Merge branch 'workflow/release-upgradeable'

Author: Amxx

.github/workflows/release-upgradeable.yml

@@ -0,0 +1,101 @@
+name: Release Upgradeable
+
+on:
+  workflow_dispatch: {}
+
+env:
+  UPGRADEABLE_REPO: OpenZeppelin/openzeppelin-contracts-upgradeable
+
+jobs:
+  state:
+    name: Check state
+    permissions:
+      pull-requests: read
+    if: ${{ github.repository == 'OpenZeppelin/openzeppelin-contracts' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          repository: ${{ env.UPGRADEABLE_REPO }}
+          ref: ${{ github.ref }}
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.ref }}
+          path: lib/openzeppelin-contracts
+      - name: Set up environment
+        uses: ./.github/actions/setup
+      - name: Get reference commit
+        id: get-reference-commit
+        run: |
+          cd lib/openzeppelin-contracts
+          echo "commit=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
+      - name: Check upgradeable
+        id: check-upgradeable
+        run: bash lib/openzeppelin/scripts/release/workflow/check-upgradeable.sh # TODO: remove path prefix when this is merged and the change are transpiled
+        env:
+          REFERENCE_COMMIT: ${{ steps.get-reference-commit.outputs.commit }}
+    outputs:
+      publish: ${{ steps.check-upgradeable.outcome }}
+      is_prerelease: ${{ steps.check-upgradeable.outputs.is_prerelease }}
+
+  # copied from release-cycle.yml
+  publish:
+    needs: state
+    name: Publish to npm
+    environment: npm
+    permissions:
+      contents: write
+      id-token: write
+    if: needs.state.outputs.publish == 'success' # Note: changed from 'true' to 'success' to support the way publish is computed
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          repository: ${{ env.UPGRADEABLE_REPO }}
+          ref: ${{ github.ref }}
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.ref }}
+          path: lib/openzeppelin-contracts
+      - name: Set up environment
+        uses: ./.github/actions/setup
+      - id: pack
+        name: Pack
+        run: bash scripts/release/workflow/pack.sh
+        env:
+          PRERELEASE: ${{ needs.state.outputs.is_prerelease }}
+      - name: Upload tarball artifact
+        uses: actions/upload-artifact@v5
+        with:
+          name: ${{ github.ref_name }}
+          path: ${{ steps.pack.outputs.tarball }}
+      - name: Publish
+        run: bash scripts/release/workflow/publish.sh
+        env:
+          TARBALL: ${{ steps.pack.outputs.tarball }}
+          TAG: ${{ steps.pack.outputs.tag }}
+      - name: Create Github Release
+        uses: actions/github-script@v8
+        env:
+          PRERELEASE: ${{ needs.state.outputs.is_prerelease }}
+        with:
+          github-token: ${{ secrets.GH_TOKEN_UPGRADEABLE }}
+          script: await require('./lib/openzeppelin-contracts/scripts/release/workflow/github-release.js')({ github, context }, '${{ env.UPGRADEABLE_REPO }}') # TODO: remove path prefix when this is merged and the change are transpiled
+    outputs:
+      tarball_name: ${{ steps.pack.outputs.tarball_name }}
+
+  integrity_check:
+    needs: publish
+    name: Tarball Integrity Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Download tarball artifact
+        id: artifact
+        uses: actions/download-artifact@v6
+        with:
+          name: ${{ github.ref_name }}
+      - name: Check integrity
+        run: bash scripts/release/workflow/integrity-check.sh
+        env:
+          TARBALL: ${{ steps.artifact.outputs.download-path }}/${{ needs.publish.outputs.tarball_name }}

scripts/release/workflow/check-upgradeable.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if ! git log -1 --pretty=%B | grep -q "Transpile ${REFERENCE_COMMIT}"; then
+  echo "Expected 'Transpile ${REFERENCE_COMMIT}' but found '$(git log -1 --pretty=%B)'"
+  exit 1
+fi
+
+VERSION="$(jq -r .version contracts/package.json)"
+if [[ "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+  PRERELEASE="false"
+elif [[ "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$ ]]; then
+  PRERELEASE="true"
+else
+  echo "Invalid version"
+  exit 1
+fi
+
+echo "is_prerelease=${PRERELEASE}" >> "$GITHUB_OUTPUT"

scripts/release/workflow/github-release.js

@@ -2,12 +2,12 @@ const { readFileSync } = require('fs');
 const { join } = require('path');
 const { version } = require(join(__dirname, '../../../package.json'));
 
-module.exports = async ({ github, context }) => {
+module.exports = async ({ github, context }, repo = undefined) => {
   const changelog = readFileSync('CHANGELOG.md', 'utf8');
 
   await github.rest.repos.createRelease({
     owner: context.repo.owner,
-    repo: context.repo.repo,
+    repo: repo ?? context.repo.repo,
     tag_name: `v${version}`,
     target_commitish: context.sha,
     body: extractSection(changelog, version),