Update Arcane Release Assets #1748
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Update Arcane Release Assets | |
| on: | |
| schedule: | |
| - cron: '*/30 * * * *' | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| id-token: write | |
| jobs: | |
| update-release-assets: | |
| if: ${{ github.repository_owner != 'getarcaneapp' && github.actor != 'getarcaneappbot' }} | |
| runs-on: depot-ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Fetch releases list | |
| id: releases | |
| run: | | |
| set -euo pipefail | |
| RELEASES_JSON=/tmp/releases.json | |
| curl -sSL \ | |
| -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \ | |
| -H "Accept: application/vnd.github+json" \ | |
| "https://api.github.com/repos/getarcaneapp/arcane/releases?per_page=100" \ | |
| -o "$RELEASES_JSON" | |
| echo "releases_json=$RELEASES_JSON" >> "$GITHUB_OUTPUT" | |
| - name: Check current assets | |
| id: check | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| RELEASES_JSON="${{ steps.releases.outputs.releases_json }}" | |
| VERSION=$(jq -r '[.[] | select(.draft == false and .prerelease == false)][0].tag_name // ""' "$RELEASES_JSON") | |
| if [[ -z "$VERSION" ]]; then | |
| echo "No releases found in $RELEASES_JSON" >&2 | |
| exit 1 | |
| fi | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| CHANGELOG_UP_TO_DATE=false | |
| shopt -s nullglob | |
| CHANGELOG_FILES=(content/changelog/*.md) | |
| if (( ${#CHANGELOG_FILES[@]} > 0 )); then | |
| CHANGELOG_UP_TO_DATE=true | |
| while IFS= read -r tag; do | |
| if ! grep -qE "^##[[:space:]]+$tag\\b" "${CHANGELOG_FILES[@]}"; then | |
| CHANGELOG_UP_TO_DATE=false | |
| break | |
| fi | |
| done < <(jq -r '.[] | select(.draft == false and .prerelease == false) | .tag_name' "$RELEASES_JSON") | |
| fi | |
| SBOM_UP_TO_DATE=false | |
| if [[ -f static/sbom/version.txt ]]; then | |
| CURRENT=$(cat static/sbom/version.txt) | |
| if [[ "$CURRENT" == "$VERSION" ]]; then | |
| SBOM_UP_TO_DATE=true | |
| fi | |
| fi | |
| if [[ "$CHANGELOG_UP_TO_DATE" == "true" && "$SBOM_UP_TO_DATE" == "true" ]]; then | |
| echo "skip_all=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "skip_all=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| if [[ "$CHANGELOG_UP_TO_DATE" == "true" ]]; then | |
| echo "do_changelog=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "do_changelog=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| if [[ "$SBOM_UP_TO_DATE" == "true" ]]; then | |
| echo "do_sbom=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "do_sbom=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Update changelog | |
| if: steps.check.outputs.do_changelog == 'true' | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| RELEASES_JSON="${{ steps.releases.outputs.releases_json }}" REPO="getarcaneapp/arcane" CHANGELOG_DIR="content/changelog" bash scripts/update-changelog.sh | |
| - name: Checkout arcane repo | |
| if: steps.check.outputs.do_sbom == 'true' | |
| uses: actions/checkout@v6 | |
| with: | |
| repository: getarcaneapp/arcane | |
| ref: ${{ steps.check.outputs.version }} | |
| path: arcane | |
| fetch-depth: 1 | |
| - name: Set up Go | |
| if: steps.check.outputs.do_sbom == 'true' | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: arcane/go.mod | |
| - name: Set up just | |
| if: steps.check.outputs.do_sbom == 'true' | |
| uses: extractions/setup-just@v4 | |
| - name: Generate config.json | |
| if: steps.check.outputs.do_sbom == 'true' | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| cd arcane | |
| just docs config output=../static/config.json | |
| - name: Set up Depot CLI | |
| if: steps.check.outputs.do_sbom == 'true' | |
| uses: depot/setup-action@v1 | |
| - name: Generate SBOM for manager image | |
| if: steps.check.outputs.do_sbom == 'true' | |
| uses: depot/build-push-action@v1 | |
| with: | |
| project: np622krb2x | |
| context: arcane | |
| file: arcane/docker/Dockerfile | |
| platforms: linux/amd64,linux/arm64 | |
| push: false | |
| sbom: true | |
| sbom-dir: sbom-output/manager | |
| build-args: | | |
| VERSION=${{ steps.check.outputs.version }} | |
| REVISION=sbom-generation | |
| - name: Generate SBOM for agent image | |
| if: steps.check.outputs.do_sbom == 'true' | |
| uses: depot/build-push-action@v1 | |
| with: | |
| project: np622krb2x | |
| context: arcane | |
| file: arcane/docker/Dockerfile-agent | |
| platforms: linux/amd64,linux/arm64 | |
| push: false | |
| sbom: true | |
| sbom-dir: sbom-output/agent | |
| build-args: | | |
| VERSION=${{ steps.check.outputs.version }} | |
| REVISION=sbom-generation | |
| - name: Copy SBOM files and cleanup | |
| if: steps.check.outputs.do_sbom == 'true' | |
| run: | | |
| set -euo pipefail | |
| VERSION="${{ steps.check.outputs.version }}" | |
| mkdir -p static/sbom/manager static/sbom/agent | |
| # Copy expected SBOM files | |
| cp sbom-output/manager/linux_amd64.spdx.json static/sbom/manager/linux_amd64.spdx.json | |
| cp sbom-output/manager/linux_arm64.spdx.json static/sbom/manager/linux_arm64.spdx.json | |
| cp sbom-output/agent/linux_amd64.spdx.json static/sbom/agent/linux_amd64.spdx.json | |
| cp sbom-output/agent/linux_arm64.spdx.json static/sbom/agent/linux_arm64.spdx.json | |
| # Validate + normalize formatting to avoid compact single-line JSON in repo diffs | |
| for file in \ | |
| static/sbom/manager/linux_amd64.spdx.json \ | |
| static/sbom/manager/linux_arm64.spdx.json \ | |
| static/sbom/agent/linux_amd64.spdx.json \ | |
| static/sbom/agent/linux_arm64.spdx.json | |
| do | |
| jq '.' "$file" > "$file.tmp" | |
| mv "$file.tmp" "$file" | |
| done | |
| # Save version | |
| echo "$VERSION" > static/sbom/version.txt | |
| # Create metadata file | |
| cat > static/sbom/metadata.json << EOF | |
| { | |
| "version": "$VERSION", | |
| "updated": "$(date -u +%Y-%m-%dT%H:%M:%SZ)", | |
| "images": { | |
| "manager": { | |
| "name": "ghcr.io/getarcaneapp/arcane", | |
| "architectures": ["linux/amd64", "linux/arm64"], | |
| "sbomFiles": { | |
| "amd64": "/sbom/manager/linux_amd64.spdx.json", | |
| "arm64": "/sbom/manager/linux_arm64.spdx.json" | |
| } | |
| }, | |
| "agent": { | |
| "name": "ghcr.io/getarcaneapp/arcane-headless", | |
| "architectures": ["linux/amd64", "linux/arm64"], | |
| "sbomFiles": { | |
| "amd64": "/sbom/agent/linux_amd64.spdx.json", | |
| "arm64": "/sbom/agent/linux_arm64.spdx.json" | |
| } | |
| } | |
| } | |
| } | |
| EOF | |
| echo "SBOM files generated for $VERSION" | |
| ls -la static/sbom/ | |
| ls -la static/sbom/manager/ | |
| ls -la static/sbom/agent/ | |
| # Clean up cloned repo and build output | |
| rm -rf arcane sbom-output | |
| - name: Check for changes | |
| id: changes | |
| if: steps.check.outputs.skip_all != 'true' | |
| run: | | |
| if [[ -n "$(git status --porcelain -- content/changelog.md content/changelog/ static/config.json static/sbom/)" ]]; then | |
| echo "has_changes=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "has_changes=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Create pull request | |
| if: steps.changes.outputs.has_changes == 'true' | |
| uses: peter-evans/create-pull-request@v8 | |
| with: | |
| token: ${{ secrets.ARCANE_BOT_TOKEN }} | |
| commit-message: 'chore(release): update assets for ${{ steps.check.outputs.version }}' | |
| committer: 'getarcaneappbot <info@getarcane.app>' | |
| author: 'getarcaneappbot <info@getarcane.app>' | |
| signoff: true | |
| title: 'chore(release): update assets for ${{ steps.check.outputs.version }}' | |
| body: | | |
| Updates Arcane release assets for ${{ steps.check.outputs.version }}. | |
| ## Changes | |
| - Changelog entry (if new) | |
| - Generated `static/config.json` (if changed) | |
| - SBOM files for manager and agent images (if new) | |
| --- | |
| *This PR was automatically generated.* | |
| branch: 'chore/release-assets-${{ steps.check.outputs.version }}' | |
| base: main | |
| labels: 'docs(changelog),chore(config),chore(sbom)' | |
| add-paths: | | |
| content/changelog.md | |
| content/changelog/ | |
| static/config.json | |
| static/sbom/ | |
| delete-branch: true |