Release to Production #84
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release to Production | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| version_bump: | |
| description: 'Version bump type' | |
| required: true | |
| default: 'patch' | |
| type: choice | |
| options: | |
| - patch | |
| - minor | |
| - major | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout main branch | |
| uses: actions/checkout@v6 | |
| with: | |
| ref: main | |
| fetch-depth: 0 | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: 1.3.6 | |
| - name: Configure Git | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| - name: Get latest tag and calculate next version | |
| id: version | |
| run: | | |
| # Get the latest tag, default to v0.0.0 if none exists | |
| LATEST_TAG=$(git tag --list 'v*' --sort=-v:refname | head -n1) | |
| if [ -z "$LATEST_TAG" ]; then | |
| LATEST_TAG="v0.0.0" | |
| fi | |
| echo "Latest tag: $LATEST_TAG" | |
| # Parse version numbers | |
| VERSION=${LATEST_TAG#v} | |
| MAJOR=$(echo $VERSION | cut -d. -f1) | |
| MINOR=$(echo $VERSION | cut -d. -f2) | |
| PATCH=$(echo $VERSION | cut -d. -f3) | |
| # Increment based on input | |
| case "${{ inputs.version_bump }}" in | |
| major) | |
| MAJOR=$((MAJOR + 1)) | |
| MINOR=0 | |
| PATCH=0 | |
| ;; | |
| minor) | |
| MINOR=$((MINOR + 1)) | |
| PATCH=0 | |
| ;; | |
| patch) | |
| PATCH=$((PATCH + 1)) | |
| ;; | |
| esac | |
| NEW_VERSION="v${MAJOR}.${MINOR}.${PATCH}" | |
| echo "New version: $NEW_VERSION" | |
| echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT | |
| - name: Merge any release-only commits back into main | |
| run: | | |
| git fetch origin release:release || true | |
| # Check if release branch exists | |
| if git show-ref --verify --quiet refs/heads/release; then | |
| # Check if release has commits not in main | |
| AHEAD=$(git rev-list --count main..release) | |
| if [ "$AHEAD" -gt 0 ]; then | |
| echo "⚠️ release branch is $AHEAD commit(s) ahead of main (hotfixes pushed directly to release)" | |
| echo "Merging release commits back into main to preserve them..." | |
| if ! git merge release --no-edit -m "chore: merge release hotfixes back into main"; then | |
| echo "❌ Merge failed due to conflicts. Resolve conflicts manually, then re-run this workflow." | |
| git merge --abort | |
| exit 1 | |
| fi | |
| git push origin main | |
| echo "✅ Successfully merged $AHEAD release commit(s) into main" | |
| fi | |
| fi | |
| - name: Fast-forward release to main | |
| run: | | |
| # Create or update release branch to match main exactly | |
| git checkout -B release origin/main | |
| git push origin release --force-with-lease | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Sync production worker secret | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| run: | | |
| printf '%s' "${{ secrets.BLOOMSTUDIO_WORKER_SHARED_SECRET }}" | bunx wrangler secret put BLOOMSTUDIO_WORKER_SHARED_SECRET --env production | |
| - name: Deploy production Cloudflare worker | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| run: bun run cf:deploy:prod | |
| - name: Create and push tag | |
| run: | | |
| git tag -a ${{ steps.version.outputs.new_version }} -m "Release ${{ steps.version.outputs.new_version }}" | |
| git push origin ${{ steps.version.outputs.new_version }} | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@v2.5.0 | |
| with: | |
| tag_name: ${{ steps.version.outputs.new_version }} | |
| name: Release ${{ steps.version.outputs.new_version }} | |
| generate_release_notes: true |