openemr-devops/.github/workflows/build-release-on-tag.yml at d53af24d7ff4189d70d6f4e0f6ba56bd68eb3265 · openemr/openemr-devops · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
name: Build Release on Tag

# Consumer of the openemr/openemr `openemr-tag` repository_dispatch for
# openemr/openemr-devops#756. When a release-prep PR merges, the conductor
# in openemr/openemr mints a tag and fans out `openemr-tag` to owner repos
# including this one. This workflow derives the build inputs from the
# dispatch payload, looks up the previous release tag for the changelog
# base_ref, and calls the reusable `build-release.yml` to produce the
# distribution packages and GitHub Release that the manual workflow_dispatch
# path already produces.

on:
  repository_dispatch:
    types: [openemr-tag]

permissions:
  contents: read

concurrency:
  # Distinct from the reusable build-release.yml group on purpose. This
  # only collapses duplicate openemr-tag dispatches for the same tag.
  # Serializing the actual build against a manual build-release.yml run is
  # build-release.yml's own concurrency group's job — both entry paths run
  # through it. Sharing its group here would deadlock: this run holds the
  # group while waiting on the called workflow, which would queue behind it.
  group: build-release-on-tag-${{ github.event.client_payload.data.tag }}
  cancel-in-progress: false

jobs:
  derive:
    name: Derive build inputs
    runs-on: ubuntu-24.04
    outputs:
      version: ${{ steps.inputs.outputs.version }}
      version_branch: ${{ steps.inputs.outputs.version_branch }}
      release_tag: ${{ steps.inputs.outputs.release_tag }}
      base_ref: ${{ steps.base.outputs.base_ref }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.5'

      - name: Install Task
        uses: arduino/setup-task@v3

      - name: Install release-tools dependencies
        working-directory: tools/release
        run: composer install --no-interaction --no-progress --prefer-dist

      - name: Derive build inputs
        id: inputs
        working-directory: tools/release
        env:
          CLIENT_PAYLOAD: ${{ toJSON(github.event.client_payload) }}
        run: |
          printf '%s' "${CLIENT_PAYLOAD}" \
              | task release:derive-build-inputs PAYLOAD_FILE='-' \
              >> "${GITHUB_OUTPUT}"

      - name: Derive base_ref from previous release
        id: base
        env:
          GH_TOKEN: ${{ github.token }}
          # Pass the tag through jq --arg, never interpolated into the
          # command, so the value cannot break out of the jq filter.
          RELEASE_TAG: ${{ steps.inputs.outputs.release_tag }}
        run: |
          base_ref=$(gh release list --repo openemr/openemr --exclude-drafts --json tagName,createdAt \
              | jq -r --arg cur "${RELEASE_TAG}" 'map(select(.tagName != $cur)) | sort_by(.createdAt) | last.tagName')
          printf 'base_ref=%s\n' "${base_ref}" >> "${GITHUB_OUTPUT}"

  build:
    name: Build release
    needs: derive
    uses: ./.github/workflows/build-release.yml
    secrets: inherit
    with:
      version: ${{ needs.derive.outputs.version }}
      version_branch: ${{ needs.derive.outputs.version_branch }}
      release_tag: ${{ needs.derive.outputs.release_tag }}
      base_ref: ${{ needs.derive.outputs.base_ref }}
      dry_run: false
      milestone: ''
      skip_milestone_check: true
      skip_ghsa_check: false