[repo] Release automation improvements (#1866)

.github/workflows/post-release.yml

@@ -0,0 +1,51 @@
+name: Complete release
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        required: true
+        description: 'Release tag'
+        type: string
+  release:
+    types: [published]
+
+jobs:
+  automation:
+    uses: ./.github/workflows/automation.yml
+    secrets: inherit
+
+  post-release:
+    runs-on: ubuntu-latest
+
+    needs:
+    - automation
+
+    if: needs.automation.outputs.enabled
+
+    env:
+      GH_TOKEN: ${{ secrets[needs.automation.outputs.token-secret-name] }}
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        # Note: By default GitHub only fetches 1 commit. We need all the tags
+        # for this work.
+        fetch-depth: 0
+        ref: ${{ github.event.repository.default_branch }}
+        token: ${{ secrets[needs.automation.outputs.token-secret-name] }}
+
+    - name: Create GitHub Pull Request to update PackageValidationBaselineVersion in projects
+      if: |
+        (github.ref_type == 'tag' && !contains(github.ref_name, '-alpha') && !contains(github.ref_name, '-beta') && !contains(github.ref_name, '-rc'))
+        || (inputs.tag && !contains(inputs.tag, '-alpha') && !contains(inputs.tag, '-beta') && !contains(inputs.tag, '-rc'))
+      shell: pwsh
+      run: |
+        Import-Module .\build\scripts\post-release.psm1
+
+        CreatePackageValidationBaselineVersionUpdatePullRequest `
+          -gitRepository '${{ github.repository }}' `
+          -tag '${{ inputs.tag || github.ref_name }}' `
+          -targetBranch '${{ github.event.repository.default_branch }}' `
+          -gitUserName '${{ needs.automation.outputs.username }}' `
+          -gitUserEmail '${{ needs.automation.outputs.email }}'

.github/workflows/prepare-release.yml

@@ -62,118 +62,107 @@ on:
     types:
     - created
 
-permissions:
-  contents: write
-  pull-requests: write
-
 jobs:
+  automation:
+    uses: ./.github/workflows/automation.yml
+    secrets: inherit
+
   prepare-release-pr:
-    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
 
-    runs-on: windows-latest
+    needs: automation
+
+    if: github.event_name == 'workflow_dispatch' && needs.automation.outputs.enabled
+
+    env:
+      GH_TOKEN: ${{ secrets[needs.automation.outputs.token-secret-name] }}
 
     steps:
     - name: check out code
       uses: actions/checkout@v4
+      with:
+        token: ${{ secrets[needs.automation.outputs.token-secret-name] }}
 
     - name: Create GitHub Pull Request to prepare release
       shell: pwsh
       run: |
         Import-Module .\build\scripts\prepare-release.psm1
 
         CreatePullRequestToUpdateChangelogsAndPublicApis `
+          -gitRepository '${{ github.repository }}' `
           -component '${{ inputs.component }}' `
           -version '${{ inputs.version }}' `
-          -targetBranch '${{ github.ref_name }}'
-      env:
-        GH_TOKEN: ${{ github.token }}
+          -targetBranch '${{ github.ref_name }}' `
+          -gitUserName '${{ needs.automation.outputs.username }}' `
+          -gitUserEmail '${{ needs.automation.outputs.email }}'
 
   lock-pr-and-post-notice-to-create-release-tag:
+    runs-on: ubuntu-latest
+
+    needs: automation
+
     if: |
       github.event_name == 'pull_request'
       && github.event.action == 'closed'
-      && github.event.pull_request.user.login == 'github-actions[bot]'
+      && github.event.pull_request.user.login == needs.automation.outputs.username
       && github.event.pull_request.merged == true
       && startsWith(github.event.pull_request.title, '[repo] Prepare release ')
+      && needs.automation.outputs.enabled
 
-    runs-on: windows-latest
+    env:
+      GH_TOKEN: ${{ secrets[needs.automation.outputs.token-secret-name] }}
 
     steps:
     - name: check out code
       uses: actions/checkout@v4
+      with:
+        token: ${{ secrets[needs.automation.outputs.token-secret-name] }}
 
     - name: Lock GitHub Pull Request to prepare release
       shell: pwsh
       run: |
         Import-Module .\build\scripts\prepare-release.psm1
 
         LockPullRequestAndPostNoticeToCreateReleaseTag `
-          -pullRequestNumber '${{ github.event.pull_request.number }}'
-      env:
-        GH_TOKEN: ${{ github.token }}
+          -gitRepository '${{ github.repository }}' `
+          -pullRequestNumber '${{ github.event.pull_request.number }}' `
+          -botUserName '${{ needs.automation.outputs.username }}'
 
   create-release-tag-unlock-pr-post-notice:
+    runs-on: ubuntu-latest
+
+    needs: automation
+
     if: |
       github.event_name == 'issue_comment'
       && github.event.issue.pull_request
       && github.event.issue.locked == true
+      && github.event.comment.user.login != needs.automation.outputs.username
       && contains(github.event.comment.body, '/CreateReleaseTag')
       && startsWith(github.event.issue.title, '[repo] Prepare release ')
       && github.event.issue.pull_request.merged_at
+      && needs.automation.outputs.enabled
 
-    runs-on: windows-latest
-
-    outputs:
-      tag: ${{ steps.create-tag.outputs.tag }}
+    env:
+      GH_TOKEN: ${{ secrets[needs.automation.outputs.token-secret-name] }}
 
     steps:
     - name: check out code
       uses: actions/checkout@v4
       with:
         # Note: By default GitHub only fetches 1 commit which fails the git tag operation below
         fetch-depth: 0
+        token: ${{ secrets[needs.automation.outputs.token-secret-name] }}
 
     - name: Create release tag
       id: create-tag
       shell: pwsh
       run: |
         Import-Module .\build\scripts\prepare-release.psm1
 
-        $tag = ''
-
-        CreateReleaseTag `
-          -pullRequestNumber '${{ github.event.issue.number }}' `
-          -actionRunId '${{ github.run_id }}' `
-          -tag ([ref]$tag)
-
-        echo "tag=$tag" >> $env:GITHUB_OUTPUT
-      env:
-        GH_TOKEN: ${{ github.token }}
-
-  invoke-package-workflow:
-    needs: create-release-tag-unlock-pr-post-notice
-    uses: ./.github/workflows/publish-packages.yml
-    with:
-      tag: ${{ needs.create-release-tag-unlock-pr-post-notice.outputs.tag }}
-    secrets: inherit
-
-  post-packages-ready-notice:
-    needs:
-    - create-release-tag-unlock-pr-post-notice
-    - invoke-package-workflow
-    runs-on: windows-latest
-    steps:
-    - name: check out code
-      uses: actions/checkout@v4
-
-    - name: Post notice when packages are ready
-      shell: pwsh
-      run: |
-        Import-Module .\build\scripts\prepare-release.psm1
-
-        PostPackagesReadyNotice `
+        CreateReleaseTagAndPostNoticeOnPullRequest `
+          -gitRepository '${{ github.repository }}' `
           -pullRequestNumber '${{ github.event.issue.number }}' `
-          -tag '${{ needs.create-release-tag-unlock-pr-post-notice.outputs.tag }}' `
-          -packagesUrl '${{ needs.invoke-package-workflow.outputs.artifact-url }}'
-      env:
-        GH_TOKEN: ${{ github.token }}
+          -botUserName '${{ needs.automation.outputs.username }}' `
+          -gitUserName '${{ needs.automation.outputs.username }}' `
+          -gitUserEmail '${{ needs.automation.outputs.email }}'

.github/workflows/publish-packages.yml

@@ -12,30 +12,19 @@ on:
       - 'Resources.*-*'
       - 'Sampler.*-*'
       - 'SemanticConventions-*'
-  workflow_call:
-    inputs:
-      tag:
-        required: true
-        type: string
-    outputs:
-      artifact-id:
-        value: ${{ jobs.build-pack-publish.outputs.artifact-id }}
-      artifact-url:
-        value: ${{ jobs.build-pack-publish.outputs.artifact-url }}
   schedule:
     - cron: '0 0 * * *' # once in a day at 00:00
 
-permissions:
-  contents: write
-  pull-requests: write
-
 jobs:
+  automation:
+    uses: ./.github/workflows/automation.yml
+    secrets: inherit
+
   build-pack-publish:
 
     runs-on: windows-latest
 
     outputs:
-      artifact-id: ${{ steps.upload-artifacts.outputs.artifact-id }}
       artifact-url: ${{ steps.upload-artifacts.outputs.artifact-url }}
 
     steps:
@@ -45,7 +34,6 @@ jobs:
         # the version tag which is typically NOT on the first commit so we
         # retrieve them all.
         fetch-depth: 0
-        ref: ${{ inputs.tag || github.ref || 'main' }}
 
     - name: Resolve project
       id: resolve-project
@@ -65,7 +53,7 @@ jobs:
         $component = '' # Used to tell Component.proj what to build
 
         ResolveProjectForTag `
-          -tag '${{ github.ref_type == 'tag' && github.ref_name || inputs.tag || '' }}' `
+          -tag '${{ github.ref_type == 'tag' && github.ref_name || '' }}' `
           -title ([ref]$title) `
           -project ([ref]$project) `
           -component ([ref]$component)
@@ -90,13 +78,13 @@ jobs:
       run: dotnet test ${{ steps.resolve-project.outputs.project }} --configuration Release --no-restore --no-build
 
     - name: dotnet pack ${{ steps.resolve-project.outputs.title }}
-      run: dotnet pack ${{ steps.resolve-project.outputs.project }} --configuration Release --no-restore --no-build  -p:PackTag=${{ github.ref_type == 'tag' && github.ref_name || inputs.tag || '' }}
+      run: dotnet pack ${{ steps.resolve-project.outputs.project }} --configuration Release --no-restore --no-build  -p:PackTag=${{ github.ref_type == 'tag' && github.ref_name || '' }}
 
     - name: Publish Artifacts
       id: upload-artifacts
       uses: actions/upload-artifact@v4
       with:
-        name: ${{ inputs.tag || github.ref_name }}-packages
+        name: ${{ github.ref_name }}-packages
         path: 'src\**\*.*nupkg'
 
     - name: Publish MyGet
@@ -110,30 +98,46 @@ jobs:
     - name: Publish NuGets
       env:
         NUGET_TOKEN_EXISTS: ${{ secrets.NUGET_TOKEN != '' }}
-      if: (github.ref_type == 'tag' || inputs.tag) && env.NUGET_TOKEN_EXISTS == 'true' # Skip NuGet publish for scheduled nightly builds or if run on a fork without the secret
+      if: github.ref_type == 'tag' && env.NUGET_TOKEN_EXISTS == 'true' # Skip NuGet publish for scheduled nightly builds or if run on a fork without the secret
       run: |
         nuget push src\**\*.nupkg -Source https://api.nuget.org/v3/index.json -ApiKey ${{ secrets.NUGET_TOKEN }} -SymbolApiKey ${{ secrets.NUGET_TOKEN }}
 
+  post-build:
+    runs-on: ubuntu-latest
+
+    needs:
+    - automation
+    - build-pack-publish
+
+    if: needs.automation.outputs.enabled && github.event_name == 'push'
+
+    env:
+      GH_TOKEN: ${{ secrets[needs.automation.outputs.token-secret-name] }}
+
+    steps:
+    - name: check out code
+      uses: actions/checkout@v4
+      with:
+        token: ${{ secrets[needs.automation.outputs.token-secret-name] }}
+
     - name: Create GitHub Release
-      if: github.ref_type == 'tag' || inputs.tag
+      if: github.ref_type == 'tag'
       shell: pwsh
       run: |
         Import-Module .\build\scripts\post-release.psm1
 
         CreateRelease `
-          -tag '${{ inputs.tag || github.ref_name }}'
-      env:
-        GH_TOKEN: ${{ github.token }}
+          -gitRepository '${{ github.repository }}' `
+          -tag '${{ github.ref_name }}'
 
-    - name: Create GitHub Pull Request to update PackageValidationBaselineVersion in projects
-      if: |
-        (github.ref_type == 'tag' && !contains(github.ref_name, '-alpha') && !contains(github.ref_name, '-beta') && !contains(github.ref_name, '-rc'))
-        || (inputs.tag && !contains(inputs.tag, '-alpha') && !contains(inputs.tag, '-beta') && !contains(inputs.tag, '-rc'))
+    - name: Post notice when packages are ready
       shell: pwsh
       run: |
         Import-Module .\build\scripts\post-release.psm1
 
-        CreatePackageValidationBaselineVersionUpdatePullRequest `
-          -tag '${{ inputs.tag || github.ref_name }}'
-      env:
-        GH_TOKEN: ${{ github.token }}
+        TryPostPackagesReadyNoticeOnPrepareReleasePullRequest `
+          -gitRepository '${{ github.repository }}' `
+          -tag '${{ github.ref_name }}' `
+          -tagSha '${{ github.sha }}' `
+          -packagesUrl '${{ needs.build-pack-publish.outputs.artifact-url }}' `
+          -botUserName '${{ needs.automation.outputs.username }}'