Skip to content

Commit 3cf0464

Browse files
carole-lavillonnierecarole-lavillonniere
authored
Weekly publish of pre-release (#108)
* Add weekly auto-release workflow for the LocalStack RIE Cut a new patch release once a week when there are new commits on localstack, so Go-dep/stdlib CVE fixes self-publish without a manual tag. - weekly-release.yml: Friday cron + workflow_dispatch; discovers the latest published release, patch-bumps, skips if no new commits, then calls build.yml. - build.yml: add workflow_call with an optional version input so the same test -> build -> release path publishes the computed version (no PAT needed). * Push the release tag after tests and build * Publish weekly releases as pre-releases pending validation * Correct stale scheduling rationale in weekly-release comment * Alert the team on Slack when the weekly release fails * Document the weekly auto-release and promotion flow
1 parent 87ea526 commit 3cf0464

3 files changed

Lines changed: 140 additions & 2 deletions

File tree

‎.github/workflows/build.yml‎

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,19 @@ on:
66
tags: v*.*
77
pull_request:
88
branches: [ localstack ]
9+
# Callable by weekly-release.yml; publishes a release when `version` is set.
10+
workflow_call:
11+
inputs:
12+
version:
13+
description: "Release version to tag and publish (e.g. v0.2.1). When set, a release is published."
14+
type: string
15+
required: false
16+
default: ""
17+
prerelease:
18+
description: "Publish as a pre-release. Promoted to a full release once localstack-pro validates it."
19+
type: boolean
20+
required: false
21+
default: false
922

1023
jobs:
1124

@@ -25,6 +38,8 @@ jobs:
2538
build:
2639
runs-on: ubuntu-latest
2740
needs: test
41+
permissions:
42+
contents: write
2843
steps:
2944
- uses: actions/checkout@v7
3045

@@ -42,10 +57,17 @@ jobs:
4257
with:
4358
name: aws-lambda-rie
4459
path: bin/*
60+
- name: Push tag
61+
if: inputs.version != ''
62+
run: |
63+
git tag "${{ inputs.version }}" "$GITHUB_SHA"
64+
git push origin "${{ inputs.version }}"
65+
4566
- name: Release binaries
4667
uses: softprops/action-gh-release@v3
47-
if: startsWith(github.ref, 'refs/tags/')
68+
if: startsWith(github.ref, 'refs/tags/') || inputs.version != ''
4869
with:
70+
tag_name: ${{ inputs.version || github.ref_name }}
4971
files: bin/*
5072
generate_release_notes: true
51-
prerelease: ${{ endsWith(github.ref, '-pre') }}
73+
prerelease: ${{ inputs.prerelease || endsWith(github.ref, '-pre') || endsWith(inputs.version, '-pre') }}

‎.github/workflows/weekly-release.yml‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
# Weekly auto-release: patch-bumps and publishes if there are new commits on localstack.
2+
name: Weekly Release
3+
4+
on:
5+
schedule:
6+
# Fridays 06:00 UTC. The release is a pre-release until localstack-pro validates and promotes it,
7+
# which is what gates the downstream lambda-images bump.
8+
- cron: '0 6 * * 5'
9+
workflow_dispatch:
10+
inputs:
11+
dryRun:
12+
description: "Compute the next version but do not release."
13+
type: boolean
14+
default: false
15+
16+
permissions:
17+
contents: read
18+
19+
jobs:
20+
version:
21+
runs-on: ubuntu-latest
22+
outputs:
23+
should_release: ${{ steps.ver.outputs.should_release }}
24+
next: ${{ steps.ver.outputs.next }}
25+
steps:
26+
- uses: actions/checkout@v7
27+
with:
28+
ref: localstack
29+
fetch-depth: 0
30+
31+
- name: Determine next version
32+
id: ver
33+
env:
34+
GH_TOKEN: ${{ github.token }}
35+
run: |
36+
git fetch --tags --force
37+
# Highest released version, including pre-releases still awaiting promotion, so a pending
38+
# promotion cannot make us recompute a version whose tag already exists. The grep keeps
39+
# RC tags (v0.0.0-rc.*) out; sort -V picks the highest version, not the newest.
40+
latest=$(gh release list --exclude-drafts \
41+
--json tagName -q '.[].tagName' \
42+
| grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -n1)
43+
if [ -z "$latest" ]; then
44+
echo "::error::No published vX.Y.Z release found to bump from." && exit 1
45+
fi
46+
count=$(git rev-list "${latest}..HEAD" --count)
47+
ver=${latest#v}
48+
IFS=. read -r major minor patch <<< "$ver"
49+
next="v${major}.${minor}.$((patch + 1))"
50+
should_release=true
51+
if [ "$count" = "0" ]; then
52+
should_release=false
53+
echo "No new commits since $latest; nothing to release."
54+
fi
55+
if [ "${{ inputs.dryRun }}" = "true" ]; then
56+
should_release=false
57+
echo "dryRun requested; not releasing."
58+
fi
59+
{
60+
echo "next=$next"
61+
echo "should_release=$should_release"
62+
} >> "$GITHUB_OUTPUT"
63+
echo "Latest release: $latest | new commits since: $count | next: $next | release: $should_release"
64+
65+
release:
66+
needs: version
67+
if: needs.version.outputs.should_release == 'true'
68+
permissions:
69+
contents: write
70+
# Reuse build.yml's test -> build -> release path with the computed version. Published as a
71+
# pre-release; localstack-pro promotes it to a full release once its CI validates the version.
72+
uses: ./.github/workflows/build.yml
73+
with:
74+
version: ${{ needs.version.outputs.next }}
75+
prerelease: true
76+
77+
notify:
78+
name: Report a broken weekly release
79+
if: always() && (needs.version.result == 'failure' || needs.release.result == 'failure')
80+
runs-on: ubuntu-latest
81+
needs:
82+
- version
83+
- release
84+
steps:
85+
- name: "Send Message"
86+
uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
87+
env:
88+
MESSAGE: "_*Weekly RIE release failed*_ :turtle-headache::broken_heart:\n\nNo new pre-release was published, so CVE remediation is stalled until this is fixed. Investigate the failed workflow run <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|here> :mag_right:"
89+
with:
90+
webhook: ${{ secrets.COSY_WEBHOOK_URL }}
91+
webhook-type: incoming-webhook
92+
payload: |
93+
blocks:
94+
- type: "section"
95+
text:
96+
type: "mrkdwn"
97+
text: "${{ env.MESSAGE }}"

‎README-LOCALSTACK.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,25 @@ previous release (e.g. [`v0.1.47`](https://github.com/localstack/lambda-runtime-
6969
> LocalStack releases — it is a manual `workflow_dispatch` that checks out `main` (the upstream
7070
> mirror) rather than `localstack`, so it would not include the LocalStack customizations.
7171
72+
### Weekly auto-release
73+
74+
[`weekly-release.yml`](./.github/workflows/weekly-release.yml) runs every Friday at 06:00 UTC. If
75+
`localstack` has new commits since the highest existing release, it patch-bumps the version and calls
76+
`build.yml` to run the tests, build the binaries, push the tag, and publish the release. Together with
77+
Renovate automerge, this is what carries dependency and CVE fixes downstream without manual work.
78+
79+
The release is published as a **pre-release**, and only reaches consumers once it has been validated:
80+
81+
1. `weekly-release.yml` publishes `vX.Y.Z`, marked as a pre-release.
82+
2. localstack-pro opens a PR bumping `LAMBDA_RUNTIME_DEFAULT_VERSION` to that version; its CI is the
83+
quality gate.
84+
3. On merge, localstack-pro flips the same release to a full release through the GitHub API — no new
85+
tag and no rebuild, so the binaries that were validated are the binaries that ship.
86+
4. lambda-images ignores pre-releases, so Renovate only opens a bump PR there after the promotion.
87+
88+
Run it manually via the **Weekly Release** workflow (`workflow_dispatch`); `dryRun` reports the next
89+
version without releasing. A failed run posts to Slack.
90+
7291
### RC (release candidate) pre-release
7392

7493
RC pre-releases let an **unmerged** PR be tested against localstack-pro CI without cutting a real

0 commit comments

Comments
 (0)