Skip to content

ci(release): move release-please off the shared-cache ARC pool (LAB-1040) #74

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
27Bslash6 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci(release): move release-please off the shared-cache ARC pool (LAB-1040) #74

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 13 additions & 7 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,14 @@ concurrency:
cancel-in-progress: false

jobs:
# GitHub-hosted: this job inherits contents+PR write and mints an App
# installation token. The self-hosted `cachekit` pool shares a writable
# hostPath build cache (/cache) across all pods and every cachekit-io repo,
# and job-level `permissions:` does not isolate that filesystem — untrusted
# build-script/proc-macro code can poison the cache a later credentialed
# job runs against (LAB-1040). release-please needs no warm cache anyway.
release-please:
runs-on: cachekit
runs-on: ubuntu-latest
Comment thread
27Bslash6 marked this conversation as resolved.
outputs:
release_created: ${{ steps.release.outputs.release_created }}
tag_name: ${{ steps.release.outputs.tag_name }}
Expand All @@ -41,8 +47,9 @@ jobs:
# release PR here. outputs.pr is set whenever the release PR was created
# OR updated, so this re-runs on every push to main while a release PR is
# open — adding an already-present assignee is a no-op, so that's safe.
# github-script, NOT `gh`: the self-hosted cachekit runner has no gh CLI
# (LAB-899). outputs.pr is passed raw via env and parsed in JS — never
# github-script, NOT `gh`: chosen when this job ran on the self-hosted
# cachekit runner, which has no gh CLI (LAB-899); it works identically on
# a hosted runner. outputs.pr is passed raw via env and parsed in JS — never
# through template-position fromJson, which is evaluated even when if: is
# false and crashes on '' for no-release pushes (LAB-865).
- name: Assign release PR to 27Bslash6
Expand Down Expand Up @@ -103,10 +110,9 @@ jobs:
subject-path: target/package/*.crate

- name: Install cargo-sbom
# --force is required: the self-hosted runner's CARGO_HOME (/cache/cargo) is a
# persistent volume, so the binary survives between runs and a plain install
# exits 101 ("binary `cargo-sbom` already exists"). --force reinstalls the
# --locked pinned version idempotently.
# --force kept from when this job ran self-hosted with a persistent
# CARGO_HOME (/cache/cargo), where a plain install exits 101 ("binary
# `cargo-sbom` already exists"). Harmless no-op cost on a hosted runner.
run: cargo install cargo-sbom --locked --force

- name: Generate SBOM
Expand Down
Loading