From f7f72dfac589ef4fbb61c48fa71bf9b4a65694df Mon Sep 17 00:00:00 2001 From: functionzz Date: Wed, 12 Aug 2026 00:37:38 -0400 Subject: [PATCH 1/5] add automated releases --- .github/release.yml | 5 +++ .github/workflows/release_actions.yml | 65 +++++++++++++++++++++++++++ .github/workflows/sbom.yml | 2 - 3 files changed, 70 insertions(+), 2 deletions(-) create mode 100644 .github/release.yml create mode 100644 .github/workflows/release_actions.yml diff --git a/.github/release.yml b/.github/release.yml new file mode 100644 index 0000000000..4ce2a27cfd --- /dev/null +++ b/.github/release.yml @@ -0,0 +1,5 @@ +changelog: + categories: + - title: Features + labels: + - '*' diff --git a/.github/workflows/release_actions.yml b/.github/workflows/release_actions.yml new file mode 100644 index 0000000000..f1919e0ff7 --- /dev/null +++ b/.github/workflows/release_actions.yml @@ -0,0 +1,65 @@ +name: Automated Release +on: + schedule: + - cron: "0 23 * * *" +permissions: {} + +jobs: + release: + name: New release + runs-on: ubuntu-latest + permissions: + contents: write + pull-requests: read + steps: + - name: Clone repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + fetch-depth: 0 + - name: Fetch deployed revision + id: revision + run: | + SHA=$(curl -fsS --max-time 10 \ + https://pontoon.mozilla.org/static/revision.txt | tr -d '[:space:]') + + if ! printf '%s' "$SHA" | grep -qE '^[0-9a-f]{40}$'; then + echo "::error::Expected a 40-character commit hash, got: ${SHA:-}" + exit 1 + fi + + echo "Deployed revision: $SHA" + echo "sha=$SHA" >> "$GITHUB_OUTPUT" + - name: Check for an existing release tag + id: check + env: + SHA: ${{ steps.revision.outputs.sha }} + run: | + if ! git cat-file -e "${SHA}^{commit}" 2>/dev/null; then + echo "::error::Commit $SHA is not in this repository." + exit 1 + fi + + COMMIT_EXISTS=$(git tag --points-at "$SHA" | grep '^v202' || true) + + if [ -n "$COMMIT_EXISTS" ]; then + echo "Already released as ${COMMIT_EXISTS}." + exit 1 + fi + + VERSION="v$(date -u +%Y.%m.%d)" + + if [ -n "$(git tag -l "$VERSION")" ]; then + echo "::error::Tag $VERSION already exists. Delete it or this deploy must wait for tomorrow's date." + exit 1 + fi + + echo "version=$VERSION" >> "$GITHUB_OUTPUT" + - name: Create GitHub Release + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 + with: + tag_name: "${{ steps.check.outputs.version }}" + target_commitish: "${{ steps.revision.outputs.sha }}" + name: "Release ${{ steps.check.outputs.version }}" + generate_release_notes: true + token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml index aefd41a4f0..3d27e4123e 100644 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -1,8 +1,6 @@ name: SSDLC SBOM on: - push: - branches: [main] release: types: [published] From c346972021d344ddc44c0e6325e96638642f053b Mon Sep 17 00:00:00 2001 From: functionzz Date: Wed, 12 Aug 2026 11:47:01 -0400 Subject: [PATCH 2/5] update checkout sha, rename TAG_EXISTS, remove cta, restore exit 0 and conditional --- .github/workflows/release_actions.yml | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/.github/workflows/release_actions.yml b/.github/workflows/release_actions.yml index f1919e0ff7..f436a47b53 100644 --- a/.github/workflows/release_actions.yml +++ b/.github/workflows/release_actions.yml @@ -13,7 +13,7 @@ jobs: pull-requests: read steps: - name: Clone repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false fetch-depth: 0 @@ -40,22 +40,25 @@ jobs: exit 1 fi - COMMIT_EXISTS=$(git tag --points-at "$SHA" | grep '^v202' || true) + TAG_EXISTS=$(git tag --points-at "$SHA" | grep '^v202' || true) - if [ -n "$COMMIT_EXISTS" ]; then - echo "Already released as ${COMMIT_EXISTS}." - exit 1 + if [ -n "$TAG_EXISTS" ]; then + echo "Already released as ${TAG_EXISTS}." + echo "release=false" >> "$GITHUB_OUTPUT" + exit 0 fi VERSION="v$(date -u +%Y.%m.%d)" if [ -n "$(git tag -l "$VERSION")" ]; then - echo "::error::Tag $VERSION already exists. Delete it or this deploy must wait for tomorrow's date." + echo "::error::Tag $VERSION already exists." exit 1 fi echo "version=$VERSION" >> "$GITHUB_OUTPUT" + echo "release=true" >> "$GITHUB_OUTPUT" - name: Create GitHub Release + if: steps.check.outputs.release == 'true' uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: tag_name: "${{ steps.check.outputs.version }}" From 40a8445541956ddb97c25512394189ddf616400e Mon Sep 17 00:00:00 2001 From: functionzz Date: Wed, 12 Aug 2026 12:18:12 -0400 Subject: [PATCH 3/5] add pat implementation --- .github/workflows/release_actions.yml | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/.github/workflows/release_actions.yml b/.github/workflows/release_actions.yml index f436a47b53..9e9a7a18e6 100644 --- a/.github/workflows/release_actions.yml +++ b/.github/workflows/release_actions.yml @@ -9,8 +9,7 @@ jobs: name: New release runs-on: ubuntu-latest permissions: - contents: write - pull-requests: read + contents: read steps: - name: Clone repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -59,10 +58,12 @@ jobs: echo "release=true" >> "$GITHUB_OUTPUT" - name: Create GitHub Release if: steps.check.outputs.release == 'true' - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 - with: - tag_name: "${{ steps.check.outputs.version }}" - target_commitish: "${{ steps.revision.outputs.sha }}" - name: "Release ${{ steps.check.outputs.version }}" - generate_release_notes: true - token: ${{ secrets.GITHUB_TOKEN }} + env: + GH_TOKEN: ${{ secrets.RELEASE_PAT }} + VERSION: ${{ steps.check.outputs.version }} + SHA: ${{ steps.revision.outputs.sha }} + run: | + gh release create "$VERSION" \ + --target "$SHA" \ + --title "Release $VERSION" \ + --generate-notes From c3568ab958e7e09c3d8a1c8c9d40e01922f2649f Mon Sep 17 00:00:00 2001 From: functionzz Date: Fri, 21 Aug 2026 02:50:44 -0400 Subject: [PATCH 4/5] reinstate GH_TOKEN, sidestep sbom, change release.yml --- .github/release.yml | 5 ++++- .github/workflows/release_actions.yml | 5 +++-- .github/workflows/sbom.yml | 2 ++ 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/release.yml b/.github/release.yml index 4ce2a27cfd..5912e4610b 100644 --- a/.github/release.yml +++ b/.github/release.yml @@ -1,5 +1,8 @@ changelog: categories: - - title: Features + - title: Dependencies + labels: + - dependencies + - title: Changes labels: - '*' diff --git a/.github/workflows/release_actions.yml b/.github/workflows/release_actions.yml index 9e9a7a18e6..7ba5f56bdc 100644 --- a/.github/workflows/release_actions.yml +++ b/.github/workflows/release_actions.yml @@ -9,7 +9,8 @@ jobs: name: New release runs-on: ubuntu-latest permissions: - contents: read + contents: write + pull-requests: read steps: - name: Clone repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -59,7 +60,7 @@ jobs: - name: Create GitHub Release if: steps.check.outputs.release == 'true' env: - GH_TOKEN: ${{ secrets.RELEASE_PAT }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} VERSION: ${{ steps.check.outputs.version }} SHA: ${{ steps.revision.outputs.sha }} run: | diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml index 3d27e4123e..aefd41a4f0 100644 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -1,6 +1,8 @@ name: SSDLC SBOM on: + push: + branches: [main] release: types: [published] From 4014de6f6e393dbe79e3e80782e580d20fba7528 Mon Sep 17 00:00:00 2001 From: Jamie <164675620+functionzz@users.noreply.github.com> Date: Fri, 21 Aug 2026 02:51:23 -0400 Subject: [PATCH 5/5] Update .github/workflows/release_actions.yml Co-authored-by: Eemeli Aro --- .github/workflows/release_actions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release_actions.yml b/.github/workflows/release_actions.yml index 7ba5f56bdc..9fdd42d929 100644 --- a/.github/workflows/release_actions.yml +++ b/.github/workflows/release_actions.yml @@ -48,7 +48,7 @@ jobs: exit 0 fi - VERSION="v$(date -u +%Y.%m.%d)" + VERSION="$(date -u +v%Y.%m.%d)" if [ -n "$(git tag -l "$VERSION")" ]; then echo "::error::Tag $VERSION already exists."