mirror of
https://github.com/logos-co/logos-modules-release.git
synced 2026-08-27 20:51:14 +00:00
Siddarth Kumar
df63284265
This brings in https://github.com/logos-co/logos-modules-release-action/pull/12
87 lines
3.8 KiB
YAML
87 lines
3.8 KiB
YAML
name: _release-module
|
|
|
|
# Local reusable workflow — the single place that owns this catalog's
|
|
# signing configuration. Every per-module workflow (release-<repo>.yml)
|
|
# and the umbrella (release-all.yml) delegate here, so switching signing
|
|
# modes only means editing THIS file, never the callers.
|
|
#
|
|
# The leading underscore marks it "private": it has only `workflow_call`
|
|
# (no `workflow_dispatch`), so it never shows up as a runnable item in
|
|
# the Actions UI. It can only be invoked from a sibling workflow via
|
|
# `uses: ./.github/workflows/_release-module.yml`.
|
|
#
|
|
# ── Signing modes ────────────────────────────────────────────────────
|
|
# This catalog publishes UNSIGNED (`signing_mode: none`) — matching the
|
|
# empty `trustedSigners` in logos-repo.json. Turn on signing when ready:
|
|
#
|
|
# inline — `lgx sign` runs in the workflow using a JWK secret.
|
|
# 1. Generate an Ed25519 JWK private key.
|
|
# 2. Add it as the `LOGOS_SIGNING_KEY` Actions secret.
|
|
# 3. Uncomment the `signing_mode: inline` line + the
|
|
# `secrets:` block below; delete `signing_mode: none`.
|
|
# 4. Put the matching public DID in `logos-repo.json`
|
|
# under `trustedSigners`.
|
|
#
|
|
# external — a signing rig you control (Jenkins, HSM, hardware token)
|
|
# produces the signed `.lgx`; the key never touches CI.
|
|
# Uncomment the external block; `signing_command` runs with
|
|
# $LGX_PATH (unsigned input) and must either modify it in
|
|
# place or write the signed result to $LGX_SIGNED_OUT.
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
module_path:
|
|
description: "Path to the module submodule (e.g. submodules/<repo>)."
|
|
type: string
|
|
required: true
|
|
force_build:
|
|
description: |
|
|
Force build — rebuild and REPLACE the already-published
|
|
`<module>-v<version>` release instead of skipping it. Maps to
|
|
the action's `skip_if_published` (inverted): false (default) =
|
|
skip a version that's already fully published; true = republish
|
|
the same version, overwriting its assets.
|
|
type: boolean
|
|
default: false
|
|
|
|
# Forked repos default to a read-only GITHUB_TOKEN; the downstream
|
|
# release job needs to create releases / upload assets.
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
release:
|
|
uses: logos-co/logos-modules-release-action/.github/workflows/release.yml@v1.1
|
|
with:
|
|
module_path: ${{ inputs.module_path }}
|
|
|
|
# Normal runs skip a version that's already fully published; "Force
|
|
# build" (force_build: true) republishes it by disabling that skip.
|
|
skip_if_published: ${{ !inputs.force_build }}
|
|
|
|
# ─── Signing mode (edit here, not in each caller) ────────────────
|
|
signing_mode: none
|
|
|
|
# Inline signing — uncomment these two lines (and the `secrets:`
|
|
# block at the bottom), then delete `signing_mode: none` above.
|
|
#signing_mode: inline
|
|
|
|
# External signing (Jenkins / HSM / hardware token). Uncomment and
|
|
# delete `signing_mode: none`. `signing_command` runs with
|
|
# $LGX_PATH pointing at the unsigned `.lgx`; it must modify that
|
|
# file in place or write the signed package to $LGX_SIGNED_OUT.
|
|
#
|
|
# signing_mode: external
|
|
# signing_command: |
|
|
# curl -fsSL -X POST --data-binary @"$LGX_PATH" \
|
|
# -H "X-Build-Id: ${GITHUB_RUN_ID}" \
|
|
# -o "$LGX_SIGNED_OUT" \
|
|
# "$JENKINS_SIGNING_URL"
|
|
|
|
# Inline mode reads this; none/external ignore it. Wired via
|
|
# `secrets: inherit` from each caller so the per-module files don't
|
|
# need to know which secret names matter. Uncomment for inline mode.
|
|
#secrets:
|
|
# signing_key: ${{ secrets.LOGOS_SIGNING_KEY }}
|