Skip to content

Commit 40a76ef

Browse files
james-toussaintjames-toussaint
committed
Split scripts and use trusted publisher
1 parent 259c56e commit 40a76ef

File tree

3 files changed

+59
-43
lines changed

3 files changed

+59
-43
lines changed

‎.github/workflows/release-upgradeable.yml‎

Lines changed: 19 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -6,65 +6,41 @@ on:
66
jobs:
77
release-upgradeable:
88
environment: push-upgradeable
9+
permissions:
10+
id-token: write # Required for OIDC
11+
contents: read
912
runs-on: ubuntu-latest
1013
env:
1114
VANILLA_REPO: OpenZeppelin/openzeppelin-contracts
1215
UPGRADEABLE_REPO: james-toussaint/openzeppelin-contracts-upgradeable # TODO: Update repo before merging
1316
steps:
17+
- run: echo "UPGRADEABLE_DIR=${GITHUB_WORKSPACE}/upgradeable" >> "$GITHUB_ENV"
1418
- uses: actions/checkout@v5
1519
with:
1620
repository: ${{ env.VANILLA_REPO }}
1721
ref: ${{ github.ref }}
18-
- name: Get vanilla commit
19-
run: |
20-
echo "VANILLA_COMMIT=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV"
22+
- id: vanilla
23+
name: Get vanilla commit
24+
run: echo "commit=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
25+
- uses: actions/checkout@v5 # TODO: Remove this before merging (used to get node 24.x from setup action)
26+
- name: Set up environment
27+
uses: ./.github/actions/setup
2128
- uses: actions/checkout@v5
2229
with:
2330
repository: ${{ env.UPGRADEABLE_REPO }}
2431
submodules: true
2532
token: ${{ secrets.GH_TOKEN_UPGRADEABLE }}
2633
ref: ${{ github.ref }}
27-
- name: Run
28-
run: |
29-
if ! git log -1 --pretty=%B | grep -q "Transpile ${VANILLA_COMMIT}"; then
30-
echo "Expected 'Transpile ${VANILLA_COMMIT}' but found '$(git log -1 --pretty=%B)'"
31-
exit 1
32-
fi
33-
VERSION="$(jq -r .version contracts/package.json)"
34-
GIT_TAG="v${VERSION}"
35-
NPM_TAG="tmp"
36-
ADDITIONAL_OPTION_IF_PRERELEASE="--prerelease"
37-
if [[ "${GIT_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
38-
NPM_TAG="dev"
39-
ADDITIONAL_OPTION_IF_PRERELEASE=""
40-
elif [[ "${GIT_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-rc.[0-9]+$ ]]; then
41-
NPM_TAG="next"
42-
fi
43-
echo "ADDITIONAL_OPTION_IF_PRERELEASE=${ADDITIONAL_OPTION_IF_PRERELEASE}" >> "$GITHUB_ENV"
44-
### [START BLOCK] TODO: Remove block before merging
45-
TIMESTAMPED_VERSION="${VERSION}-$(date +%s)"
46-
echo "OLD_GIT_TAG=${GIT_TAG}" >> "$GITHUB_ENV"
47-
GIT_TAG="${GIT_TAG}-$(date +%s)" # incremental git tag for testing
48-
sed -i'' -e 's/openzeppelin\/contracts-upgradeable/james-toussaint\/contracts-upgradeable/g' contracts/package.json # custom scope for testing
49-
sed -i'' -e "s/${VERSION}/${TIMESTAMPED_VERSION}/g" contracts/package.json && head contracts/package.json # incremental npm package version for testing
50-
### [END BLOCK]
51-
npm ci
52-
bash scripts/git-user-config.sh
53-
git tag -m {,}"${GIT_TAG}"
54-
CI=true git push origin tag "${GIT_TAG}"
55-
cd "contracts/"
56-
# Intentionally escape $ to avoid interpolation and writing the token to disk
57-
echo "//registry.npmjs.org/:_authToken=\${NPM_TOKEN}" > .npmrc
58-
npm publish --tag "${NPM_TAG}"
59-
echo "GIT_TAG=${GIT_TAG}" >> "$GITHUB_ENV"
34+
path: upgradeable
35+
- run: cd "${UPGRADEABLE_DIR}" && bash ${{ github.workspace }}/scripts/git-user-config.sh
36+
- id: publish
37+
name: Publish
38+
run: bash scripts/release/workflow/publish-upgradeable.sh
6039
env:
61-
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
40+
VANILLA_COMMIT: ${{ steps.vanilla.outputs.commit }}
6241
- name: Create Github Release Note
42+
run: bash scripts/release/workflow/github-release-upgradeable.sh
6343
env:
6444
GITHUB_TOKEN: ${{ secrets.GH_TOKEN_UPGRADEABLE }}
65-
run: |
66-
gh release create "${GIT_TAG}" \
67-
--repo="${UPGRADEABLE_REPO}" \
68-
--title="${GIT_TAG}" \
69-
--notes="$(gh release view "${OLD_GIT_TAG}" --repo="${VANILLA_REPO}" --json body -q .body)" `# TODO: Update tag before merging` \
70-
"${ADDITIONAL_OPTION_IF_PRERELEASE}"
45+
GIT_TAG: ${{ steps.publish.outputs.git_tag }}
46+
ADDITIONAL_OPTION_IF_PRERELEASE: ${{ steps.publish.outputs.additional_option_if_prerelease }}

‎scripts/release/workflow/github-release-upgradeable.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/usr/bin/env bash
2+
3+
gh release create "${GIT_TAG}" \
4+
--repo="${UPGRADEABLE_REPO}" \
5+
--title="${GIT_TAG}" \
6+
--notes="$(gh release view "${OLD_GIT_TAG}" --repo="${VANILLA_REPO}" --json body -q .body)" `# TODO: Update tag before merging` \
7+
"${ADDITIONAL_OPTION_IF_PRERELEASE}"

‎scripts/release/workflow/publish-upgradeable.sh‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#!/usr/bin/env bash
2+
3+
cd $UPGRADEABLE_DIR
4+
5+
if ! git log -1 --pretty=%B | grep -q "Transpile ${VANILLA_COMMIT}"; then
6+
echo "Expected 'Transpile ${VANILLA_COMMIT}' but found '$(git log -1 --pretty=%B)'"
7+
exit 1
8+
fi
9+
VERSION="$(jq -r .version contracts/package.json)"
10+
GIT_TAG="v${VERSION}"
11+
NPM_TAG="tmp"
12+
ADDITIONAL_OPTION_IF_PRERELEASE="--prerelease"
13+
if [[ "${GIT_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
14+
NPM_TAG="dev"
15+
ADDITIONAL_OPTION_IF_PRERELEASE=""
16+
elif [[ "${GIT_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-rc.[0-9]+$ ]]; then
17+
NPM_TAG="next"
18+
fi
19+
echo "additional_option_if_prerelease=${ADDITIONAL_OPTION_IF_PRERELEASE}" >> "$GITHUB_OUTPUT"
20+
### [START BLOCK] TODO: Remove block before merging
21+
TIMESTAMPED_VERSION="${VERSION}-$(date +%s)"
22+
echo "OLD_GIT_TAG=${GIT_TAG}" >> "$GITHUB_ENV"
23+
GIT_TAG="${GIT_TAG}-$(date +%s)" # incremental git tag for testing
24+
sed -i'' -e 's/openzeppelin\/contracts-upgradeable/james-toussaint\/contracts-upgradeable/g' contracts/package.json # custom scope for testing
25+
sed -i'' -e "s/${VERSION}/${TIMESTAMPED_VERSION}/g" contracts/package.json && head contracts/package.json # incremental npm package version for testing
26+
### [END BLOCK]
27+
sed -i'' -e 's/OpenZeppelin\/openzeppelin-contracts-upgradeable/james-toussaint\/openzeppelin-contracts/g' contracts/package.json # repository.url for provenance (TODO: Update and try keep upgradeable url)
28+
git tag -m {,}"${GIT_TAG}"
29+
CI=true git push origin tag "${GIT_TAG}"
30+
npm ci
31+
cd "contracts/"
32+
npm publish --tag "${NPM_TAG}"
33+
echo "git_tag=${GIT_TAG}" >> "$GITHUB_OUTPUT"

0 commit comments

Comments
 (0)