Repository navigation
Publish Release #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish Release | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: 'Version tag for the release (e.g., 2026-02-16)' | |
| required: true | |
| type: string | |
| permissions: | |
| contents: write | |
| id-token: write | |
| attestations: write | |
| jobs: | |
| verify-deployment: | |
| name: Verify Deployment | |
| if: github.ref == 'refs/heads/main' | |
| uses: ./.github/workflows/verify-deployment.yml | |
| secrets: inherit | |
| with: | |
| ref: ${{ github.sha }} | |
| publish: | |
| name: Publish | |
| needs: verify-deployment | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Determine version | |
| id: version | |
| run: | | |
| echo "version=${{ inputs.version }}" >> $GITHUB_OUTPUT | |
| echo "Release version: ${{ inputs.version }}" | |
| - name: Create GitHub Release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| VERSION="${{ steps.version.outputs.version }}" | |
| gh release create "$VERSION" \ | |
| --title "$VERSION" \ | |
| --generate-notes | |
| - name: Download release artifacts for attestation | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| VERSION="${{ steps.version.outputs.version }}" | |
| mkdir -p release-artifacts | |
| gh release download "$VERSION" --archive=tar.gz --dir release-artifacts | |
| gh release download "$VERSION" --archive=zip --dir release-artifacts | |
| ls -la release-artifacts/ | |
| - name: Generate provenance attestation | |
| id: attestation | |
| uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 | |
| with: | |
| subject-path: release-artifacts/* | |
| - name: Upload attestation to release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| VERSION="${{ steps.version.outputs.version }}" | |
| gh release upload "$VERSION" "${{ steps.attestation.outputs.bundle-path }}" --clobber |