diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml new file mode 100644 index 000000000..baeedabe6 --- /dev/null +++ b/.github/workflows/release.yaml @@ -0,0 +1,64 @@ +name: Release workflow - Add the docker hub link to the release notes + +on: + release: + types: + - published + +permissions: + actions: write + contents: read + issues: write + +jobs: + manual-approval: + name: Waiting for manual approval + runs-on: ubuntu-latest + + steps: + - name: Wait for manual approval + uses: trstringer/manual-approval@662b3ddbc7685f897992051e87e1b4b58c07dc03 #v1.9.1 + with: + secret: ${{ github.TOKEN }} + approvers: fabergat, aldur, matteojug, djordon + minimum-approvals: 1 + issue-title: "Add Docker Hub link to the ${{ github.event.release.tag_name }} release notes" + issue-body: "Please approve or deny the ${{ github.ref_name }}. Wait the Build and Release sBTC Signer ${{ github.event.release.tag_name }} Docker Image workflow finish with a success." + exclude-workflow-initiator-as-approver: false + + update-release: + name: Update Release Page + permissions: write-all + runs-on: ubuntu-latest + needs: manual-approval + + steps: + - name: Get Docker Image Digest + id: docker-info + run: | + DOCKER_REPO="blockstack/sbtc" + TAG=${{ github.event.release.tag_name }} + DIGEST=$(curl -s https://hub.docker.com/v2/repositories/$DOCKER_REPO/tags/signer-$TAG | jq -r '.images[0].digest') + echo "link=hub.docker.com/layers/$DOCKER_REPO/signer-$TAG/images/$DIGEST" >> $GITHUB_ENV + + - name: Update Release with Docker Image Link + uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea #v7.0.1 + with: + script: | + const link = process.env.link; + + await github.rest.repos.updateRelease({ + owner: context.repo.owner, + repo: context.repo.repo, + release_id: context.payload.release.id, + body: + ` + ${context.payload.release.body} + + **Release Docker Image:** [https://${link}](https://${link}) + + You can verify the attestation using this [guide](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds#verifying-artifact-attestations-with-the-github-cli). + ` + }); + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file