From e131ee627412daeb12abb98cf3a268f5ef8377e4 Mon Sep 17 00:00:00 2001 From: Ashley Cui Date: Mon, 2 Mar 2026 00:00:17 -0500 Subject: [PATCH] Remove deprecated release actions Our new release has been mostly stable at this point, remove legacy actions. Signed-off-by: Ashley Cui --- .github/workflows/mac-pkg.yml | 145 -------------- .github/workflows/release-artifacts.yml | 254 ------------------------ 2 files changed, 399 deletions(-) delete mode 100644 .github/workflows/mac-pkg.yml delete mode 100644 .github/workflows/release-artifacts.yml diff --git a/.github/workflows/mac-pkg.yml b/.github/workflows/mac-pkg.yml deleted file mode 100644 index 7f79b67777..0000000000 --- a/.github/workflows/mac-pkg.yml +++ /dev/null @@ -1,145 +0,0 @@ -name: Sign and Upload Mac Installer [DEPRECATED] - -on: - workflow_dispatch: - inputs: - version: - description: 'Release version to build and upload (e.g. "v9.8.7")' - required: true - dryrun: - description: 'Perform all the steps except uploading to the release page' - required: true - default: "true" # 'choice' type requires string value - type: choice - options: - - "true" # Must be quoted string, boolean value not supported. - - "false" - -permissions: {} - -jobs: - build: - runs-on: macos-latest - permissions: - contents: write - env: - APPLICATION_CERTIFICATE: ${{ secrets.MACOS_APPLICATION_CERT }} - CODESIGN_IDENTITY: ${{ secrets.MACOS_APPLICATION_IDENTITY }} - INSTALLER_CERTIFICATE: ${{ secrets.MACOS_INSTALLER_CERT }} - PRODUCTSIGN_IDENTITY: ${{ secrets.MACOS_INSTALLER_IDENTITY }} - CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }} - - NOTARIZE_TEAM: ${{ secrets.MACOS_NOTARIZATION_TEAM_ID }} - NOTARIZE_USERNAME: ${{ secrets.MACOS_NOTARIZATION_APPLE_ID }} - NOTARIZE_PASSWORD: ${{ secrets.MACOS_NOTARIZATION_PWD }} - - KEYCHAIN_PWD: ${{ secrets.MACOS_CI_KEYCHAIN_PWD }} - steps: - - name: Consolidate dryrun setting to always be true or false - id: actual_dryrun - env: - INPUT_DRYRUN: ${{ inputs.dryrun }} - run: | - # The 'release' trigger will not have a 'dryrun' input set. Handle - # this case in a readable/maintainable way. - if [[ -z "${INPUT_DRYRUN}" ]] - then - echo "dryrun=false" >> $GITHUB_OUTPUT - else - echo "dryrun=${INPUT_DRYRUN}" >> $GITHUB_OUTPUT - fi - - name: Dry Run Status - env: - DRYRUN: ${{ steps.actual_dryrun.outputs.dryrun }} - run: | - echo "::notice::This workflow execution will be a dry-run: ${DRYRUN}" - - name: Determine Version - id: getversion - env: - INPUT_VERSION: ${{ inputs.version }} - TAG_NAME: ${{ github.event.release.tag_name }} - run: | - if [[ -z "${INPUT_VERSION}" ]] - then - VERSION=${TAG_NAME} - else - VERSION=${INPUT_VERSION} - fi - echo - echo "version=$VERSION" >> $GITHUB_OUTPUT - - name: Check uploads - id: check - env: - VERSION: ${{ steps.getversion.outputs.version }} - run: | - URI="https://github.com/containers/podman/releases/download/${VERSION}" - ARM_FILE="podman-installer-macos-arm64.pkg" - - status=$(curl -s -o /dev/null -w "%{http_code}" "${URI}/${ARM_FILE}") - if [[ "$status" == "404" ]] ; then - echo "buildarm=true" >> $GITHUB_OUTPUT - else - echo "::warning::ARM installer already exists, skipping" - echo "buildarm=false" >> $GITHUB_OUTPUT - fi - - name: Checkout Version - if: >- - steps.check.outputs.buildarm == 'true' || - steps.actual_dryrun.outputs.dryrun == 'true' - uses: actions/checkout@v6 - with: - ref: ${{steps.getversion.outputs.version}} - persist-credentials: false - - name: Set up Go - # Conditional duplication sucks - GHA doesn't grok YAML anchors/aliases - if: >- - steps.check.outputs.buildarm == 'true' || - steps.actual_dryrun.outputs.dryrun == 'true' - uses: actions/setup-go@v6 - with: - go-version: stable - cache: false - - name: Create Keychain - if: >- - steps.check.outputs.buildarm == 'true' || - steps.actual_dryrun.outputs.dryrun == 'true' - run: | - echo $APPLICATION_CERTIFICATE | base64 --decode -o appcert.p12 - echo $INSTALLER_CERTIFICATE | base64 --decode -o instcert.p12 - - security create-keychain -p "$KEYCHAIN_PWD" build.keychain - security default-keychain -s build.keychain - security unlock-keychain -p "$KEYCHAIN_PWD" build.keychain - security import appcert.p12 -k build.keychain -P "$CERTIFICATE_PWD" -T /usr/bin/codesign - security import instcert.p12 -k build.keychain -P "$CERTIFICATE_PWD" -T /usr/bin/productsign - security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PWD" build.keychain &> /dev/null - - xcrun notarytool store-credentials "notarytool-profile" --apple-id "$NOTARIZE_USERNAME" --team-id "$NOTARIZE_TEAM" --password "$NOTARIZE_PASSWORD" &> /dev/null - - name: Build and Sign ARM - if: steps.check.outputs.buildarm == 'true' || steps.actual_dryrun.outputs.dryrun == 'true' - working-directory: contrib/pkginstaller - run: | - make ARCH=aarch64 notarize &> /dev/null - cd out && shasum -a 256 podman-installer-macos-arm64.pkg >> shasums - - name: Artifact - if: >- - steps.check.outputs.buildarm == 'true' || - steps.actual_dryrun.outputs.dryrun == 'true' - uses: actions/upload-artifact@v7 - with: - name: installers - path: | - contrib/pkginstaller/out/podman-installer-macos-*.pkg - contrib/pkginstaller/out/shasums - - name: Upload to Release - if: >- - steps.actual_dryrun.outputs.dryrun == 'false' && - steps.check.outputs.buildarm == 'true' - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - VERSION: ${{ steps.getversion.outputs.version }} - run: | - (gh release download "${VERSION}" -p "shasums" || exit 0) - cat contrib/pkginstaller/out/shasums >> shasums - gh release upload "${VERSION}" contrib/pkginstaller/out/podman-installer-macos-*.pkg - gh release upload "${VERSION}" --clobber shasums diff --git a/.github/workflows/release-artifacts.yml b/.github/workflows/release-artifacts.yml deleted file mode 100644 index 769b805d65..0000000000 --- a/.github/workflows/release-artifacts.yml +++ /dev/null @@ -1,254 +0,0 @@ -name: Upload Release Artifacts [DEPRECATED] - -on: - workflow_dispatch: - inputs: - version: - description: 'Release version to build and upload (e.g. "v9.8.7")' - required: true - dryrun: - description: 'Perform all the steps except uploading to the release page' - required: true - default: "true" # 'choice' type requires string value - type: choice - options: - - "true" # Must be quoted string, boolean value not supported. - - "false" - -permissions: {} - -jobs: - build: - runs-on: ubuntu-24.04 - permissions: - contents: write - actions: write - steps: - # If the job fails, these details are all but impossible to observe.yy - - name: Provide github event JSON for examination - run: | - echo "::group::Event JSON" - jq --color-output "." "${GITHUB_EVENT_PATH}" - echo "::endgroup::" - - - name: Determine Version - id: getversion - env: - INPUT_VERSION: ${{ inputs.version }} - TAG_NAME: ${{ github.event.release.tag_name }} - run: | - if [[ -z "${INPUT_VERSION}" ]] - then - VERSION=${TAG_NAME} - else - VERSION=${INPUT_VERSION} - fi - - if ! grep -Eq 'v[0-9]+(\.[0-9]+(\.[0-9]+(-.+)?)?)?$' <<<"$VERSION" - then - echo "Unable to parse release version '$VERSION' from github event JSON, or workflow 'version' input." - exit 1 - fi - - if grep -Eq '.+-dev$' <<<"$VERSION" - then - echo "Refusing to process a "-dev" version '$VERSION'" - exit 1 - fi - - echo - echo "version=$VERSION" >> $GITHUB_OUTPUT - - - name: Consolidate dryrun setting to always be true or false - id: actual_dryrun - env: - INPUT_DRYRUN: ${{ inputs.dryrun }} - run: | - # The 'release' trigger will not have a 'dryrun' input set. Handle - # this case in a readable/maintainable way. - if [[ -z "${INPUT_DRYRUN}" ]] - then - echo "dryrun=false" >> $GITHUB_OUTPUT - else - echo "dryrun=${INPUT_DRYRUN}" >> $GITHUB_OUTPUT - fi - - - name: Dry Run Status - env: - DRYRUN: ${{ steps.actual_dryrun.outputs.dryrun }} - run: | - echo "::notice::This workflow execution will be a dry-run: ${DRYRUN}" - - - name: Check uploads - id: check - env: - VERSION: ${{ steps.getversion.outputs.version }} - run: | - URI="https://github.com/containers/podman/releases/download/${VERSION}" - for artifact in 'podman-remote-release-darwin_arm64.zip darwin_arm' \ - 'podman-remote-release-windows_amd64.zip windows_amd' \ - 'podman-remote-static-linux_amd64.tar.gz linux_amd' \ - 'podman-remote-static-linux_arm64.tar.gz linux_arm' - do - set -- $artifact # Convert the "tuple" into the param args $1 $2... - status=$(curl -s -o /dev/null -w "%{http_code}" "${URI}/${1:?}") - if [[ "$status" == "404" ]] ; then - echo "${1:?} will be built" - needsbuild=true - echo "${2:?}=true" >> $GITHUB_OUTPUT - else - echo "::warning::${1:?} already exists, skipping" - fi - done - - if [ "$needsbuild" = true ]; then - echo "buildartifacts=true" >> $GITHUB_OUTPUT - else - echo "No new artifacts need to be built." - fi - - - name: Checkout Version - uses: actions/checkout@v6 - with: - ref: ${{steps.getversion.outputs.version}} - persist-credentials: false - - - name: Set up Go - if: >- - steps.check.outputs.buildartifacts == 'true' || - steps.actual_dryrun.outputs.dryrun == 'true' - uses: actions/setup-go@v6 - with: - go-version: stable - cache: false - - - name: Setup artifact directory - if: >- - steps.check.outputs.buildartifacts == 'true' || - steps.actual_dryrun.outputs.dryrun == 'true' - run: mkdir -p release/ - - - name: Build Darwin ARM - if: >- - steps.check.outputs.darwin_arm == 'true' || - steps.actual_dryrun.outputs.dryrun == 'true' - run: | - make podman-remote-release-darwin_arm64.zip - mv podman-remote-release-darwin_arm64.zip release/ - - - name: Build Linux AMD - if: >- - steps.check.outputs.linux_amd == 'true' || - steps.actual_dryrun.outputs.dryrun == 'true' - run: | - make podman-remote-static-linux_amd64 - tar -cvzf podman-remote-static-linux_amd64.tar.gz bin/podman-remote-static-linux_amd64 - mv podman-remote-static-linux_amd64.tar.gz release/ - - - name: Build Linux ARM - if: >- - steps.check.outputs.linux_arm == 'true' || - steps.actual_dryrun.outputs.dryrun == 'true' - run: | - make podman-remote-static-linux_arm64 - tar -cvzf podman-remote-static-linux_arm64.tar.gz bin/podman-remote-static-linux_arm64 - mv podman-remote-static-linux_arm64.tar.gz release/ - - - name: Build Windows AMD - if: >- - steps.check.outputs.windows_amd == 'true' || - steps.actual_dryrun.outputs.dryrun == 'true' - run: | - sudo apt-get install -y pandoc - make podman-remote-release-windows_amd64.zip - mv podman-remote-release-windows_amd64.zip release/ - - - name: shasums - if: >- - steps.check.outputs.buildartifacts == 'true' || - steps.actual_dryrun.outputs.dryrun == 'true' - run: | - pushd release - sha256sum *.zip *.tar.gz > shasums - popd - - - name: Upload to Actions as artifact - if: >- - steps.check.outputs.buildartifacts == 'true' || - steps.actual_dryrun.outputs.dryrun == 'true' - uses: actions/upload-artifact@v7 - with: - name: artifacts - path: | - release/* - - - name: Upload to Release - id: upload - if: >- - steps.check.outputs.buildartifacts == 'true' && - steps.actual_dryrun.outputs.dryrun == 'false' - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - VERSION: ${{ steps.getversion.outputs.version }} - run: | - (gh release download "${VERSION}" -p "shasums" || exit 0) - cat release/shasums >> shasums - gh release upload "${VERSION}" release/*.zip release/*.tar.gz - gh release upload "${VERSION}" --clobber shasums - - # WARNING: This should only be set when 'notification' job should be triggered - echo "complete=true" >> $GITHUB_OUTPUT - outputs: - uploaded: ${{ steps.upload.outputs.complete }} - version: ${{ steps.getversion.outputs.version }} - - notification: - if: needs.build.outputs.uploaded == 'true' - runs-on: ubuntu-24.04 - needs: build - permissions: - contents: read - steps: - - name: Format release email - id: format - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - VERSION: ${{ needs.build.outputs.version }} - run: | - if grep -Eq '.+-rc' <<<"$VERSION" - then - RC_PREFIX="candidate " - fi - - echo "mail_subj=Podman ${RC_PREFIX}${VERSION} Released" >> $GITHUB_OUTPUT - - cat < email_body.txt - Hi all, - - Podman ${RC_PREFIX}${VERSION} is now available. You may view the full details at - https://github.com/${GITHUB_REPOSITORY}/releases/tag/$VERSION - - Release ${RC_PREFIX}Notes: - -------------- - EOF - - echo "${GITHUB_TOKEN}" | gh auth login --with-token - gh release view "$VERSION" \ - --repo "${GITHUB_REPOSITORY}" --json=body --jq '.body' >> email_body.txt - - # If job fails, permit operator to observe contents in case helpful. - - name: Provide release e-mail contents for examination - run: cat email_body.txt - - - name: Send release notification e-mail - # Ref: https://github.com/dawidd6/action-send-mail - uses: dawidd6/action-send-mail@42942bc2f8fba4e611b459a018967a6a7c78c68c # v17 - with: - server_address: ${{secrets.ACTION_MAIL_SERVER}} - server_port: 465 - username: ${{secrets.ACTION_MAIL_USERNAME}} - password: ${{secrets.ACTION_MAIL_PASSWORD}} - subject: ${{ steps.format.outputs.mail_subj }} - to: Podman List - from: ${{secrets.ACTION_MAIL_SENDER}} - body: file://./email_body.txt