You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@casbin.apache.org by hs...@apache.org on 2026/10/07 03:00:18 UTC
(casbin-admission-webhook) 02/02: feat: release the webhook binary and Docker image only from a manually pushed tag
This is an automated email from the ASF dual-hosted git repository.
hsluoyz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/casbin-admission-webhook.git
commit c2aece3da93c8abbf4e6c7fc1a18700c433b2793
Author: Yang Luo <hs...@gmail.com>
AuthorDate: Wed Oct 7 10:48:54 2026 +0800
feat: release the webhook binary and Docker image only from a manually pushed tag
---
.github/workflows/release.yml | 132 +++++++++++++++++++++++++++++-------------
.releaserc.json | 50 ----------------
README.md | 1 -
3 files changed, 92 insertions(+), 91 deletions(-)
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d7e418a..1617566 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,27 +1,74 @@
name: Release
+# Releases are cut by hand: nothing here runs on a merge, only on a pushed tag.
+#
+# v1.4.0-rc1 -> GitHub pre-release (the candidate put up for the Apache vote)
+# v1.4.0 -> GitHub release + push the Docker image
+#
+# Either way the release carries an Apache-style source tarball and the Linux
+# webhook binary. The release manager downloads the tarball and signs /
+# checksums it locally before starting the vote; nothing is signed here.
+
on:
push:
- branches:
- - main
- - master
+ tags:
+ - "v*"
permissions:
contents: write
- issues: write
- pull-requests: write
+
+env:
+ # Base name of the source release artifact, per Apache naming conventions.
+ ARTIFACT_BASENAME: apache-casbin-admission-webhook
jobs:
release:
- name: Release
+ name: Release ${{ github.ref_name }}
+ if: github.repository == 'apache/casbin-admission-webhook'
runs-on: ubuntu-latest
- if: github.repository == 'casbin/casbin-admission-webhook'
+ outputs:
+ version: ${{ steps.version.outputs.base_version }}
+ prerelease: ${{ steps.version.outputs.prerelease }}
steps:
- - name: Checkout
+ - name: Checkout Repository
uses: actions/checkout@v4
- with:
- fetch-depth: 0
- persist-credentials: false
+
+ - name: Resolve version from tag
+ id: version
+ run: |
+ set -euo pipefail
+ VERSION="${GITHUB_REF_NAME#v}"
+ # v1.4.0-rc1 -> 1.4.0. The tarball the PPMC votes on is the exact tarball
+ # that ships, so the candidate counter is never part of its name.
+ BASE_VERSION="${VERSION%%-rc*}"
+ if [ "$VERSION" = "$BASE_VERSION" ]; then
+ PRERELEASE=false
+ else
+ PRERELEASE=true
+ fi
+ # Anything that is neither vX.Y.Z nor vX.Y.Z-rcN is a typo, and a typo
+ # must not reach Docker Hub.
+ if ! echo "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)?$'; then
+ echo "::error::Tag $GITHUB_REF_NAME is not vX.Y.Z or vX.Y.Z-rcN."
+ exit 1
+ fi
+ {
+ echo "base_version=$BASE_VERSION"
+ echo "prerelease=$PRERELEASE"
+ } >> "$GITHUB_OUTPUT"
+ echo "Tag $GITHUB_REF_NAME -> version $BASE_VERSION (pre-release: $PRERELEASE)"
+
+ - name: Build source release tarball
+ id: package
+ run: |
+ set -euo pipefail
+ NAME="${ARTIFACT_BASENAME}-${{ steps.version.outputs.base_version }}-incubating-src"
+ ASSET="${RUNNER_TEMP}/${NAME}.tar.gz"
+ # git archive gives us exactly the tracked sources at this tag, unpacking
+ # into a single top-level directory named after the release.
+ git archive --format=tar.gz --prefix="$NAME/" -o "$ASSET" HEAD
+ echo "asset=$ASSET" >> "$GITHUB_OUTPUT"
+ ls -l "$ASSET"
- name: Set up Go
uses: actions/setup-go@v5
@@ -31,59 +78,64 @@ jobs:
- name: Build binary
run: make build
- - name: Set up Node.js
- uses: actions/setup-node@v4
- with:
- node-version: 'lts/*'
-
- - name: Install semantic-release
- run: |
- npm install -g semantic-release@24 \
- @semantic-release/github@11 \
- @semantic-release/exec@6 \
- conventional-changelog-conventionalcommits@8
-
- - name: Run semantic-release
+ - name: Publish GitHub release
env:
- GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- run: npx semantic-release
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ TAG: ${{ github.ref_name }}
+ ASSET: ${{ steps.package.outputs.asset }}
+ run: |
+ set -euo pipefail
+ FLAGS=(--title "$TAG" --generate-notes)
+ if [ "${{ steps.version.outputs.prerelease }}" = "true" ]; then
+ FLAGS+=(--prerelease)
+ fi
+ gh release create "$TAG" "$ASSET" "webhook#Webhook Binary (Linux AMD64)" "${FLAGS[@]}"
docker:
name: Build and Push Docker Image
- runs-on: ubuntu-latest
needs: release
- if: github.repository == 'casbin/casbin-admission-webhook'
+ # Release candidates exist only for the vote; they never reach a registry.
+ if: needs.release.outputs.prerelease == 'false'
+ runs-on: ubuntu-latest
+ env:
+ VERSION: ${{ needs.release.outputs.version }}
steps:
- - name: Checkout
- uses: actions/checkout@v4
- with:
- fetch-depth: 0
-
- - name: Get latest tag
- id: get_tag
+ - name: Check the Docker Hub credentials are configured
+ id: gate
+ env:
+ DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
run: |
- git fetch --tags
- LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "v0.0.0")
- echo "tag=${LATEST_TAG#v}" >> $GITHUB_OUTPUT
- echo "latest_tag=${LATEST_TAG}" >> $GITHUB_OUTPUT
+ if [ -n "${DOCKERHUB_TOKEN}" ]; then
+ echo "enabled=true" >> "$GITHUB_OUTPUT"
+ else
+ echo "enabled=false" >> "$GITHUB_OUTPUT"
+ echo "::warning::DOCKERHUB_TOKEN is not set, so no Docker image was pushed for ${VERSION}."
+ fi
+
+ - name: Checkout Repository
+ if: steps.gate.outputs.enabled == 'true'
+ uses: actions/checkout@v4
- name: Set up Docker Buildx
+ if: steps.gate.outputs.enabled == 'true'
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
- name: Log in to Docker Hub
+ if: steps.gate.outputs.enabled == 'true'
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Build and push Docker image
+ if: steps.gate.outputs.enabled == 'true'
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
with:
context: .
push: true
tags: |
casbin/casbin-admission-webhook:latest
- casbin/casbin-admission-webhook:${{ steps.get_tag.outputs.tag }}
+ casbin/casbin-admission-webhook:${{ env.VERSION }}
platforms: linux/amd64,linux/arm64
cache-from: type=gha
cache-to: type=gha,mode=max
diff --git a/.releaserc.json b/.releaserc.json
deleted file mode 100644
index 5ee611d..0000000
--- a/.releaserc.json
+++ /dev/null
@@ -1,50 +0,0 @@
-{
- "branches": ["main", "master"],
- "plugins": [
- [
- "@semantic-release/commit-analyzer",
- {
- "preset": "conventionalcommits",
- "releaseRules": [
- {"type": "feat", "release": "minor"},
- {"type": "fix", "release": "patch"},
- {"type": "perf", "release": "patch"},
- {"type": "revert", "release": "patch"},
- {"type": "docs", "release": "patch"},
- {"type": "chore", "release": false},
- {"type": "refactor", "release": "patch"},
- {"type": "test", "release": false},
- {"type": "build", "release": false},
- {"type": "ci", "release": false}
- ]
- }
- ],
- [
- "@semantic-release/release-notes-generator",
- {
- "preset": "conventionalcommits",
- "presetConfig": {
- "types": [
- {"type": "feat", "section": "Features"},
- {"type": "fix", "section": "Bug Fixes"},
- {"type": "perf", "section": "Performance Improvements"},
- {"type": "revert", "section": "Reverts"},
- {"type": "docs", "section": "Documentation"},
- {"type": "refactor", "section": "Code Refactoring"},
- {"type": "test", "section": "Tests", "hidden": true},
- {"type": "build", "section": "Build System", "hidden": true},
- {"type": "ci", "section": "CI", "hidden": true}
- ]
- }
- }
- ],
- [
- "@semantic-release/github",
- {
- "assets": [
- {"path": "webhook", "label": "Webhook Binary (Linux AMD64)"}
- ]
- }
- ]
- ]
-}
diff --git a/README.md b/README.md
index dd44780..cb4550d 100644
--- a/README.md
+++ b/README.md
@@ -15,7 +15,6 @@ A Kubernetes Admission Webhook that uses [Casbin](https://casbin.org/) for Polic
- ๐ **Easy Deployment**: Simple Kubernetes manifests and automated certificate generation
- ๐งช **Well-tested**: Comprehensive unit tests and integration tests
- ๐ฆ **Container-ready**: Pre-built Docker images available
-- ๐ **CI/CD**: Automated releases with semantic versioning
- ๐ก๏ธ **Secure**: Runs with minimal privileges and read-only root filesystem
## How It Works
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@casbin.apache.org
For additional commands, e-mail: commits-help@casbin.apache.org