astelm/grpcurl
1
0
Fork 0
mirror of https://github.com/fullstorydev/grpcurl.git synced 2026-09-05 18:16:08 +03:00
Code Issues Packages Projects Releases Wiki Activity

update release to cut and upload via gh actions (#580)

Browse Source
This commit is contained in:
Sam Kirsch
2026-08-31 15:10:15 -04:00
committed by GitHub
parent 8568146e02
commit cf21d4aca5
8 changed files with 246 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/release.yml
+26
View File
@@ -0,0 +1,26 @@
# Controls how GitHub groups merged PRs in the auto-generated release notes.
# goreleaser delegates to GitHub's generator (changelog.use: github-native in
# .goreleaser.yml), so this file is what shapes the notes for a release.
#
# Labels are optional: anything unlabeled lands in "Changes". Labeling a PR
# `bug` or `enhancement` just sorts it into a nicer bucket, and dependabot
# applies `dependencies` on its own, which keeps version bumps out of the way
# at the bottom.
changelog:
exclude:
labels:
- ignore-for-release
categories:
- title: Enhancements
labels:
- enhancement
- title: Bug Fixes
labels:
- bug
- title: Dependencies
labels:
- dependencies
# Catch-all. Must stay last: a PR lands in the first category it matches.
- title: Changes
labels:
- "*"
.github/workflows/release.yml
+184
View File
@@ -0,0 +1,184 @@
name: Release
on:
workflow_dispatch:
inputs:
version:
description: "Release version, sem-ver format: vM.N.P"
required: true
type: string
dry_run:
description: "Build everything, publish nothing (aka DRY-RUN... no tag, no GitHub release, no image push, no brew PR)"
type: boolean
default: false
# Only one release may be in flight at a time.
concurrency:
group: release
cancel-in-progress: false
permissions:
contents: read
jobs:
release:
name: Tag, build binaries, and create the GitHub release
runs-on: ubuntu-latest
permissions:
contents: write # create the tag and the release
steps:
- name: Validate version
run: |
if [[ ! "${{ inputs.version }}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
echo "::error::'${{ inputs.version }}' is not a sem-ver version of the form vM.N.P" >&2
exit 1
fi
- uses: actions/checkout@v7
with:
# goreleaser needs full history (and existing tags) to compute the change log
fetch-depth: 0
- name: Check that the tag does not already exist
run: |
if git rev-parse -q --verify "refs/tags/${{ inputs.version }}" >/dev/null; then
echo "::error::tag ${{ inputs.version }} already exists" >&2
exit 1
fi
- uses: actions/setup-go@v7
with:
go-version-file: go.mod
check-latest: true
# Releases are effectively immutable, so make sure we aren't shipping a broken build.
- name: Run tests
run: go test ./...
- name: Create tag
run: |
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
git tag -a "${{ inputs.version }}" -m "Release ${{ inputs.version }}"
- name: Push tag
if: ${{ !inputs.dry_run }}
run: git push origin "${{ inputs.version }}"
# Cross-compiles for every platform in .goreleaser.yml, then creates the
# GitHub release with generated notes and uploads the archives.
- name: Build and release
run: make release GORELEASER_ARGS="${{ inputs.dry_run && '--skip=publish,announce' || '' }}"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# CHANGELOG.md is the release notes that *would* have been published,
# which is worth eyeballing before a real release.
- name: Upload artifacts for inspection
if: ${{ inputs.dry_run }}
uses: actions/upload-artifact@v7
with:
name: dry-run-dist
path: |
dist/*.tar.gz
dist/*.zip
dist/*.txt
dist/*.deb
dist/*.rpm
dist/CHANGELOG.md
if-no-files-found: error
docker:
name: Build and push the Docker image
needs: release
runs-on: ubuntu-latest
permissions:
contents: read
packages: write # push to ghcr.io
outputs:
image: ${{ steps.image.outputs.name }}
env:
# Matches what releasing/do-release.sh has always published.
PLATFORMS: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
steps:
# Derived from the repo rather than hardcoded, so this works the same on a
# fork: `packages: write` only grants access to packages owned by the repo
# owner. GHCR also rejects uppercase, and GitHub expressions have no
# lowercase function, hence the shell parameter expansion.
- name: Compute image name
id: image
run: echo "name=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
- uses: actions/checkout@v7
with:
# the release job just created this tag; build the image from exactly that source
ref: ${{ inputs.dry_run && github.sha || inputs.version }}
# The Dockerfile stamps the binary with the contents of this file. It is
# gitignored, and produced by `make docker` during local builds.
- name: Write VERSION file
run: echo "${{ inputs.version }}" > VERSION
- uses: docker/setup-qemu-action@v4
- uses: docker/setup-buildx-action@v4
- name: Log in to GitHub Container Registry
if: ${{ !inputs.dry_run }}
uses: docker/login-action@v4
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
# The Dockerfile has two final stages: the default `scratch` image and an
# `alpine` one. Both are published, as do-release.sh does.
- name: Build and push
uses: docker/build-push-action@v7
with:
context: .
platforms: ${{ env.PLATFORMS }}
push: ${{ !inputs.dry_run }}
no-cache: true
tags: |
${{ steps.image.outputs.name }}:${{ inputs.version }}
${{ steps.image.outputs.name }}:latest
- name: Build and push (alpine)
uses: docker/build-push-action@v7
with:
context: .
target: alpine
platforms: ${{ env.PLATFORMS }}
push: ${{ !inputs.dry_run }}
no-cache: true
tags: |
${{ steps.image.outputs.name }}:${{ inputs.version }}-alpine
${{ steps.image.outputs.name }}:latest-alpine
summary:
name: Summarize
needs: [release, docker]
runs-on: ubuntu-latest
steps:
- name: Dry run summary
if: ${{ inputs.dry_run }}
run: |
{
echo "## Dry run of ${{ inputs.version }} succeeded"
echo
echo "Nothing was published. The binaries are attached to this run as the \`dry-run-dist\` artifact."
echo "Re-run with **dry_run** unchecked to publish."
} >> "$GITHUB_STEP_SUMMARY"
- name: Release summary
if: ${{ !inputs.dry_run }}
run: |
{
echo "## Released ${{ inputs.version }}"
echo
echo "* [GitHub release](${{ github.server_url }}/${{ github.repository }}/releases/tag/${{ inputs.version }})"
echo "* Image \`${{ needs.docker.outputs.image }}:${{ inputs.version }}\` (and \`:latest\`)"
echo "* Image \`${{ needs.docker.outputs.image }}:${{ inputs.version }}-alpine\` (and \`:latest-alpine\`)"
echo
echo "Release notes were generated from the merged PRs. Nothing else to do."
} >> "$GITHUB_STEP_SUMMARY"
.goreleaser.yml
+5
View File
@@ -1,3 +1,5 @@
version: 2
builds:
- binary: grpcurl
main: ./cmd/grpcurl
@@ -59,3 +61,6 @@ nfpms:
formats:
- deb
- rpm
changelog:
use: github-native
Makefile
+6 -2
View File
@@ -29,10 +29,14 @@ updatedeps:
install:
go install -ldflags '-X "main.version=dev build $(dev_build_version)"' ./...
GORELEASER_VERSION := v2.5.0
# Extra flags for goreleaser, e.g. "--skip=publish" for a dry run.
GORELEASER_ARGS ?=
.PHONY: release
release:
@go install github.com/goreleaser/goreleaser@v1.21.0
goreleaser release --clean
@go install github.com/goreleaser/goreleaser/v2@$(GORELEASER_VERSION)
goreleaser release --clean $(GORELEASER_ARGS)
.PHONY: docker
docker:
README.md
+2 -2
View File
@@ -62,9 +62,9 @@ brew install grpcurl
For platforms that support Docker, you can download an image that lets you run `grpcurl`:
```shell
# Download image
docker pull fullstorydev/grpcurl:latest
docker pull ghcr.io/fullstorydev/grpcurl:latest
# Run the tool
docker run fullstorydev/grpcurl api.grpc.me:443 list
docker run ghcr.io/fullstorydev/grpcurl api.grpc.me:443 list
```
Note that there are some pitfalls when using docker:
- If you need to interact with a server listening on the host's loopback network, you must specify the host as `host.docker.internal` instead of `localhost` (for Mac or Windows) _OR_ have the container use the host network with `-network="host"` (Linux only).
releasing/README.md
+14 -60
View File
@@ -7,73 +7,27 @@ The release process consists of a handful of tasks:
2. Build binaries for various platforms. This is done using the local `go` tool and uses `GOOS` and `GOARCH` environment variables to cross-compile for supported platforms.
3. Creates a release in GitHub, uploads the binaries, and creates provisional release notes (in the form of a change log).
4. Build a docker image for the new release.
5. Push the docker image to Docker Hub, with both a version tag and the "latest" tag.
6. Submits a PR to update the [Homebrew](https://brew.sh/) recipe with the latest version.
5. Push the docker image to `ghcr.io`, with both a version tag and the "latest" tag.
Most of this is automated via a script in this same directory. The main thing you will need is a GitHub personal access token, which will be used for creating the release in GitHub (so you need write access to the fullstorydev/grpcurl repo) and to open a Homebrew pull request.
## Creating a new release
So, to actually create a new release, just run the script in this directory.
Go to the [Release workflow](https://github.com/fullstorydev/grpcurl/actions/workflows/release.yml), click **Run workflow**, and provide:
First, you need a version number for the new release, following sem-ver format: `v<Major>.<Minor>.<Patch>`. Second, you need a personal access token for GitHub.
* **Branch**: the branch or commit to release from (usually `master`).
* **version**: the version number for the new release, in sem-ver format: `v<Major>.<Minor>.<Patch>`, e.g. `v2.3.4`.
* **dry_run**: check this to build everything but publish nothing. Useful for validating a change to the release tooling. The binaries are attached to the workflow run as an artifact.
We'll use `v2.3.4` as an example version and `abcdef0123456789abcdef` as an example GitHub token:
The workflow then:
1. Verifies the version is well-formed and that the tag does not already exist.
2. Runs the tests.
3. Creates and pushes the release tag.
4. Cross-compiles binaries for all supported platforms, creates the GitHub release with generated release notes, and uploads the archives. (This is goreleaser, driven by `.goreleaser.yml`.)
5. Builds a multi-arch (`linux/amd64`, `linux/arm64`) Docker image and pushes it to `ghcr.io`, tagged with both the version and `latest`.
```sh
# from the root of the repo
GITHUB_TOKEN=abcdef0123456789abcd \
./releasing/do-release.sh v2.3.4
```
## Release notes
Wasn't that easy! There is one last step: update the release notes in GitHub. By default, the script just records a change log of commit descriptions. Use that log (and, if necessary, drill into individual PRs included in the release) to flesh out notes in the format of the `RELEASE_NOTES.md` file _in this directory_. Then login to GitHub, go to the new release, edit the notes, and paste in the markdown you just wrote.
Release notes are generated, never hand-written. `changelog.use: github-native` in `.goreleaser.yml` hands the job to GitHub's own release-notes generator, which lists every PR merged since the previous tag with its title, link, and author, and credits new contributors.
That should be all there is to it! If things go wrong and you have to re-do part of the process, see the sections below.
----
### GitHub Releases
The GitHub release is the first step performed by the `do-release.sh` script. So generally, if there is an issue with that step, you can re-try the whole script.
Note, if running the script did something wrong, you may have to first login to GitHub and remove uploaded artifacts for a botched release attempt. In general, this is _very undesirable_. Releases should usually be considered immutable. Instead of removing uploaded assets and providing new ones, it is often better to remove uploaded assets (to make bad binaries no longer available) and then _release a new patch version_. (You can edit the release notes for the botched version explaining why there are no artifacts for it.)
The steps to do a GitHub-only release (vs. running the entire script) are the following:
```sh
# from the root of the repo
git tag v2.3.4
GITHUB_TOKEN=abcdef0123456789abcdef \
GO111MODULE=on \
make release
```
The `git tag ...` step is necessary because the release target requires that the current SHA have a sem-ver tag. That's the version it will use when creating the release.
This will create the release in GitHub with provisional release notes that just include a change log of commit messages. You still need to login to GitHub and revise those notes to adhere to the recommended format. (See `RELEASE_NOTES.md` in this directory.)
### Docker Hub Releases
To re-run only the Docker Hub release steps, you can manually run through each step in the "Docker" section of `do_release.sh`.
If the `docker push ...` steps fail, you may need to run `docker login`, enter your Docker Hub login credentials, and then try to push again.
### Homebrew Releases
The last step is to update the Homebrew recipe to use the latest version. First, we need to compute the SHA256 checksum for the source archive:
```sh
# download the source archive from GitHub
URL=https://github.com/fullstorydev/grpcurl/archive/refs/tags/v2.3.4.tar.gz
curl -L -o tmp.tgz $URL
# and compute the SHA
SHA="$(sha256sum < tmp.tgz | awk '{ print $1 }')"
```
To actually create the brew PR, you need your GitHub personal access token again, as well as the URL and SHA from the previous step:
```sh
HOMEBREW_GITHUB_API_TOKEN=abcdef0123456789abcdef \
brew bump-formula-pr --url $URL --sha256 $SHA grpcurl
```
This creates a PR to bump the formula to the new version. When this PR is merged by brew maintainers, the new version becomes available!
`.github/release.yml` controls how those PRs are grouped. Labels are optional — an unlabeled PR lands in a catch-all "Changes" section — so this needs no ongoing upkeep. Two things make the notes read better, if you want them:
releasing/RELEASE_NOTES.md
-11
View File
@@ -1,11 +0,0 @@
## Changes
### Command-line tool
* _In this list, describe the changes to the command-line tool._
* _Use one bullet per change. Include both bug-fixes and improvements. Omit this section if there are no changes that impact the command-line tool._
### Go package "github.com/fullstorydev/grpcurl"
* _In this list, describe the changes to exported API in the main package in this repo: "github.com/fullstorydev/grpcurl". These will often be closely related to changes to the command-line tool, though not always: changes that only impact the cmd/grpcurl directory of this repo do not impact exported API._
* _Use one bullet per change. Include both bug-fixes and improvements. Omit this section if there are no changes that impact the exported API._
releasing/do-release.sh
+9 -11
View File
@@ -37,8 +37,9 @@ $PREFIX git checkout go.mod go.sum
# make sure credentials are valid for later push steps; this might
# be interactive since this will prompt for username and password
# if there are no valid current credentials.
$PREFIX docker login
# if there are no valid current credentials. Use a GitHub personal access
# token with the write:packages scope as the password.
$PREFIX docker login ghcr.io
echo "$VERSION" > VERSION
# Docker Buildx support is included in Docker 19.03
@@ -48,15 +49,12 @@ $PREFIX docker run --privileged --rm tonistiigi/binfmt:qemu-v6.1.0 --install all
# Create a new builder instance
export DOCKER_CLI_EXPERIMENTAL=enabled
$PREFIX docker buildx create --use --name multiarch-builder --node multiarch-builder0
# push to docker hub, both the given version as a tag and for "latest" tag
$PREFIX docker buildx build --platform linux/amd64,linux/s390x,linux/arm64,linux/ppc64le --tag fullstorydev/grpcurl:${VERSION} --tag fullstorydev/grpcurl:latest --push --progress plain --no-cache .
$PREFIX docker buildx build --platform linux/amd64,linux/s390x,linux/arm64,linux/ppc64le --tag fullstorydev/grpcurl:${VERSION}-alpine --tag fullstorydev/grpcurl:latest-alpine --push --progress plain --no-cache --target alpine .
# push to GHCR, both the given version as a tag and for "latest" tag
$PREFIX docker buildx build --platform linux/amd64,linux/s390x,linux/arm64,linux/ppc64le --tag ghcr.io/fullstorydev/grpcurl:${VERSION} --tag ghcr.io/fullstorydev/grpcurl:latest --push --progress plain --no-cache .
$PREFIX docker buildx build --platform linux/amd64,linux/s390x,linux/arm64,linux/ppc64le --tag ghcr.io/fullstorydev/grpcurl:${VERSION}-alpine --tag ghcr.io/fullstorydev/grpcurl:latest-alpine --push --progress plain --no-cache --target alpine .
rm VERSION
# Homebrew release
URL="https://github.com/fullstorydev/grpcurl/archive/refs/tags/${VERSION}.tar.gz"
curl -L -o tmp.tgz "$URL"
SHA="$(sha256sum < tmp.tgz | awk '{ print $1 }')"
rm tmp.tgz
HOMEBREW_GITHUB_API_TOKEN="$GITHUB_TOKEN" $PREFIX brew bump-formula-pr --url "$URL" --sha256 "$SHA" grpcurl
#
# Nothing to do. Homebrew's tooling polls for new releases and opens the
# homebrew-core bump PR on its own. See releasing/README.md.