You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@opendal.apache.org by xu...@apache.org on 2026/04/27 09:17:22 UTC
(opendal) 01/01: ci: fix release workflows for actions allowlist
This is an automated email from the ASF dual-hosted git repository.
Xuanwo pushed a commit to branch xuanwo/fix-release-workflow-allowlist
in repository https://gitbox.apache.org/repos/asf/opendal.git
commit 6f94052abb6acc28f1d4ffa3cae26d4c133fa96c
Author: Xuanwo <gi...@xuanwo.io>
AuthorDate: Mon Apr 27 17:17:03 2026 +0800
ci: fix release workflows for actions allowlist
---
.github/workflows/ci_bindings_zig.yml | 19 +++++++++++---
.github/workflows/docs.yml | 48 ++++++++++++++++++++++-------------
.github/workflows/release_dotnet.yml | 25 +++++++++++++++---
.github/workflows/release_java.yml | 2 +-
.github/workflows/release_nodejs.yml | 32 +++++++++++++++--------
.github/workflows/release_python.yml | 22 +++++++++-------
.github/workflows/release_ruby.yml | 40 +++++++++++++++++++++++++----
7 files changed, 137 insertions(+), 51 deletions(-)
diff --git a/.github/workflows/ci_bindings_zig.yml b/.github/workflows/ci_bindings_zig.yml
index c9d082b68..213744d04 100644
--- a/.github/workflows/ci_bindings_zig.yml
+++ b/.github/workflows/ci_bindings_zig.yml
@@ -45,9 +45,22 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- - uses: mlugg/setup-zig@fa65c4058643678a4e4a9a60513944a7d8d35440 # v2.1.0
- with:
- version: 0.14.0
+ - name: Setup Zig
+ shell: bash
+ run: |
+ ZIG_VERSION=0.14.0
+ case "$(uname -s)-$(uname -m)" in
+ Linux-x86_64) ZIG_TARGET=x86_64-linux ;;
+ *)
+ echo "unsupported host for Zig: $(uname -s)-$(uname -m)" >&2
+ exit 1
+ ;;
+ esac
+ ZIG_HOME="${RUNNER_TOOL_CACHE}/zig/${ZIG_VERSION}"
+ mkdir -p "${ZIG_HOME}"
+ curl -fsSL "https://ziglang.org/download/${ZIG_VERSION}/zig-${ZIG_TARGET}-${ZIG_VERSION}.tar.xz" \
+ | tar -xJ --strip-components=1 -C "${ZIG_HOME}"
+ echo "${ZIG_HOME}" >> "${GITHUB_PATH}"
- name: Setup Rust toolchain
uses: ./.github/actions/setup
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index bcc92a394..f7cc35b72 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -629,16 +629,22 @@ jobs:
OPENDAL_WEBSITE_NOT_LATEST: true
- name: Deploy to nightlies for tagged version
- uses: burnett01/rsync-deployments@0dc935cdecc5f5e571865e60d2a6cdc673704823
if: ${{ startsWith(github.ref, 'refs/tags/') && !contains(github.ref, 'rc') }}
- with:
- switches: -avzr
- path: website/build/
- remote_path: ${{ secrets.NIGHTLIES_RSYNC_PATH }}/opendal/opendal-docs-release-${{ github.ref_name }}/
- remote_host: ${{ secrets.NIGHTLIES_RSYNC_HOST }}
- remote_port: ${{ secrets.NIGHTLIES_RSYNC_PORT }}
- remote_user: ${{ secrets.NIGHTLIES_RSYNC_USER }}
- remote_key: ${{ secrets.NIGHTLIES_RSYNC_KEY }}
+ shell: bash
+ env:
+ NIGHTLIES_RSYNC_HOST: ${{ secrets.NIGHTLIES_RSYNC_HOST }}
+ NIGHTLIES_RSYNC_KEY: ${{ secrets.NIGHTLIES_RSYNC_KEY }}
+ NIGHTLIES_RSYNC_PATH: ${{ secrets.NIGHTLIES_RSYNC_PATH }}
+ NIGHTLIES_RSYNC_PORT: ${{ secrets.NIGHTLIES_RSYNC_PORT }}
+ NIGHTLIES_RSYNC_USER: ${{ secrets.NIGHTLIES_RSYNC_USER }}
+ run: |
+ mkdir -p "${HOME}/.ssh"
+ printf '%s' "${NIGHTLIES_RSYNC_KEY}" > "${HOME}/.ssh/nightlies_rsync"
+ chmod 0600 "${HOME}/.ssh/nightlies_rsync"
+ rsync -avzr \
+ -e "ssh -i ${HOME}/.ssh/nightlies_rsync -p ${NIGHTLIES_RSYNC_PORT} -o StrictHostKeyChecking=no" \
+ website/build/ \
+ "${NIGHTLIES_RSYNC_USER}@${NIGHTLIES_RSYNC_HOST}:${NIGHTLIES_RSYNC_PATH}/opendal/opendal-docs-release-${{ github.ref_name }}/"
- name: Clear build
run: rm -rf ./website/build
@@ -650,13 +656,19 @@ jobs:
OPENDAL_WEBSITE_BASE_URL: /opendal/opendal-docs-stable/
- name: Deploy to nightlies for stable version
- uses: burnett01/rsync-deployments@0dc935cdecc5f5e571865e60d2a6cdc673704823
if: ${{ startsWith(github.ref, 'refs/tags/') && !contains(github.ref, 'rc') }}
- with:
- switches: -avzr --delete
- path: website/build/
- remote_path: ${{ secrets.NIGHTLIES_RSYNC_PATH }}/opendal/opendal-docs-stable/
- remote_host: ${{ secrets.NIGHTLIES_RSYNC_HOST }}
- remote_port: ${{ secrets.NIGHTLIES_RSYNC_PORT }}
- remote_user: ${{ secrets.NIGHTLIES_RSYNC_USER }}
- remote_key: ${{ secrets.NIGHTLIES_RSYNC_KEY }}
+ shell: bash
+ env:
+ NIGHTLIES_RSYNC_HOST: ${{ secrets.NIGHTLIES_RSYNC_HOST }}
+ NIGHTLIES_RSYNC_KEY: ${{ secrets.NIGHTLIES_RSYNC_KEY }}
+ NIGHTLIES_RSYNC_PATH: ${{ secrets.NIGHTLIES_RSYNC_PATH }}
+ NIGHTLIES_RSYNC_PORT: ${{ secrets.NIGHTLIES_RSYNC_PORT }}
+ NIGHTLIES_RSYNC_USER: ${{ secrets.NIGHTLIES_RSYNC_USER }}
+ run: |
+ mkdir -p "${HOME}/.ssh"
+ printf '%s' "${NIGHTLIES_RSYNC_KEY}" > "${HOME}/.ssh/nightlies_rsync"
+ chmod 0600 "${HOME}/.ssh/nightlies_rsync"
+ rsync -avzr --delete \
+ -e "ssh -i ${HOME}/.ssh/nightlies_rsync -p ${NIGHTLIES_RSYNC_PORT} -o StrictHostKeyChecking=no" \
+ website/build/ \
+ "${NIGHTLIES_RSYNC_USER}@${NIGHTLIES_RSYNC_HOST}:${NIGHTLIES_RSYNC_PATH}/opendal/opendal-docs-stable/"
diff --git a/.github/workflows/release_dotnet.yml b/.github/workflows/release_dotnet.yml
index 1e46eb0ab..e26f24020 100644
--- a/.github/workflows/release_dotnet.yml
+++ b/.github/workflows/release_dotnet.yml
@@ -175,10 +175,27 @@ jobs:
path: bindings/dotnet/artifacts/package
- name: NuGet login
- uses: NuGet/login@v1
id: login
- with:
- user: Apache.OpenDAL
+ shell: bash
+ env:
+ NUGET_USERNAME: Apache.OpenDAL
+ run: |
+ oidc_token="$(curl -fsSL \
+ -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
+ "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=https%3A%2F%2Fwww.nuget.org" \
+ | python3 -c 'import json, sys; print(json.load(sys.stdin)["value"])')"
+ echo "::add-mask::${oidc_token}"
+
+ request_body="$(python3 -c 'import json, os; print(json.dumps({"username": os.environ["NUGET_USERNAME"], "tokenType": "ApiKey"}))')"
+ api_key="$(curl -fsSL \
+ -X POST https://www.nuget.org/api/v2/token \
+ -H "Content-Type: application/json" \
+ -H "Authorization: Bearer ${oidc_token}" \
+ -H "User-Agent: apache-opendal-release" \
+ --data "${request_body}" \
+ | python3 -c 'import json, sys; print(json.load(sys.stdin)["apiKey"])')"
+ echo "::add-mask::${api_key}"
+ echo "NUGET_API_KEY=${api_key}" >> "${GITHUB_OUTPUT}"
- name: Publish package
- run: dotnet nuget push bindings/dotnet/artifacts/package/*.nupkg --api-key "${{ steps.login.outputs.NUGET_API_KEY }}" --source https://api.nuget.org/v3/index.json --skip-duplicate
\ No newline at end of file
+ run: dotnet nuget push bindings/dotnet/artifacts/package/*.nupkg --api-key "${{ steps.login.outputs.NUGET_API_KEY }}" --source https://api.nuget.org/v3/index.json --skip-duplicate
diff --git a/.github/workflows/release_java.yml b/.github/workflows/release_java.yml
index c4a9daef1..cf9f6ec2c 100644
--- a/.github/workflows/release_java.yml
+++ b/.github/workflows/release_java.yml
@@ -108,7 +108,7 @@ jobs:
- uses: actions/checkout@v6
with:
repository: apache/opendal
- ref: ${{ inputs.ref }}
+ ref: ${{ github.ref }}
- name: Set up JDK 8
uses: actions/setup-java@v5
with:
diff --git a/.github/workflows/release_nodejs.yml b/.github/workflows/release_nodejs.yml
index d62c6a0d8..0f519c0eb 100644
--- a/.github/workflows/release_nodejs.yml
+++ b/.github/workflows/release_nodejs.yml
@@ -113,14 +113,28 @@ jobs:
cache: pnpm
cache-dependency-path: "bindings/nodejs/pnpm-lock.yaml"
- name: Install
- uses: dtolnay/rust-toolchain@stable
- with:
- toolchain: stable
- targets: ${{ matrix.settings.target }}
- - uses: mlugg/setup-zig@fa65c4058643678a4e4a9a60513944a7d8d35440 # v2.1.0
+ shell: bash
+ run: |
+ rustup toolchain install stable --profile minimal
+ rustup default stable
+ rustup target add ${{ matrix.settings.target }}
+ - name: Setup Zig
if: ${{ contains(matrix.settings.target, 'musl') }}
- with:
- version: 0.14.0
+ shell: bash
+ run: |
+ ZIG_VERSION=0.14.0
+ case "$(uname -s)-$(uname -m)" in
+ Linux-x86_64) ZIG_TARGET=x86_64-linux ;;
+ *)
+ echo "unsupported host for Zig: $(uname -s)-$(uname -m)" >&2
+ exit 1
+ ;;
+ esac
+ ZIG_HOME="${RUNNER_TOOL_CACHE}/zig/${ZIG_VERSION}"
+ mkdir -p "${ZIG_HOME}"
+ curl -fsSL "https://ziglang.org/download/${ZIG_VERSION}/zig-${ZIG_TARGET}-${ZIG_VERSION}.tar.xz" \
+ | tar -xJ --strip-components=1 -C "${ZIG_HOME}"
+ echo "${ZIG_HOME}" >> "${GITHUB_PATH}"
- name: Install cargo-zigbuild
uses: taiki-e/install-action@v2
if: ${{ contains(matrix.settings.target, 'musl') }}
@@ -128,10 +142,6 @@ jobs:
GITHUB_TOKEN: ${{ github.token }}
with:
tool: cargo-zigbuild
- - name: Setup toolchain
- run: ${{ matrix.settings.setup }}
- if: ${{ matrix.settings.setup }}
- shell: bash
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Set Build ENV
diff --git a/.github/workflows/release_python.yml b/.github/workflows/release_python.yml
index 2d6bdb844..645cc0528 100644
--- a/.github/workflows/release_python.yml
+++ b/.github/workflows/release_python.yml
@@ -123,16 +123,20 @@ jobs:
pattern: wheels-*
merge-multiple: true
path: bindings/python/dist
+ - name: Setup uv
+ uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
- name: Publish to TestPyPI
- uses: pypa/gh-action-pypi-publish@release/v1
if: ${{ startsWith(github.ref, 'refs/tags/') && contains(github.ref, '-') }}
- with:
- repository-url: https://test.pypi.org/legacy/
- skip-existing: true
- packages-dir: bindings/python/dist
+ run: |
+ uv publish \
+ --trusted-publishing automatic \
+ --publish-url https://test.pypi.org/legacy/ \
+ --check-url https://test.pypi.org/simple/opendal/ \
+ bindings/python/dist/*
- name: Publish to PyPI
- uses: pypa/gh-action-pypi-publish@release/v1
if: ${{ startsWith(github.ref, 'refs/tags/') && !contains(github.ref, '-') }}
- with:
- skip-existing: true
- packages-dir: bindings/python/dist
+ run: |
+ uv publish \
+ --trusted-publishing automatic \
+ --check-url https://pypi.org/simple/opendal/ \
+ bindings/python/dist/*
diff --git a/.github/workflows/release_ruby.yml b/.github/workflows/release_ruby.yml
index eaf74bb5c..c2ca45d9b 100644
--- a/.github/workflows/release_ruby.yml
+++ b/.github/workflows/release_ruby.yml
@@ -112,9 +112,12 @@ jobs:
- name: Checkout repository
uses: actions/checkout@v6
- - uses: dtolnay/rust-toolchain@stable
- with:
- targets: ${{ matrix.rust_target }}
+ - name: Setup Rust toolchain
+ shell: bash
+ run: |
+ rustup toolchain install stable --profile minimal
+ rustup default stable
+ rustup target add ${{ matrix.rust_target }}
- name: Setup Ruby and install dependencies
uses: ruby/setup-ruby@v1
@@ -156,7 +159,7 @@ jobs:
# (github.event_name == 'workflow_dispatch' && contains(needs.build.outputs.version, 'rc'))
# Don't start publish until we are ready
- if: false
+ if: ${{ vars.RUBY_RELEASE_ENABLED == 'true' }}
needs: [build, build-native]
runs-on: ubuntu-latest
@@ -264,7 +267,34 @@ jobs:
EOF
- name: Configure trusted publishing credentials
- uses: rubygems/configure-rubygems-credentials@v1.0.0
+ shell: bash
+ run: |
+ oidc_token="$(curl -fsSL \
+ -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
+ "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=rubygems.org" \
+ | ruby -rjson -e 'puts JSON.parse(STDIN.read).fetch("value")')"
+ echo "::add-mask::${oidc_token}"
+
+ api_key="$(curl -fsSL \
+ -X POST https://rubygems.org/api/v1/oidc/trusted_publisher/exchange_token \
+ -H "Content-Type: application/json" \
+ -H "Accept: application/json" \
+ -H "User-Agent: apache-opendal-release" \
+ --data "{\"jwt\":\"${oidc_token}\"}" \
+ | ruby -rjson -e 'puts JSON.parse(STDIN.read).fetch("rubygems_api_key")')"
+ echo "::add-mask::${api_key}"
+
+ mkdir -p "${HOME}/.gem"
+ {
+ echo "---"
+ echo ":rubygems_api_key: ${api_key}"
+ } > "${HOME}/.gem/credentials"
+ chmod 0600 "${HOME}/.gem/credentials"
+ {
+ echo "RUBYGEMS_API_KEY=${api_key}"
+ echo "BUNDLE_GEM__PUSH_KEY=${api_key}"
+ echo "GEM_HOST_API_KEY=${api_key}"
+ } >> "${GITHUB_ENV}"
- name: Release gem
run: bundle exec rake release