Skip to content

Commit 4c1c684

Browse files
josecorellajosecorella
committed
chore(CI/CD): add semantic release automation
1 parent f5d9748 commit 4c1c684

File tree

4 files changed

+289
-0
lines changed

4 files changed

+289
-0
lines changed

‎.github/workflows/sem_ver.yml

+55
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# This workflow tests the installation of semantic release
2+
name: Semantic Release Test Installation
3+
4+
on:
5+
pull_request:
6+
7+
jobs:
8+
semantic-release:
9+
runs-on: macos-latest
10+
permissions:
11+
id-token: write
12+
contents: read
13+
steps:
14+
- name: Support longpaths on Git checkout
15+
run: |
16+
git config --global core.longpaths true
17+
- uses: actions/checkout@v3
18+
# We only pull in the submodules we need to build the library
19+
- run: git submodule update --init libraries
20+
21+
# We need access to the role that is able to get CI Bot Creds
22+
- name: Configure AWS Credentials for Release
23+
uses: aws-actions/configure-aws-credentials@v2
24+
with:
25+
aws-region: us-west-2
26+
role-to-assume: arn:aws:iam::587316601012:role/GitHub-CI-CI-Bot-Credential-Access-Role-us-west-2
27+
role-session-name: CI_Bot_Release
28+
29+
- name: Upgrade Node
30+
uses: actions/setup-node@v4
31+
with:
32+
node-version: 20
33+
34+
# Use AWS Secrets Manger GHA to retrieve CI Bot Creds
35+
- name: Get CI Bot Creds Secret
36+
uses: aws-actions/aws-secretsmanager-get-secrets@v2
37+
with:
38+
secret-ids: Github/aws-crypto-tools-ci-bot
39+
parse-json-secrets: true
40+
41+
# Log in as the CI Bot
42+
- name: Log in as CI Bot
43+
run: |
44+
echo ${{env.GITHUB_AWS_CRYPTO_TOOLS_CI_BOT_ESDK_RELEASE_TOKEN}} > token.txt
45+
gh auth login --with-token < token.txt
46+
rm token.txt
47+
gh auth status
48+
49+
# Test to see if we can setup semantic release
50+
- name: Test Semantic Release Installation
51+
uses: actions/checkout@v4
52+
with:
53+
ref: main
54+
- run: |
55+
make setup_semantic_release

‎.github/workflows/semantic_release.yml

+77
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# This workflow runs semantic release, bumps, generates changelog, and tags the project
2+
name: Semantic Release
3+
4+
on:
5+
workflow_dispatch:
6+
inputs:
7+
dry-run:
8+
description: "Are you releasing a new version? (y/n)"
9+
required: true
10+
type: string
11+
12+
jobs:
13+
semantic-release:
14+
# there is no easy way in gha to check if the actor is part of the team, running semantic release is a more
15+
# privileged operation, so we must make sure this list of users is a subset of the users labeled as maintainers of
16+
# https://github.com/orgs/aws/teams/aws-crypto-tools
17+
if: contains('["seebees","texastony","ShubhamChaturvedi7","lucasmcdonald3","josecorella","imabhichow","rishav-karanjit","antonf-amzn","justplaz","ajewellamz"]', github.actor)
18+
runs-on: macos-latest
19+
permissions:
20+
id-token: write
21+
contents: write
22+
steps:
23+
- name: Support longpaths on Git checkout
24+
run: |
25+
git config --global core.longpaths true
26+
- uses: actions/checkout@v3
27+
# We only pull in the submodules we need to build the library
28+
- run: git submodule update --init libraries
29+
30+
# We need access to the role that is able to get CI Bot Creds
31+
- name: Configure AWS Credentials for Release
32+
uses: aws-actions/configure-aws-credentials@v2
33+
with:
34+
aws-region: us-west-2
35+
role-to-assume: arn:aws:iam::587316601012:role/GitHub-CI-CI-Bot-Credential-Access-Role-us-west-2
36+
role-session-name: CI_Bot_Release
37+
38+
- name: Upgrade Node
39+
uses: actions/setup-node@v4
40+
with:
41+
node-version: 20
42+
43+
# Use AWS Secrets Manger GHA to retrieve CI Bot Creds
44+
- name: Get CI Bot Creds Secret
45+
uses: aws-actions/aws-secretsmanager-get-secrets@v2
46+
with:
47+
secret-ids: Github/aws-crypto-tools-ci-bot
48+
parse-json-secrets: true
49+
50+
# Log in as the CI Bot
51+
- name: Log in as CI Bot
52+
run: |
53+
echo ${{env.GITHUB_AWS_CRYPTO_TOOLS_CI_BOT_ESDK_RELEASE_TOKEN}} > token.txt
54+
gh auth login --with-token < token.txt
55+
rm token.txt
56+
gh auth status
57+
58+
# Set up semantic release
59+
- name: Setup Semantic Release
60+
run: |
61+
make setup_semantic_release
62+
63+
# Run semantic release in dry run mode if input matches
64+
- name: Run Semantic Release in dry run mode
65+
env:
66+
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
67+
if: ${{inputs.dry-run == 'n'}}
68+
run: |
69+
make dry_run_semantic_release
70+
71+
# Run semantic release if input matches
72+
- name: Run Semantic Release
73+
env:
74+
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
75+
if: ${{inputs.dry-run == 'y'}}
76+
run: |
77+
make run_semantic_release

‎.releaserc.cjs

+148
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
// Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
2+
// SPDX-License-Identifier: Apache-2.0
3+
4+
/*
5+
First run `make setup_semantic_release` to install the required dependencies.
6+
7+
Using this config semantic-release will search for the latest tag
8+
evaluate all commits after that tag
9+
generate release notes and a version bump.
10+
It will commit these changes, push these changes, and publish a new version tag.
11+
12+
This file requires a `--branches` option to function.
13+
This is to facilitate point releases if needed.
14+
15+
`npx semantic-release --branches main`
16+
*/
17+
18+
// This project has several runtimes
19+
// each one has files that need to be updated.
20+
// We model all the files and the runtimes here in this structure
21+
const Runtimes = {
22+
net: {
23+
"DynamoDbEncryption/runtimes/net/DynamoDbEncryption.csproj": {
24+
dependencies: [],
25+
assemblyInfo: [
26+
"DynamoDbEncryption/runtimes/net/AssemblyInfo.cs"
27+
]
28+
}
29+
},
30+
};
31+
32+
/**
33+
* @type {import('semantic-release').GlobalConfig}
34+
*/
35+
module.exports = {
36+
branches: ["main"],
37+
repositoryUrl:
38+
"[email protected]:aws/aws-database-encryption-sdk-dynamodb.git",
39+
plugins: [
40+
// Check the commits since the last release
41+
["@semantic-release/commit-analyzer",
42+
{
43+
"preset": "conventionalcommits",
44+
"parserOpts": {
45+
"noteKeywords": ["BREAKING CHANGE", "BREAKING CHANGES"]
46+
},
47+
"presetConfig": {
48+
"types": [
49+
{"type": "feat", "section": "Features"},
50+
{"type": "fix", "section": "Fixes"},
51+
{"type": "chore", "section": "Maintenance"},
52+
{"type": "docs", "section": "Maintenance"},
53+
{"type": "revert", "section": "Fixes"},
54+
{"type": "style", "hidden": true},
55+
{"type": "refactor", "hidden": true},
56+
{"type": "perf", "hidden": true},
57+
{"type": "test", "hidden": true}
58+
]
59+
},
60+
"releaseRules": [
61+
{"type": "docs", "release": "patch"},
62+
{"type": "revert", "release": "patch"},
63+
{"type": "chore", "release": "patch"}
64+
]
65+
},
66+
],
67+
// Based on the commits generate release notes
68+
["@semantic-release/release-notes-generator",
69+
{
70+
"preset": "conventionalcommits",
71+
"parserOpts": {
72+
"noteKeywords": ["BREAKING CHANGE", "BREAKING CHANGES"]
73+
},
74+
"presetConfig": {
75+
"types": [
76+
{"type": "feat", "section": "Features"},
77+
{"type": "fix", "section": "Fixes"},
78+
{"type": "chore", "section": "Maintenance"},
79+
{"type": "docs", "section": "Maintenance"},
80+
{"type": "revert", "section": "Fixes"},
81+
{"type": "style", "hidden": true},
82+
{"type": "refactor", "hidden": true},
83+
{"type": "perf", "hidden": true},
84+
{"type": "test", "hidden": true}
85+
]
86+
}
87+
}
88+
],
89+
// Update the change log with the generated release notes
90+
[
91+
"@semantic-release/changelog",
92+
{
93+
changelogFile: "CHANGELOG.md",
94+
changelogTitle: "# Changelog",
95+
},
96+
],
97+
98+
// Bump the various versions
99+
[
100+
"semantic-release-replace-plugin",
101+
{
102+
replacements: [
103+
// Update the version for all DotNet projects
104+
// Does not update the dependencies
105+
{
106+
files: Object.keys(Runtimes.net),
107+
from: "<Version>.*</Version>",
108+
to: "<Version>${nextRelease.version}</Version>",
109+
results: Object.keys(Runtimes.net).map(CheckResults),
110+
countMatches: true,
111+
},
112+
// Update the AssmeblyInfo.cs file of the DotNet projects
113+
...Object.entries(Runtimes.net).flatMap(
114+
([file, { assemblyInfo }]) => ({
115+
files: assemblyInfo,
116+
from: "assembly: AssemblyVersion(.*)",
117+
to: 'assembly: AssemblyVersion("${nextRelease.version}")]',
118+
results: [CheckResults(assemblyInfo)],
119+
countMatches: true,
120+
}),
121+
),
122+
],
123+
},
124+
],
125+
// Commit and push changes the changelog and versions bumps
126+
[
127+
"@semantic-release/git",
128+
{
129+
assets: [
130+
"CHANGELOG.md",
131+
...Object.values(Runtimes).flatMap((r) => Object.keys(r)),
132+
...Object.values(Runtimes.net).flatMap((r) => r.assemblyInfo),
133+
],
134+
message:
135+
"chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}",
136+
},
137+
],
138+
],
139+
};
140+
141+
function CheckResults(file) {
142+
return {
143+
file,
144+
hasChanged: true,
145+
numMatches: 1,
146+
numReplacements: 1,
147+
};
148+
}

‎Makefile

+9
Original file line numberDiff line numberDiff line change
@@ -51,3 +51,12 @@ generate_properties_file:
5151
--namespace aws.polymorph \
5252
--properties-file $(PROJECT_ROOT)/smithy-dafny-project.properties \
5353
";
54+
55+
setup_semantic_release:
56+
npm i --no-save semantic-release @semantic-release/changelog semantic-release-replace-plugin conventional-changelog-conventionalcommits @semantic-release/git
57+
58+
run_semantic_release:
59+
npx semantic-release --no-ci
60+
61+
dry_run_semantic_release:
62+
npx semantic-release --dry-run

0 commit comments

Comments
 (0)