1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
|
name: "Release"
on:
push:
tags:
- "*"
permissions:
contents: read
env:
COMPOSER_FLAGS: "--ansi --no-interaction --no-progress --no-suggest --prefer-dist"
jobs:
build:
permissions:
contents: write # for gh to create a release
id-token: write # for actions/attest-build-provenance to create a attestation certificate
attestations: write # for actions/attest-build-provenance to upload the attestation
name: Upload Release Asset
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # 2.36.0
with:
coverage: "none"
extensions: "intl"
ini-values: "memory_limit=-1"
php-version: "8.4"
- name: "Install dependencies from composer.lock using composer binary provided by system"
run: "composer install ${{ env.COMPOSER_FLAGS }}"
- name: "Run install again using composer binary from source"
run: "bin/composer install ${{ env.COMPOSER_FLAGS }}"
- name: "Validate composer.json"
run: "bin/composer validate"
- name: Build phar file
run: "php -d phar.readonly=0 bin/compile"
- name: Generate build provenance attestation
uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
with:
subject-path: '${{ github.workspace }}/composer.phar'
- name: Configure GPG key and sign phar
run: |
mkdir -p ~/.gnupg/
chmod 0700 ~/.gnupg/
echo "$GPG_SIGNING_KEY" > ~/.gnupg/private.key
gpg --import ~/.gnupg/private.key
gpg -u contact@packagist.com --detach-sign --output composer.phar.asc composer.phar
env:
GPG_SIGNING_KEY: |
${{ secrets.GPG_KEY_161DFBE342889F01DDAC4E61CBB3D576F2A0946F }}
- name: Create release
env:
GH_TOKEN: ${{ github.token }}
run: gh release create "${{ github.ref_name }}" --title "${{ github.ref_name }}" --notes TODO --draft --verify-tag
- name: Upload release assets
env:
GH_TOKEN: ${{ github.token }}
run: gh release upload "${{ github.ref_name }}" composer.phar composer.phar.asc --clobber
# This step requires a secret token with `pull` access to composer/docker. The default
# secrets.GITHUB_TOKEN is scoped to this repository only which is not sufficient.
- name: "Open issue @ Docker repository"
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with:
github-token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
script: |
// create new issue on Docker repository
github.rest.issues.create({
owner: "${{ github.repository_owner }}",
repo: "docker",
title: `New Composer tag: ${{ github.ref_name }}`,
body: `https://github.com/${{ github.repository }}/releases/tag/${{ github.ref_name }}`,
});
|
