/verify-dist.yml | 2 +- action.yml | 2 +- 6 files changed, 58 insertions(+), 44 deletions(-) create mode 100644 .github/workflows/changelog-preview.yml diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index a076d92..dfdb56e 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -30,7 +30,7 @@ jobs: docker_tag: ${{ steps.docker_tag.outputs.docker_tag }} steps: - name: Checkout repo - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Get docker tag id: docker_tag @@ -53,7 +53,7 @@ jobs: - name: Get auth token id: token - uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0 + uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.11.0 if: github.ref == 'refs/heads/master' with: app_id: ${{ vars.SENTRY_INTERNAL_APP_ID }} @@ -81,7 +81,7 @@ jobs: image: action-release-image steps: - name: Checkout repo - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 with: fetch-depth: 0 @@ -119,7 +119,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Install run: yarn install @@ -147,7 +147,7 @@ jobs: contents: read name: Test current action steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 with: fetch-depth: 0 @@ -168,7 +168,7 @@ jobs: image: node:20.19.2 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 with: fetch-depth: 0 @@ -190,7 +190,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 with: fetch-depth: 0 @@ -212,13 +212,13 @@ jobs: contents: read steps: - name: Checkout directory we'll be running from - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 with: fetch-depth: 0 path: main/ - name: Checkout directory we'll be testing - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 with: fetch-depth: 0 path: test/ @@ -242,12 +242,12 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 with: fetch-depth: 0 - name: Setup Node - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: ${{ matrix.node-version }} @@ -290,7 +290,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 with: fetch-depth: 0 diff --git a/.github/workflows/changelog-preview.yml b/.github/workflows/changelog-preview.yml new file mode 100644 index 0000000..5883c00 --- /dev/null +++ b/.github/workflows/changelog-preview.yml @@ -0,0 +1,17 @@ +name: Changelog Preview +on: + pull_request: + types: + - opened + - synchronize + - reopened + - edited + - labeled +permissions: + contents: write + pull-requests: write + +jobs: + changelog-preview: + uses: getsentry/craft/.github/workflows/changelog-preview.yml@v2 + secrets: inherit diff --git a/.github/workflows/create-release-tags.yml b/.github/workflows/create-release-tags.yml index 8692e88..b9985ac 100644 --- a/.github/workflows/create-release-tags.yml +++ b/.github/workflows/create-release-tags.yml @@ -16,7 +16,7 @@ runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 with: ref: ${{ github.event.release.tag_name }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3900d18..d0b7655 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,43 +1,40 @@ name: 'Action: Prepare Release' - on: workflow_dispatch: inputs: version: - description: Version to release - required: true + description: Version to release (or "auto") + required: false force: - description: Force a release even when there are release-blockers (optional) + description: Force a release even when there are release-blockers required: false merge_target: - description: Target branch to merge into. Uses the default branch as a fallback (optional) + description: Target branch to merge into required: false - default: master +permissions: + contents: write + pull-requests: write jobs: release: - name: Release a new version - runs-on: ubuntu-latest - + name: Release a new version steps: - - name: Get auth token - id: token - uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0 - with: - app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }} - private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }} - - - uses: actions/checkout@v4 - with: - token: ${{ steps.token.outputs.token }} - fetch-depth: 0 - - - name: Prepare release - uses: getsentry/action-prepare-release@v1 - env: - GITHUB_TOKEN: ${{ steps.token.outputs.token }} - with: - version: ${{ github.event.inputs.version }} - force: ${{ github.event.inputs.force }} - merge_target: ${{ github.event.inputs.merge_target }} + - name: Get auth token + id: token + uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2 + with: + app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }} + private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }} + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 + with: + token: ${{ steps.token.outputs.token }} + fetch-depth: 0 + - name: Prepare release + uses: getsentry/craft@39ee616a6a58dc64797feecb145d66770492b66c # v2 + env: + GITHUB_TOKEN: ${{ steps.token.outputs.token }} + with: + version: ${{ inputs.version }} + force: ${{ inputs.force }} + merge_target: ${{ inputs.merge_target }} diff --git a/.github/workflows/verify-dist.yml b/.github/workflows/verify-dist.yml index 0d87b5d..7b30e78 100644 --- a/.github/workflows/verify-dist.yml +++ b/.github/workflows/verify-dist.yml @@ -22,7 +22,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 with: fetch-depth: 0 diff --git a/action.yml b/action.yml index e52dfe6..24ecacb 100644 --- a/action.yml +++ b/action.yml @@ -167,7 +167,7 @@ runs: INPUT_WORKING_DIRECTORY: ${{ inputs.working_directory }} INPUT_DISABLE_TELEMETRY: ${{ inputs.disable_telemetry }} INPUT_DISABLE_SAFE_DIRECTORY: ${{ inputs.disable_safe_directory }} - uses: docker://ghcr.io/getsentry/action-release-image:master + uses: docker://ghcr.io/getsentry/action-release-image:ci-migrate-to-craft-action # For actions running on macos or windows runners, we use a composite # action approach which allows us to install the arch specific sentry-cli