Skip to content

Commit 0a1c2bf

Browse files
ActoryOuActoryOu
committed
Follow Security Guide to update release.yml
1 parent f1827d8 commit 0a1c2bf

File tree

1 file changed

+57
-54
lines changed

1 file changed

+57
-54
lines changed

‎.github/workflows/release.yml‎

Lines changed: 57 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,16 @@ env:
1919
repository_zip_name: ${{ github.event.repository.name }}-${{ github.event.inputs.version_number }}.zip
2020
# Source folder list for version number updates
2121
source_folder_list: "source test"
22+
repository_name: ${{ github.event.repository.name }}
23+
version_number: ${{ github.event.inputs.version_number }}
24+
actor: ${{ github.actor }}
25+
commit_id: ${{ github.event.inputs.commit_id }}
2226

2327
jobs:
2428
clean-existing-tag-and-release:
2529
if: ${{ github.event.inputs.delete_existing_tag_release == 'true' }}
2630
runs-on: ubuntu-latest
2731
env:
28-
VERSION_NUM: ${{ github.event.inputs.version_number }}
2932
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3033
steps:
3134
- name: Checkout code
@@ -34,10 +37,10 @@ jobs:
3437
- name: Check if tag exists
3538
run: |
3639
git fetch origin
37-
if git tag --list $VERSION_NUM
40+
if git tag --list ${{ env.version_number }}
3841
then
39-
echo "Deleting existing tag for $VERSION_NUM"
40-
git push origin --delete tags/$VERSION_NUM
42+
echo "Deleting existing tag for ${{ env.version_number }}"
43+
git push origin --delete tags/${{ env.version_number }}
4144
fi
4245
4346
- name: Check if release exists
@@ -46,10 +49,10 @@ jobs:
4649
sudo apt-add-repository https://cli.github.com/packages
4750
sudo apt update
4851
sudo apt-get install gh
49-
if gh release list | grep $VERSION_NUM
52+
if gh release list | grep ${{ env.version_number }}
5053
then
51-
echo "Deleting existing release for $VERSION_NUM"
52-
gh release delete --yes $VERSION_NUM
54+
echo "Deleting existing release for ${{ env.version_number }}
55+
gh release delete --yes ${{ env.version_number }}
5356
fi
5457
5558
add-sbom-and-tag-commit:
@@ -61,47 +64,47 @@ jobs:
6164
- name: Checkout code
6265
uses: actions/checkout@v4
6366
with:
64-
ref: ${{ github.event.inputs.commit_id }}
67+
ref: ${{ env.commit_id }}
6568

6669
- name: Configure git identity
6770
run: |
68-
git config --global user.name ${{ github.actor }}
69-
git config --global user.email ${{ github.actor }}@users.noreply.github.com
71+
git config --global user.name ${{ env.actor }}
72+
git config --global user.email ${{ env.actor }}@users.noreply.github.com
7073
7174
- name: create a new branch that references commit id
72-
run: git checkout -b ${{ github.event.inputs.version_number }} ${{ github.event.inputs.commit_id }}
75+
run: git checkout -b ${{ env.version_number }} ${{ env.commit_id }}
7376

7477
- name: Update version number in source files
7578
run: |
7679
echo "${{ env.source_folder_list }}" | \
7780
xargs -n 1 sh -c \
7881
'find $1 -type f \( -name "*.c" -o -name "*.h" \) \
79-
-exec sed -i -b -E "0,/^ \* ${{ github.event.repository.name }}/s/^ \* ${{ github.event.repository.name }}.*/ \* ${{ github.event.repository.name }} ${{ github.event.inputs.version_number }}/g" {} +'
82+
-exec sed -i -b -E "0,/^ \* ${{ env.repository_name }}/s/^ \* ${{ env.repository_name }}.*/ \* ${{ env.repository_name }} ${{ env.version_number }}/g" {} +'
8083
git add .
8184
git commit -m '[AUTO][RELEASE]: Update version number in source files'
82-
git push -u origin ${{ github.event.inputs.version_number }}
85+
git push -u origin ${{ env.version_number }}
8386
8487
- name : Update version number in manifest.yml
8588
run: |
86-
sed -i -b '0,/^version/s/^version.*/version: "${{ github.event.inputs.version_number }}"/g' ./manifest.yml
89+
sed -i -b '0,/^version/s/^version.*/version: "${{ env.version_number }}"/g' ./manifest.yml
8790
git add .
8891
git commit -m '[AUTO][RELEASE]: Update version number in manifest.yml'
89-
git push -u origin ${{ github.event.inputs.version_number }}
92+
git push -u origin ${{ env.version_number }}
9093
9194
- name : Update version number in doxygen
9295
run: |
93-
sed -i -b 's/PROJECT_NUMBER *=.*/PROJECT_NUMBER = ${{ github.event.inputs.version_number }}/g' ./docs/doxygen/config.doxyfile
96+
sed -i -b 's/PROJECT_NUMBER *=.*/PROJECT_NUMBER = ${{ env.version_number }}/g' ./docs/doxygen/config.doxyfile
9497
git add .
9598
git commit -m '[AUTO][RELEASE]: Update version number in doxygen'
96-
git push -u origin ${{ github.event.inputs.version_number }}
99+
git push -u origin ${{ env.version_number }}
97100
98101
- name : Update MQTT version number macro
99-
if: ${{ github.event.repository.name == 'coreMQTT' }}
102+
if: ${{ env.repository_name == 'coreMQTT' }}
100103
run: |
101-
sed -i -b 's/^\#define MQTT_LIBRARY_VERSION .*/\#define MQTT_LIBRARY_VERSION "${{ github.event.inputs.version_number }}"/g' source/include/core_mqtt.h
104+
sed -i -b 's/^\#define MQTT_LIBRARY_VERSION .*/\#define MQTT_LIBRARY_VERSION "${{ env.version_number }}"/g' source/include/core_mqtt.h
102105
git add .
103106
git commit -m '[AUTO][RELEASE]: Update version number macro in source/include/core_mqtt.h'
104-
git push -u origin ${{ github.event.inputs.version_number }}
107+
git push -u origin ${{ env.version_number }}
105108
106109
- name: Generate SBOM
107110
uses: FreeRTOS/CI-CD-Github-Actions/sbom-generator@main
@@ -113,19 +116,19 @@ jobs:
113116
run: |
114117
git add .
115118
git commit -m 'Update SBOM'
116-
git push -u origin ${{ github.event.inputs.version_number }}
119+
git push -u origin ${{ env.version_number }}
117120
118121
- name: Tag Commit and Push to remote
119122
run: |
120-
git tag ${{ github.event.inputs.version_number }} -a -m "${{ github.event.repository.name }} Library ${{ github.event.inputs.version_number }}"
123+
git tag ${{ env.version_number }} -a -m "${{ env.repository_name }} Library ${{ env.version_number }}"
121124
git push origin --tags
122125
123126
- name: Verify tag on remote
124127
run: |
125-
git tag -d ${{ github.event.inputs.version_number }}
128+
git tag -d ${{ env.version_number }}
126129
git remote update
127-
git checkout tags/${{ github.event.inputs.version_number }}
128-
git diff ${{ github.event.inputs.commit_id }} tags/${{ github.event.inputs.version_number }}
130+
git checkout tags/${{ env.version_number }}
131+
git diff ${{ env.commit_id }} tags/${{ env.version_number }}
129132
130133
create-zip:
131134
if: ${{ ( github.event.inputs.delete_existing_tag_release == 'true' && success() ) || ( github.event.inputs.delete_existing_tag_release == 'false' && always() ) }}
@@ -139,18 +142,18 @@ jobs:
139142
- name: Checkout code
140143
uses: actions/checkout@v4
141144
with:
142-
ref: ${{ github.event.inputs.version_number }}
143-
path: ${{ github.event.repository.name }}
145+
ref: ${{ env.version_number }}
146+
path: ${{ env.repository_name }}
144147
submodules: recursive
145148

146149
- name: Checkout disabled submodules
147150
run: |
148-
cd ${{ github.event.repository.name }}
151+
cd ${{ env.repository_name }}
149152
git submodule update --init --checkout --recursive
150153
151154
- name: Create ZIP
152155
run: |
153-
zip -r ${{ env.repository_zip_name }} ${{ github.event.repository.name }} -x "*.git*"
156+
zip -r ${{ env.repository_zip_name }} ${{ env.repository_name }} -x "*.git*"
154157
ls ./
155158
156159
- name: Validate created ZIP
@@ -160,66 +163,66 @@ jobs:
160163
cd zip-check
161164
unzip ${{ env.repository_zip_name }} -d ${{ env.repository_compressed_name }}
162165
ls ${{ env.repository_compressed_name }}
163-
diff -r -x "*.git*" ${{ env.repository_compressed_name }}/${{ github.event.repository.name }}/ ../${{ github.event.repository.name }}/
166+
diff -r -x "*.git*" ${{ env.repository_compressed_name }}/${{ env.repository_name }}/ ../${{ env.repository_name }}/
164167
cd ../
165168
166169
- name: Check version number in source files
167170
run: |
168-
cd zip-check/${{ env.repository_compressed_name }}/${{ github.event.repository.name }}
171+
cd zip-check/${{ env.repository_compressed_name }}/${{ env.repository_name }}
169172
170173
# List all the *.h *.c files in <source_folder_list>
171174
SOURCE_FILE_LIST=$( echo "${{ env.source_folder_list }}" | \
172175
xargs -n 1 sh -c 'find $1 -type f \( -name "*.c" -o -name "*.h" \)' )
173176
174177
# List all the files which contain " * <repository_name>.*" in SOURCE_FILE_LIST
175-
SOURCE_FILE_WITH_VERSION_LIST=$( grep -l " \* ${{ github.event.repository.name }}.*" $SOURCE_FILE_LIST )
178+
SOURCE_FILE_WITH_VERSION_LIST=$( grep -l " \* ${{ env.repository_name }}.*" $SOURCE_FILE_LIST )
176179
177180
# Compare the <version_number> with input version number in files in SOURCE_FILE_LIST
178181
echo $SOURCE_FILE_WITH_VERSION_LIST | xargs -I{} sh -c \
179-
'grep -x " \* ${{ github.event.repository.name }} ${{ github.event.inputs.version_number }}" {} && \
180-
echo {} : match ${{ github.event.repository.name }} ${{ github.event.inputs.version_number }} || \
181-
{ echo "{} : ${{ github.event.repository.name }} ${{ github.event.inputs.version_number }} not found"; exit 255; }'
182+
'grep -x " \* ${{ env.repository_name }} ${{ env.version_number }}" {} && \
183+
echo {} : match ${{ env.repository_name }} ${{ env.version_number }} || \
184+
{ echo "{} : ${{ env.repository_name }} ${{ env.version_number }} not found"; exit 255; }'
182185
183186
- name: Check version number in doxygen
184187
run: |
185-
cd zip-check/${{ env.repository_compressed_name }}/${{ github.event.repository.name }}
188+
cd zip-check/${{ env.repository_compressed_name }}/${{ env.repository_name }}
186189
187190
# find "PROJECT_NUMBER = <version_number>"
188191
DOXYGEN_VERSION_NUMBER=$(grep -x "[ ]*PROJECT_NUMBER[ ]*=[ ]*[^ ]*[ ]*" docs/doxygen/config.doxyfile | awk -F= '{gsub(" ","",$2); print $2 }');
189192
190193
# compare the <version_number> with input version number
191-
[[ $DOXYGEN_VERSION_NUMBER == "${{ github.event.inputs.version_number }}" ]] \
192-
&& echo "config.doxyfile : match ${{ github.event.inputs.version_number }}" \
193-
|| { echo "config.doxyfile : $DOXYGEN_VERSION_NUMBER doesn't match ${{ github.event.inputs.version_number }}"; exit 255; }
194+
[[ $DOXYGEN_VERSION_NUMBER == "${{ env.version_number }}" ]] \
195+
&& echo "config.doxyfile : match ${{ env.version_number }}" \
196+
|| { echo "config.doxyfile : $DOXYGEN_VERSION_NUMBER doesn't match ${{ env.version_number }}"; exit 255; }
194197
195198
- name: Check version number in manifest.yml
196199
run: |
197-
cd zip-check/${{ env.repository_compressed_name }}/${{ github.event.repository.name }}
200+
cd zip-check/${{ env.repository_compressed_name }}/${{ env.repository_name }}
198201
199202
# find the first occurence of "version: <version_number>" and comare the <version_number> with input version number
200203
MANIFEST_VESION_NUMBER=$( grep -m 1 -E "^version:[ ]*\".*\"[ ]*" manifest.yml | awk -F: '{ gsub(" ","",$2); gsub("\"","",$2); print $2 }' );
201204
202205
# compare the <version_number> with input version number
203-
[[ $MANIFEST_VESION_NUMBER == "${{ github.event.inputs.version_number }}" ]] \
204-
&& echo "manifest.yml : match ${{ github.event.inputs.version_number }}" \
205-
|| { echo "manifest.yml : $MANIFEST_VESION_NUMBER doesn't match ${{ github.event.inputs.version_number }}"; exit 255; }
206+
[[ $MANIFEST_VESION_NUMBER == "${{ env.version_number }}" ]] \
207+
&& echo "manifest.yml : match ${{ env.version_number }}" \
208+
|| { echo "manifest.yml : $MANIFEST_VESION_NUMBER doesn't match ${{ env.version_number }}"; exit 255; }
206209
207210
- name: Check MQTT version number macro in header file
208-
if: ${{ github.event.repository.name == 'coreMQTT' }}
211+
if: ${{ env.repository_name == 'coreMQTT' }}
209212
run: |
210-
cd zip-check/${{ env.repository_compressed_name }}/${{ github.event.repository.name }}
213+
cd zip-check/${{ env.repository_compressed_name }}/${{ env.repository_name }}
211214
212215
# find "#define MQTT_LIBRARY_VERSION <version_number>" in core_mqtt.h
213216
MACRO_VERSION_NUMBER=$(grep -x "^\#define[ ]*MQTT_LIBRARY_VERSION[ ]*\".*\"[ ]*" source/include/core_mqtt.h | awk '{gsub("\"","",$3); print $3 }');
214217
215218
# compare the <version_number> with input version number
216-
[[ $MACRO_VERSION_NUMBER == "${{ github.event.inputs.version_number }}" ]] \
217-
&& echo "core_mqtt.h : match ${{ github.event.inputs.version_number }}" \
218-
|| { echo "core_mqtt.h : $MACRO_VERSION_NUMBER doesn't match ${{ github.event.inputs.version_number }}"; exit 255; }
219+
[[ $MACRO_VERSION_NUMBER == "${{ env.version_number }}" ]] \
220+
&& echo "core_mqtt.h : match ${{ env.version_number }}" \
221+
|| { echo "core_mqtt.h : $MACRO_VERSION_NUMBER doesn't match ${{ env.version_number }}"; exit 255; }
219222
220223
- name: Build
221224
run: |
222-
cd zip-check/${{ env.repository_compressed_name }}/${{ github.event.repository.name }}
225+
cd zip-check/${{ env.repository_compressed_name }}/${{ env.repository_name }}
223226
sudo apt-get install -y lcov
224227
cmake -S test -B build/ \
225228
-G "Unix Makefiles" \
@@ -230,7 +233,7 @@ jobs:
230233
231234
- name: Test
232235
run: |
233-
cd zip-check/${{ env.repository_compressed_name }}/${{ github.event.repository.name }}/build/
236+
cd zip-check/${{ env.repository_compressed_name }}/${{ env.repository_name }}/build/
234237
ctest -E system --output-on-failure
235238
cd ..
236239
@@ -249,7 +252,7 @@ jobs:
249252
- name: Doxygen generation
250253
uses: FreeRTOS/CI-CD-Github-Actions/doxygen-generation@main
251254
with:
252-
ref: ${{ github.event.inputs.version_number }}
255+
ref: ${{ env.version_number }}
253256
add_release: "true"
254257

255258
create-release:
@@ -266,9 +269,9 @@ jobs:
266269
env:
267270
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
268271
with:
269-
tag_name: ${{ github.event.inputs.version_number }}
270-
release_name: ${{ github.event.inputs.version_number }}
271-
body: Release ${{ github.event.inputs.version_number }} of the ${{ github.event.repository.name }} Library.
272+
tag_name: ${{ env.version_number }}
273+
release_name: ${{ env.version_number }}
274+
body: Release ${{ env.version_number }} of the ${{ env.repository_name }} Library.
272275
draft: false
273276
prerelease: false
274277

0 commit comments

Comments
 (0)