From 1d7cbc7aa65fd4f40e745dadeae79a160f19e9c4 Mon Sep 17 00:00:00 2001 From: Steven Pritchard Date: Wed, 22 Jul 2026 22:21:14 +0000 Subject: [PATCH 1/2] Add create_release_tag.yml workflow for pupmod repos Adds a manually-dispatched (workflow_dispatch) GitHub Action that replaces the local release-tagging script: - Must be dispatched from the default branch - Reads the release version from metadata.json and validates it (SemVer format, tag does not already exist, pkg:check_version, pkg:compare_latest_tag, metadata_lint) - Generates the tag annotation from the CHANGELOG via rake pkg:create_tag_changelog - Creates the annotated tag and pushes it, which triggers the tag_deploy.yml release workflow - Pushes with the SIMP_AUTO_GITHUB_TOKEN__REPO_SCOPE PAT because tags pushed with the default GITHUB_TOKEN do not trigger other workflows - Supports a dry_run input that validates and prints the annotation without pushing Co-Authored-By: Claude Fable 5 --- CHANGELOG.md | 10 ++ data/project_types/pupmod.yaml | 1 + .../_github/workflows/create_release_tag.yml | 115 ++++++++++++++++++ 3 files changed, 126 insertions(+) create mode 100644 modules/profile/files/pupmod/_github/workflows/create_release_tag.yml diff --git a/CHANGELOG.md b/CHANGELOG.md index 4621eee..00ddaa8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,16 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). ### Added +- New GHA workflow for pupmod repos, `create_release_tag.yml` + - Manually-dispatched (`workflow_dispatch`) release tagging + - Reads the version from `metadata.json`, validates it + (`pkg:check_version`, `pkg:compare_latest_tag`, `metadata_lint`), + generates the tag annotation from the CHANGELOG + (`pkg:create_tag_changelog`), and pushes the annotated tag + - The pushed tag triggers `tag_deploy.yml` (requires the + `SIMP_AUTO_GITHUB_TOKEN__REPO_SCOPE` PAT secret to push) + - Supports a `dry_run` input that validates and prints the tag + annotation without pushing - New GHA workflow, `add_new_issue_to_triage_project.yml` - New task, `generate_reference_md` - Generates up-to-date `REFERENCE.md` diff --git a/data/project_types/pupmod.yaml b/data/project_types/pupmod.yaml index 84d0b88..c68d8f8 100644 --- a/data/project_types/pupmod.yaml +++ b/data/project_types/pupmod.yaml @@ -14,6 +14,7 @@ profile::github_actions::absent_action_files: profile::github_actions::present_action_files: - pr_tests.yml # PR-triggered Pupmod checks + test matrix + - create_release_tag.yml # Manually create + push a release tag - tag_deploy.yml # Release on tag, deploy pupmod to forge, RPMs to GH - release_rpms.yml # Build, sign, upload RPMs to a release from any repo - validate_tokens.yml # Diagnostic workflow to check API tokens work diff --git a/modules/profile/files/pupmod/_github/workflows/create_release_tag.yml b/modules/profile/files/pupmod/_github/workflows/create_release_tag.yml new file mode 100644 index 0000000..5f603da --- /dev/null +++ b/modules/profile/files/pupmod/_github/workflows/create_release_tag.yml @@ -0,0 +1,115 @@ +# Manual action to create + push a release tag from metadata.json & CHANGELOG +# ------------------------------------------------------------------------------ +# +# NOTICE: **This file is maintained with puppetsync** +# +# This file is updated automatically as part of a puppet module baseline. +# +# The next baseline sync will overwrite any local changes to this file! +# +# ============================================================================== +# This pipeline uses the following GitHub Action Secrets: +# +# GitHub Secret variable Notes +# ------------------------------- --------------------------------------- +# SIMP_AUTO_GITHUB_TOKEN__REPO_SCOPE Used to push the release tag. A PAT is +# required in order for the pushed tag to +# trigger the `tag_deploy.yml` workflow +# (events created with the workflow's own +# GITHUB_TOKEN do not trigger other +# workflows). Falls back to GITHUB_TOKEN, +# which still creates the tag but will +# NOT trigger the release workflow. +# +# ------------------------------------------------------------------------------ +# +# * This is a workflow_dispatch action, which can be triggered manually or from +# other workflows/API +# +# * It must be dispatched from the repository's default branch +# +# * The tag version is read from `metadata.json` and the tag's annotation is +# generated from the CHANGELOG (`rake pkg:create_tag_changelog`) +# +# * Pushing the tag triggers the `tag_deploy.yml` release workflow +# +--- +name: 'RELENG: Create release tag' + +on: + workflow_dispatch: + inputs: + dry_run: + description: "Dry run (validate + report the tag annotation, don't push)" + required: false + type: boolean + default: false + +env: + PUPPET_VERSION: '~> 8' + +jobs: + create-release-tag: + name: 'Create release tag' + runs-on: ubuntu-latest + permissions: + contents: write + steps: + - name: "Assert '${{ github.ref }}' is the default branch" + env: + DEFAULT_BRANCH_REF: 'refs/heads/${{ github.event.repository.default_branch }}' + run: | + [[ "$GITHUB_REF" == "$DEFAULT_BRANCH_REF" ]] || \ + { echo "::error ::Dispatched ref '${GITHUB_REF}' is not the default branch ('${DEFAULT_BRANCH_REF}')"; exit 1; } + + - uses: actions/checkout@v7 + with: + ref: ${{ github.ref }} + clean: true + fetch-depth: 0 # tag history is needed for `rake pkg:compare_latest_tag` + token: ${{ secrets.SIMP_AUTO_GITHUB_TOKEN__REPO_SCOPE || github.token }} + + - name: Read + validate version from metadata.json + id: version + run: | + version="$(jq -r .version metadata.json)" + if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-z]+[0-9]+)?$ ]]; then + echo "::error ::metadata.json version '${version}' is not SemVer (X.Y.Z or X.Y.Z-)" + exit 1 + fi + if git rev-parse -q --verify "refs/tags/${version}" >/dev/null; then + echo "::error ::Tag '${version}' already exists" + exit 1 + fi + echo "version=${version}" | tee -a "$GITHUB_OUTPUT" + + - uses: ruby/setup-ruby@v1 + with: + ruby-version: 3.4.9 + bundler-cache: true + + - name: RELENG sanity checks + run: | + bundle exec rake pkg:check_version + bundle exec rake pkg:compare_latest_tag + bundle exec rake metadata_lint + + - name: Generate tag annotation from CHANGELOG + env: + TARGET_VERSION: ${{ steps.version.outputs.version }} + run: | + bundle exec rake pkg:create_tag_changelog > "/tmp/tag_annotation_${TARGET_VERSION}.txt" + echo '::group::Tag annotation' + cat "/tmp/tag_annotation_${TARGET_VERSION}.txt" + echo '::endgroup::' + + - name: Create + push annotated tag (skipped when dry_run) + if: ${{ !inputs.dry_run }} + env: + TARGET_VERSION: ${{ steps.version.outputs.version }} + run: | + git config user.name "${GITHUB_ACTOR}" + git config user.email "${GITHUB_ACTOR}@users.noreply.github.com" + git tag -a "$TARGET_VERSION" -F "/tmp/tag_annotation_${TARGET_VERSION}.txt" + git push origin "refs/tags/${TARGET_VERSION}" + echo "Pushed tag \`${TARGET_VERSION}\` (this triggers the \`tag_deploy.yml\` release workflow)" >> "$GITHUB_STEP_SUMMARY" From 8a28431956ae637f34cd34a7a638bbd0f2f2da4f Mon Sep 17 00:00:00 2001 From: Steven Pritchard Date: Thu, 30 Jul 2026 16:44:37 +0000 Subject: [PATCH 2/2] Drop CHANGELOG.md hunk per the changelog freeze CHANGELOG.md is frozen (see #71); the squash-merge PR title carries this change's history. Co-Authored-By: Claude Fable 5 --- CHANGELOG.md | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 00ddaa8..4621eee 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,16 +10,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). ### Added -- New GHA workflow for pupmod repos, `create_release_tag.yml` - - Manually-dispatched (`workflow_dispatch`) release tagging - - Reads the version from `metadata.json`, validates it - (`pkg:check_version`, `pkg:compare_latest_tag`, `metadata_lint`), - generates the tag annotation from the CHANGELOG - (`pkg:create_tag_changelog`), and pushes the annotated tag - - The pushed tag triggers `tag_deploy.yml` (requires the - `SIMP_AUTO_GITHUB_TOKEN__REPO_SCOPE` PAT secret to push) - - Supports a `dry_run` input that validates and prints the tag - annotation without pushing - New GHA workflow, `add_new_issue_to_triage_project.yml` - New task, `generate_reference_md` - Generates up-to-date `REFERENCE.md`