mirror of
https://github.com/vercel/next.js.git
synced 2026-09-20 02:25:18 +08:00
e69de2ffaf
Moves all release workflows off of a GH PAT and uses an app with a short-lived token instead. Test Plan: Dry run [here](https://github.com/vercel/next.js/actions/runs/24934593874). However, this workflow is blocked until we figure out commit signing for the bot app. Some options: - The bot account generates a signing key and we use it in CI (not great, bypasses the app) - The org bypasses signature verification for the bot user (also not great, requires an exemption rule) - We need to rework the commit step so Lerna does not do the push, and instead trigger it via the app + GH API. This seems like the best option, will be added in a follow-up PR. Note: `create-release-branch` workflow is broken in its current form, as we will not be restoring administrator privileges to adjust environment settings. This will become a manual step in the future.
133 lines
3.6 KiB
JavaScript
133 lines
3.6 KiB
JavaScript
// @ts-check
|
|
const fs = require('fs')
|
|
const path = require('path')
|
|
const execa = require('execa')
|
|
const {
|
|
configureGitHubAuth,
|
|
getGitHubToken,
|
|
getGitHubTokenMissingMessage,
|
|
verifyGitHubApiAccess,
|
|
} = require('./release-github-auth')
|
|
|
|
async function main() {
|
|
const args = process.argv
|
|
const branchName = args[args.indexOf('--branch-name') + 1]
|
|
const tagName = args[args.indexOf('--tag-name') + 1]
|
|
|
|
if (!branchName) {
|
|
throw new Error('branchName value is missing!')
|
|
}
|
|
|
|
if (!tagName || !tagName.startsWith('v')) {
|
|
throw new Error('tagName value is invalid "' + tagName + '"')
|
|
}
|
|
|
|
const githubToken = getGitHubToken()
|
|
|
|
if (!githubToken) {
|
|
console.log(getGitHubTokenMissingMessage())
|
|
return
|
|
}
|
|
|
|
await configureGitHubAuth(githubToken)
|
|
await verifyGitHubApiAccess(
|
|
githubToken,
|
|
'/repos/vercel/next.js/environments/release-stable/deployment-branch-policies?per_page=1',
|
|
'release-stable deployment branch policies'
|
|
)
|
|
|
|
await execa(`git checkout -b "${branchName}"`, {
|
|
stdio: 'inherit',
|
|
shell: true,
|
|
})
|
|
await execa(`git fetch origin ${tagName} --tags`, {
|
|
stdio: 'inherit',
|
|
shell: true,
|
|
})
|
|
await execa(`git reset --hard ${tagName}`, {
|
|
stdio: 'inherit',
|
|
shell: true,
|
|
})
|
|
const lernaPath = path.join(__dirname, '..', 'lerna.json')
|
|
const existingLerna = JSON.parse(
|
|
await fs.promises.readFile(lernaPath, 'utf8')
|
|
)
|
|
existingLerna.command.publish.allowBranch.push(branchName)
|
|
|
|
await fs.promises.writeFile(lernaPath, JSON.stringify(existingLerna, null, 2))
|
|
|
|
const buildAndDeployPath = path.join(
|
|
__dirname,
|
|
'..',
|
|
'.github',
|
|
'workflows',
|
|
'build_and_deploy.yml'
|
|
)
|
|
const buildAndDeploy = await fs.promises.readFile(buildAndDeployPath, 'utf8')
|
|
await fs.promises.writeFile(
|
|
buildAndDeployPath,
|
|
buildAndDeploy.replace(/refs\/heads\/canary/g, `refs/heads/${branchName}`)
|
|
)
|
|
|
|
const buildAndTestPath = path.join(
|
|
__dirname,
|
|
'..',
|
|
'.github',
|
|
'workflows',
|
|
'build_and_test.yml'
|
|
)
|
|
let buildAndTest = await fs.promises.readFile(buildAndTestPath, 'utf8')
|
|
buildAndTest = buildAndTest
|
|
.replace(`['canary']`, `['${branchName}']`)
|
|
.replace(/[\s]{1,}('test-new-tests-.+',)/g, '')
|
|
|
|
buildAndTest = buildAndTest.replace(
|
|
/(^[ \t]*)# test-new-tests-if\n(^[ \t]*)if:.*\n(^[ \t]*)# test-new-tests-end-if/gm,
|
|
(_, indent1, indent2, indent3) =>
|
|
`${indent1}# test-new-tests-if\n${indent2}if: false\n${indent3}# test-new-tests-end-if`
|
|
)
|
|
|
|
await fs.promises.writeFile(buildAndTestPath, buildAndTest)
|
|
|
|
await execa(`git add .`, {
|
|
stdio: 'inherit',
|
|
shell: true,
|
|
})
|
|
await execa(`git commit -m "setup release branch"`, {
|
|
stdio: 'inherit',
|
|
shell: true,
|
|
})
|
|
|
|
await execa(`git push origin "${branchName}"`, {
|
|
stdio: 'inherit',
|
|
shell: true,
|
|
})
|
|
|
|
console.log(`Waiting 5s before updating branch rules`)
|
|
await new Promise((resolve) => setTimeout(resolve, 5_000))
|
|
|
|
const updateEnvironmentRes = await fetch(
|
|
'https://api.github.com/repos/vercel/next.js/environments/release-stable/deployment-branch-policies',
|
|
{
|
|
method: 'POST',
|
|
headers: {
|
|
Accept: 'application/vnd.github+json',
|
|
Authorization: `Bearer ${githubToken}`,
|
|
'X-GitHub-Api-Version': '2022-11-28',
|
|
},
|
|
body: JSON.stringify({ name: branchName }),
|
|
}
|
|
)
|
|
|
|
if (!updateEnvironmentRes.ok) {
|
|
console.error(
|
|
{ status: updateEnvironmentRes.status },
|
|
await updateEnvironmentRes.text()
|
|
)
|
|
throw new Error(`Failed to update environment branch rules`)
|
|
}
|
|
console.log(`Successfully updated deployment environment branch rules`)
|
|
}
|
|
|
|
main()
|