ci: speed up the release loop (#18) #62
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: | |
| - main | |
| # Fallback only: a GITHUB_TOKEN merge of the version PR does not emit push. | |
| # PAT merges (the usual path) already fire the push event above — do not | |
| # also handle those here or two publishes race. | |
| pull_request: | |
| types: [closed] | |
| branches: | |
| - main | |
| # One publish at a time. Do not cancel an in-flight npm publish. | |
| concurrency: | |
| group: release-${{ github.repository }} | |
| cancel-in-progress: false | |
| jobs: | |
| release: | |
| name: Release | |
| runs-on: ubuntu-latest | |
| if: > | |
| github.repository_owner == 'wangyuling93' && | |
| (github.event_name == 'push' || | |
| (github.event_name == 'pull_request' && | |
| github.event.pull_request.merged == true && | |
| github.event.pull_request.head.ref == 'changeset-release/main' && | |
| github.event.pull_request.merged_by.login == 'github-actions[bot]')) | |
| outputs: | |
| packages_published: ${{ steps.changesets.outputs.published }} | |
| kimi_native_release: ${{ steps.kimi-release.outputs.should_publish }} | |
| kimi_release_tag: ${{ steps.kimi-release.outputs.tag }} | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| id-token: write # Required for NPM Trusted Publishing (OIDC) | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| # On pull_request (closed) events the checkout defaults to the PR | |
| # merge ref; always base the release on main's post-merge state. | |
| ref: main | |
| # checkout's default extraheader uses the job GITHUB_TOKEN and beats | |
| # changesets/action's .netrc PAT, so version-PR updates are pushed | |
| # as github-actions[bot] and CI sits in action_required. Leave | |
| # credentials unset; the action writes .netrc from CHANGESETS_TOKEN. | |
| persist-credentials: false | |
| - name: Detect release mode | |
| id: mode | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| run: | | |
| set -euo pipefail | |
| has_changesets=false | |
| if find .changeset -maxdepth 1 -name '*.md' ! -name 'README.md' | grep -q .; then | |
| has_changesets=true | |
| fi | |
| is_release_merge=false | |
| subject=$(git log -1 --format=%s) | |
| if [ "$EVENT_NAME" = "pull_request" ]; then | |
| is_release_merge=true | |
| elif [[ "$subject" == *"changeset-release/main"* ]]; then | |
| is_release_merge=true | |
| elif [ "$subject" = "ci: release packages" ]; then | |
| is_release_merge=true | |
| fi | |
| if [ "$has_changesets" = true ]; then | |
| echo "mode=version" >> "$GITHUB_OUTPUT" | |
| elif [ "$is_release_merge" = true ]; then | |
| echo "mode=publish" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "mode=skip" >> "$GITHUB_OUTPUT" | |
| fi | |
| echo "mode has_changesets=$has_changesets is_release_merge=$is_release_merge subject=$subject" | |
| - name: Setup pnpm | |
| if: steps.mode.outputs.mode != 'skip' | |
| uses: pnpm/action-setup@v6 | |
| - name: Setup Node.js | |
| if: steps.mode.outputs.mode != 'skip' | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: "pnpm" | |
| registry-url: "https://registry.npmjs.org" | |
| - name: Upgrade npm for Trusted Publishing | |
| if: steps.mode.outputs.mode == 'publish' | |
| run: npm install -g npm@11 | |
| - name: Install dependencies | |
| if: steps.mode.outputs.mode != 'skip' | |
| run: pnpm install --frozen-lockfile | |
| - name: Generate Kimi Code built-in catalog | |
| if: steps.mode.outputs.mode == 'publish' | |
| shell: bash | |
| run: | | |
| CATALOG_FILE="$RUNNER_TEMP/kimi-code-built-in-catalog.json" | |
| node apps/kimi-code/scripts/update-catalog.mjs --out "$CATALOG_FILE" | |
| echo "KIMI_CODE_BUILT_IN_CATALOG_FILE=$CATALOG_FILE" >> "$GITHUB_ENV" | |
| - name: Build packages | |
| if: steps.mode.outputs.mode == 'publish' | |
| run: pnpm build | |
| - name: Create Release Pull Request or Publish to npm | |
| id: changesets | |
| if: steps.mode.outputs.mode != 'skip' | |
| uses: changesets/action@v1 | |
| with: | |
| publish: pnpm changeset publish | |
| version: pnpm run version:release | |
| commit: "ci: release packages" | |
| title: "ci: release packages" | |
| commitMode: git-cli | |
| # Use the maintainer's PAT so the version PR is authored by a real | |
| # account: PRs created by github-actions[bot] always require manual | |
| # workflow approval (the bot has no contribution history), which | |
| # stalls the auto-merge loop. | |
| github-token: ${{ secrets.CHANGESETS_TOKEN }} | |
| env: | |
| # Same token as the github-token input: changesets/action refuses a | |
| # mismatch between the two. | |
| GITHUB_TOKEN: ${{ secrets.CHANGESETS_TOKEN }} | |
| # Publishing uses npm OIDC trusted publishing (configured on the | |
| # package page); provenance is generated automatically. No token is | |
| # needed — NPM_TOKEN was only used to bootstrap the first publish. | |
| # id-token: write is granted above. | |
| # Auto-merge the version PR once the required CI checks pass. Uses | |
| # GitHub's native auto-merge (repo setting "Allow auto-merge" + | |
| # branch protection requiring status checks); changesets/action has no | |
| # such input of its own. | |
| - name: Enable auto-merge on the version PR | |
| if: steps.mode.outputs.mode != 'skip' && steps.changesets.outputs.pullRequestNumber != '' | |
| run: gh pr merge --repo "$GITHUB_REPOSITORY" --merge --auto "${{ steps.changesets.outputs.pullRequestNumber }}" | |
| env: | |
| # Auto-merge with the maintainer's PAT: merges performed with the | |
| # GITHUB_TOKEN are attributed to github-actions[bot], whose push / | |
| # closed events do not trigger workflows. | |
| GH_TOKEN: ${{ secrets.CHANGESETS_TOKEN }} | |
| - name: Resolve Kimi Code native release | |
| if: steps.changesets.outputs.published == 'true' | |
| id: kimi-release | |
| run: node apps/kimi-code/scripts/native/resolve-release.mjs | |
| env: | |
| CHANGESETS_PUBLISHED_PACKAGES: ${{ steps.changesets.outputs.publishedPackages }} | |
| deploy-docs: | |
| name: Deploy docs | |
| needs: release | |
| if: needs.release.outputs.packages_published == 'true' && github.repository_owner == 'MoonshotAI' | |
| uses: ./.github/workflows/docs-deploy.yml | |
| permissions: | |
| contents: read | |
| pages: write | |
| id-token: write | |
| native-artifacts: | |
| name: Native release artifact | |
| needs: release | |
| if: needs.release.outputs.kimi_native_release == 'true' | |
| uses: ./.github/workflows/_native-build.yml | |
| with: | |
| upload-artifact-prefix: kimi-code-native | |
| retention-days: 7 | |
| sign-macos: true | |
| secrets: | |
| APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| APPLE_NOTARIZATION_KEY_P8: ${{ secrets.APPLE_NOTARIZATION_KEY_P8 }} | |
| APPLE_NOTARIZATION_KEY_ID: ${{ secrets.APPLE_NOTARIZATION_KEY_ID }} | |
| APPLE_NOTARIZATION_ISSUER_ID: ${{ secrets.APPLE_NOTARIZATION_ISSUER_ID }} | |
| publish-native-assets: | |
| name: Publish native release assets | |
| needs: | |
| - release | |
| - native-artifacts | |
| if: needs.release.outputs.kimi_native_release == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Download native artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| pattern: kimi-code-native-* | |
| path: dist-native-release | |
| merge-multiple: true | |
| - name: Produce manifest.json | |
| env: | |
| RELEASE_TAG: ${{ needs.release.outputs.kimi_release_tag }} | |
| run: node apps/kimi-code/scripts/native/produce-manifest.mjs dist-native-release "$RELEASE_TAG" | |
| - name: Upload assets to GitHub Release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASE_TAG: ${{ needs.release.outputs.kimi_release_tag }} | |
| run: gh release upload "$RELEASE_TAG" dist-native-release/* --clobber |