mirror of
https://github.com/cline/cline.git
synced 2026-09-19 02:05:44 +08:00
ci(nightly): tag and push vscode-nightly-v<version> for each nightly build
Both nightly publish workflows (publish-nightly.yml and publish-nightly-sdk.yml)
publish to the saoudrizwan.cline-nightly extension with version
'${major}.${minor}.${unix-timestamp}'. Until now nothing on the git side
recorded which commit a given marketplace version was built from, which
made post-hoc 'what's in version X.Y.<timestamp>?' triage essentially
require reverse-engineering the GitHub Actions run history.
Follow the technique from publish.yml (the stable release workflow): after
a successful publish, configure a github-actions[bot] git identity, create
an annotated tag pointing at the build SHA, and push it to origin.
Changes:
- scripts/publish-nightly.mjs: when running under GitHub Actions (i.e.
GITHUB_OUTPUT is set), append 'version=${newVersion}' to that file so
the calling workflow can read steps.publish.outputs.version. The
generated version is computed in exactly one place (Math.floor(
Date.now()/1000)), eliminating drift risk between the published vsix
and the tag.
- publish-nightly.yml: give the publish step id 'publish'; add a
'Tag and push nightly build' step that creates and pushes
vscode-nightly-v${VERSION}. The workflow already has 'contents: write'
permissions and a credentialled checkout, so 'git push origin' just works.
- publish-nightly-sdk.yml: bump 'contents: read' -> 'contents: write';
add the same tagging step, but push using an explicit
https://x-access-token:${GITHUB_TOKEN}@github.com/... URL rather than
relying on a persisted credential. This lets us keep
'persist-credentials: false' on the SDK source checkout (defense in
depth: that token cannot inadvertently push to
dpc/sdk-migration-simpler-login). Tag refs (refs/tags/*) are the only
thing this token gets used to push.
Tag namespace 'vscode-nightly-v...' is intentionally distinct from the
'vX.Y.Z' tags used for stable VS Code releases, and reserves room for
future 'jetbrains-nightly-v...' / 'cli-nightly-v...' tag families.
Existing stable 'vX.Y.Z' tags are left untouched.
This commit is contained in:
Dominic Cooney
@@ -6,7 +6,9 @@ on:
|
||||
workflow_dispatch:
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
# contents: write is needed so the final step can push a build tag
|
||||
# (`vscode-nightly-v<version>`) marking what was shipped.
|
||||
contents: write
|
||||
packages: write
|
||||
checks: write
|
||||
pull-requests: write
|
||||
@@ -56,6 +58,7 @@ jobs:
|
||||
done
|
||||
|
||||
- name: Publish SDK nightly extension
|
||||
id: publish
|
||||
env:
|
||||
VSCE_PAT: ${{ secrets.VSCE_PAT }}
|
||||
OVSX_PAT: ${{ secrets.OVSX_PAT }}
|
||||
@@ -70,3 +73,43 @@ jobs:
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
|
||||
OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
|
||||
run: npm run publish:marketplace:nightly
|
||||
|
||||
# Tag the commit that was actually built and shipped, so we can
|
||||
# later answer "what was in nightly version X.Y.<timestamp>?".
|
||||
# The version comes from scripts/publish-nightly.mjs, which writes
|
||||
# `version=<the-new-version>` to $GITHUB_OUTPUT. Tag namespace is
|
||||
# `vscode-nightly-v<version>` to distinguish from the plain `vX.Y.Z`
|
||||
# tags used for stable VS Code releases.
|
||||
#
|
||||
# We push using an explicit ${{ secrets.GITHUB_TOKEN }} URL rather
|
||||
# than relying on a persisted git credential, so we can keep
|
||||
# `persist-credentials: false` on the source checkout above
|
||||
# (defense-in-depth: that token cannot inadvertently push to
|
||||
# `dpc/sdk-migration-simpler-login`). Tag refs (`refs/tags/*`) are
|
||||
# the only thing this token is used to push.
|
||||
- name: Tag and push nightly build
|
||||
if: success() && steps.publish.outputs.version != ''
|
||||
env:
|
||||
NIGHTLY_VERSION: ${{ steps.publish.outputs.version }}
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
TAG="vscode-nightly-v${NIGHTLY_VERSION}"
|
||||
TAG_REF="refs/tags/${TAG}"
|
||||
BUILD_SHA=$(git rev-parse HEAD)
|
||||
|
||||
if git ls-remote --exit-code --tags origin "${TAG_REF}" >/dev/null 2>&1; then
|
||||
echo "Tag ${TAG} already exists on origin; skipping push."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
git config user.name "github-actions[bot]"
|
||||
git config user.email "github-actions[bot]@users.noreply.github.com"
|
||||
git tag -a "${TAG}" "${BUILD_SHA}" \
|
||||
-m "Cline (Nightly SDK) VS Code extension ${NIGHTLY_VERSION}" \
|
||||
-m "Built and published by ${GITHUB_WORKFLOW} run ${GITHUB_RUN_ID}." \
|
||||
-m "Workflow file: .github/workflows/publish-nightly-sdk.yml" \
|
||||
-m "Source ref: ${SDK_NIGHTLY_REF}"
|
||||
git push \
|
||||
"https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" \
|
||||
"${TAG_REF}"
|
||||
echo "Tagged build commit ${BUILD_SHA} as ${TAG} and pushed to origin."
|
||||
|
||||
@@ -59,6 +59,7 @@ jobs:
|
||||
done
|
||||
|
||||
- name: Publish Nightly Extension
|
||||
id: publish
|
||||
env:
|
||||
VSCE_PAT: ${{ secrets.VSCE_PAT }}
|
||||
OVSX_PAT: ${{ secrets.OVSX_PAT }}
|
||||
@@ -73,3 +74,33 @@ jobs:
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
|
||||
OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
|
||||
run: npm run publish:marketplace:nightly
|
||||
|
||||
# Tag the commit that was actually built and shipped, so we can
|
||||
# later answer "what was in nightly version X.Y.<timestamp>?".
|
||||
# The version comes from scripts/publish-nightly.mjs, which writes
|
||||
# `version=<the-new-version>` to $GITHUB_OUTPUT. Tag namespace is
|
||||
# `vscode-nightly-v<version>` to distinguish from the plain `vX.Y.Z`
|
||||
# tags used for stable VS Code releases.
|
||||
- name: Tag and push nightly build
|
||||
if: success() && steps.publish.outputs.version != ''
|
||||
env:
|
||||
NIGHTLY_VERSION: ${{ steps.publish.outputs.version }}
|
||||
run: |
|
||||
TAG="vscode-nightly-v${NIGHTLY_VERSION}"
|
||||
TAG_REF="refs/tags/${TAG}"
|
||||
BUILD_SHA=$(git rev-parse HEAD)
|
||||
|
||||
if git ls-remote --exit-code --tags origin "${TAG_REF}" >/dev/null 2>&1; then
|
||||
echo "Tag ${TAG} already exists on origin; skipping push."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
git config user.name "github-actions[bot]"
|
||||
git config user.email "github-actions[bot]@users.noreply.github.com"
|
||||
git tag -a "${TAG}" "${BUILD_SHA}" \
|
||||
-m "Cline (Nightly) VS Code extension ${NIGHTLY_VERSION}" \
|
||||
-m "Built and published by ${GITHUB_WORKFLOW} run ${GITHUB_RUN_ID}." \
|
||||
-m "Workflow file: .github/workflows/publish-nightly.yml" \
|
||||
-m "Source ref: ${GITHUB_REF}"
|
||||
git push origin "${TAG_REF}"
|
||||
echo "Tagged build commit ${BUILD_SHA} as ${TAG} and pushed to origin."
|
||||
|
||||
@@ -330,6 +330,21 @@ class NightlyPublisher {
|
||||
const newVersion = this.generateVersion(currentVersion)
|
||||
log.info(`New version: ${newVersion}`)
|
||||
|
||||
// When running under GitHub Actions, surface the generated version
|
||||
// via $GITHUB_OUTPUT so the workflow can tag the build commit with
|
||||
// the same version that ends up on the marketplace. Tagging in the
|
||||
// workflow (rather than here) keeps git side-effects out of this
|
||||
// script's local-dev path.
|
||||
const githubOutputPath = process.env.GITHUB_OUTPUT
|
||||
if (githubOutputPath) {
|
||||
try {
|
||||
fs.appendFileSync(githubOutputPath, `version=${newVersion}\n`)
|
||||
log.info(`Wrote version to GITHUB_OUTPUT: ${githubOutputPath}`)
|
||||
} catch (error) {
|
||||
log.warn(`Failed to write version to GITHUB_OUTPUT: ${error.message}`)
|
||||
}
|
||||
}
|
||||
|
||||
// Update package.json fields
|
||||
pkg.version = newVersion
|
||||
pkg.name = config.nightlyName
|
||||
|
||||
Reference in New Issue
Block a user