azure-iot-cli-extension/.github/workflows/release_workflow.yml at dev · Azure/azure-iot-cli-extension · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
# checkov:skip=CKV_GHA_7:workflow_dispatch inputs are typed booleans controlling release flow, not injected into build output
name: Build and Publish Release
run-name: Build and publish release${{ github.event.inputs.github_release == 'true' &&  ' - Stage Release' || ''}}
permissions: {}
on:
  # only manual trigger
  workflow_dispatch:
    inputs:
      continue-on-error:
        description: Continue release if pre-checks fail
        type: boolean
        required: false
        default: false
      github_release:
        description: Stage github release
        type: boolean
        required: false
        default: false
      run_int_tests:
        description: Run integration test step
        type: boolean
        required: false
        default: true
jobs:
  security:
    permissions:
      # needed to write security info to repository
      id-token: write
      security-events: write
      contents: read
    uses: ./.github/workflows/security_checks.yml
    with:
      continue-on-error: ${{ github.event.inputs.continue-on-error == 'true' }}
  build:
    permissions:
      contents: read
      id-token: write
    uses: ./.github/workflows/release_build.yml
    secrets: inherit
  unit-test:
    permissions:
      contents: read
    uses: ./.github/workflows/tox.yml
    with:
      continue-on-error: ${{ github.event.inputs.continue-on-error == 'true' }}
  azdev_linter:
    permissions:
      contents: read
    needs: [build]
    uses: ./.github/workflows/azdev_linter.yml
    with:
      continue-on-error: ${{ github.event.inputs.continue-on-error == 'true' }}
  int_test:
    permissions:
      contents: read
    needs: [build]
    if: always() && !cancelled() && !failure() && (github.event.inputs.run_int_tests == 'true')
    uses: ./.github/workflows/int_test.yml
    with:
      test-services: "auto"
      python-versions: "3.10,3.13"
      regions: "westus"
    secrets: inherit
  approval:
    needs: [security, build, unit-test, azdev_linter, int_test]
    # only needed if (release || wheel) - conditionals allow previous jobs to be skipped and still run
    if: always() && !cancelled() && !failure() && (github.event.inputs.github_release == 'true')
    environment: production
    runs-on: ubuntu-latest
    steps:
      - name: Confirm
        run: |
          echo "Approved" >> $GITHUB_STEP_SUMMARY
          if [ "${{ inputs.github_release }}" == "true" ]; then
            echo "Github release will be drafted." >> $GITHUB_STEP_SUMMARY
          fi
  # github_release == 'true'
  draft_github_release:
    permissions:
      # needed to create draft release
      contents: write
    needs: [approval]
    if: always() && !cancelled() && !failure() && github.event.inputs.github_release == 'true'
    uses: ./.github/workflows/stage_release.yml
    secrets: inherit