diff --git a/.github/workflows/chocolatey.yml b/.github/workflows/chocolatey.yml index 6fd898995f9..209ad040597 100644 --- a/.github/workflows/chocolatey.yml +++ b/.github/workflows/chocolatey.yml @@ -21,13 +21,13 @@ # # The package downloads the installer from archive.apache.org rather than # carrying a copy, so it cannot be built until the release has been promoted -# and the archive has picked it up. If the release run is too early, run it -# again from the Actions tab once the archive has the file. +# and the archive has picked it up. If the release run is too early, re-run it +# once the archive has the file, or start this workflow from the Actions tab +# with the version. # -# Nothing is pushed until the CHOCO_API_KEY secret exists. The "thrift" id on -# the Chocolatey community repository currently belongs to an abandoned third -# party package, and a maintainer takeover has to be granted first. See -# doc/ReleaseManagement.md. +# Nothing is pushed unless the CHOCO_API_KEY secret is set, to the API key of +# an account that maintains the "thrift" package on the Chocolatey community +# repository. See doc/ReleaseManagement.md. name: "Chocolatey" @@ -109,9 +109,11 @@ jobs: shell: pwsh env: VERSION: ${{ steps.version.outputs.version }} - IS_RELEASE: ${{ github.event_name == 'release' }} + # A release and a manual run both push, so only a pull request + # packages a placeholder. + IS_PULL_REQUEST: ${{ github.event_name == 'pull_request' }} run: | - if ($env:IS_RELEASE -eq 'true') { + if ($env:IS_PULL_REQUEST -ne 'true') { # No checksum given, so the published installer is downloaded and # hashed. The package then cannot record a checksum the published # file does not have. @@ -147,7 +149,9 @@ jobs: push: name: Push to Chocolatey needs: package - if: ${{ github.event_name == 'release' && !github.event.release.prerelease }} + # A manual run is how a release gets pushed once the archive has the + # installer, so it pushes too. + if: ${{ github.event_name == 'workflow_dispatch' || (github.event_name == 'release' && !github.event.release.prerelease) }} runs-on: windows-2025 timeout-minutes: 20 environment: release @@ -169,19 +173,16 @@ jobs: $package = "chocolatey-package/thrift.$env:VERSION.nupkg" if (-not $env:CHOCO_API_KEY) { - # Expected until the "thrift" id has been handed over. The package - # is built and attached to the run either way. + # The package is built and attached to the run either way. Write-Host '::warning::CHOCO_API_KEY is not set, so nothing was pushed to Chocolatey.' @( '### Chocolatey push skipped', '', - 'The `CHOCO_API_KEY` secret is not set in the `release` environment, so the', - 'package was built but not pushed. It is attached to this run as the', - '`chocolatey-package` artifact.', + 'The `CHOCO_API_KEY` secret is not set, so the package was built but not', + 'pushed. It is attached to this run as the `chocolatey-package` artifact.', '', - 'The `thrift` id on the Chocolatey community repository still belongs to an', - 'abandoned third party package; a maintainer takeover has to be granted before', - 'anything can be pushed under it. See `doc/ReleaseManagement.md`.' + 'The key has to belong to an account that maintains the `thrift` package on', + 'the Chocolatey community repository. See `doc/ReleaseManagement.md`.' ) | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Append exit 0 } diff --git a/.github/workflows/winget.yml b/.github/workflows/winget.yml index ba3dc7daebb..ba01a9a2801 100644 --- a/.github/workflows/winget.yml +++ b/.github/workflows/winget.yml @@ -22,8 +22,8 @@ # The manifest points at archive.apache.org, which keeps every release, rather # than downloads.apache.org, which only carries the current one. So this cannot # run until the release has been promoted and the archive has picked it up. If -# the release run is too early, run it again from the Actions tab once the -# archive has the file. +# the release run is too early, re-run it once the archive has the file, or +# start this workflow from the Actions tab with the version and release date. name: "WinGet" @@ -133,9 +133,11 @@ jobs: env: VERSION: ${{ steps.version.outputs.version }} RELEASE_DATE: ${{ steps.version.outputs.release_date }} - IS_RELEASE: ${{ github.event_name == 'release' }} + # A release and a manual run both submit, so only a pull request + # renders with a placeholder. + IS_PULL_REQUEST: ${{ github.event_name == 'pull_request' }} run: | - if ($env:IS_RELEASE -eq 'true') { + if ($env:IS_PULL_REQUEST -ne 'true') { # No checksum given, so the renderer downloads the published # installer and hashes that. The manifest then cannot claim a # checksum the published file does not have. @@ -192,7 +194,9 @@ jobs: submit: name: Submit to winget-pkgs needs: manifests - if: ${{ github.event_name == 'release' && !github.event.release.prerelease }} + # A manual run is how a release gets submitted once the archive has the + # installer, so it submits too. + if: ${{ github.event_name == 'workflow_dispatch' || (github.event_name == 'release' && !github.event.release.prerelease) }} # wingetcreate only runs on Windows. runs-on: windows-2025 timeout-minutes: 20 @@ -224,9 +228,9 @@ jobs: @( '### WinGet submission skipped', '', - 'The `WINGET_TOKEN` secret is not set in the `release` environment, so the', - 'manifests were rendered but not submitted. They are attached to this run as the', - '`winget-manifests` artifact. To submit them by hand, from a Windows machine:', + 'The `WINGET_TOKEN` secret is not set, so the manifests were rendered but not', + 'submitted. They are attached to this run as the `winget-manifests` artifact.', + 'To submit them by hand, from a Windows machine:', '', '```powershell', 'curl.exe -JLO https://aka.ms/wingetcreate/latest', diff --git a/doc/ReleaseManagement.md b/doc/ReleaseManagement.md index 4d985ca26fc..b8a305105c1 100644 --- a/doc/ReleaseManagement.md +++ b/doc/ReleaseManagement.md @@ -443,7 +443,9 @@ file and the `release` environment. | `WINGET_TOKEN` | repository **secret** | `winget.yml` | nothing is submitted; see below | | `CHOCO_API_KEY` | repository **secret** | `chocolatey.yml` | nothing is pushed; see below | -All of them are scoped to the `release` [environment](https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments). +The publishing jobs run in the `release` [environment](https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments), +which the trusted publishers name. The secrets and the variable can be set for +the repository or for that environment. `GITHUB_TOKEN` is provided by Actions itself and needs no setup. Two notes that are easy to get wrong: @@ -456,9 +458,6 @@ Two notes that are easy to get wrong: to publish by hand. That keeps a missing secret from failing a release, but it means the run summary is what to read, not the tick. -`CHOCO_API_KEY` is expected to be missing for now - see -[Chocolatey](#chocolatey) below, the package id has not been handed over yet. - ### Post-Release 1. Visit https://reporter.apache.org/addrelease.html?thrift and register it. You will get an automated reminder as the one who committed into dist. This informs the Apache Board of Directors of releases through project reports. @@ -510,6 +509,25 @@ GitHub is what the signatures on `dist.apache.org` cover. ~$ gh release upload v1.0.0 thrift-1.0.0-setup.exe --clobber --repo apache/thrift ``` +If the installer was not part of the release candidate, it is missing from +`dist/release` too, and the Chocolatey and WinGet runs of the release fail to +download it. To add it afterwards: + +1. Build it from the voted compiler, with Inno Setup 6.3 or later, in a checkout + of the release tag, which provides the `LICENSE` and `NOTICE` it installs: + + ```powershell + PS C:\thrift> .\build\windows\build-installer.ps1 -Version 1.0.0 -Compiler C:\dist\thrift-1.0.0.exe -OutputDir dist + ``` + + The `windows-installer` artifact of the `Windows packages` workflow will not + do: it contains a compiler that the workflow built itself, not the voted one. +1. Sign and checksum it the same way as the other release artifacts, and commit + it with its signature and checksums to `dist/release/thrift/1.0.0`. +1. Overwrite the asset on the GitHub release with it, as shown above. +1. Once `archive.apache.org` has the file, run the [Chocolatey](#chocolatey) and + [WinGet](#winget) workflows again, as described below. + ##### Chocolatey The [`Chocolatey`](../.github/workflows/chocolatey.yml) workflow builds the @@ -520,27 +538,15 @@ The package does not carry the compiler. It downloads the installer from `archive.apache.org` and records its checksum, so it can only be built once the archive has the release - `downloads.apache.org` only carries the current release, and a package naming it would stop installing at the next one. If the -release run was too early, run it again from the Actions tab once the archive -has the file. - -**Nothing is pushed yet.** The `thrift` id on the Chocolatey community -repository belongs to a third-party package that last shipped 0.12.0 in February -2019, maintained by `chaliy` and `Lite` from -. Before Apache Thrift can publish -under that id, a maintainer takeover has to be requested from Chocolatey under -their process for abandoned packages: - -1. Contact the current maintainers through their Chocolatey profile page and - allow the response time Chocolatey's policy requires. -1. If there is no response, open a maintainer takeover request with Chocolatey. -1. Once the id has been handed over, add the API key of the account that owns it - as a secret named `CHOCO_API_KEY` in the `release` environment. - -Until then the workflow builds and checks the package, attaches it to the run as -an artifact, and says in its summary that it did not push. If the takeover is -refused, the free ids `apache-thrift` and `thrift-compiler` are the fallback; -changing the id means editing `build/windows/chocolatey/thrift.nuspec.in` and -the package name the build script expects. +release run was too early, re-run it once the archive has the file, which GitHub +allows for 30 days, or start the workflow from the Actions tab (*Run workflow*) +with the released version. + +The workflow pushes with the API key in the secret `CHOCO_API_KEY`, which has to +belong to an account that maintains the `thrift` package on the Chocolatey +community repository. Without the secret it builds and checks the package, +attaches it to the run as an artifact, and says in its summary that it did not +push. Chocolatey checks every pushed version before it is listed. ##### WinGet @@ -554,16 +560,18 @@ up - the manifest points at the archive, because `downloads.apache.org` only carries the current release and a manifest naming it would stop working at the next one. This is the same wait the Docker Official Image update has. -So expect to run it again, from the Actions tab, a while after the release: +So expect to run it again a while after the release. Re-running the release's +run works for 30 days; starting the workflow from the Actions tab always works: -1. Actions → `WinGet` → *Run workflow*, entering the released version. +1. Actions → `WinGet` → *Run workflow*, entering the released version and its + release date. Without a date, the manifest records the day of the run. 1. The workflow renders the manifests, downloads the published installer to compute its checksum, validates the manifests against the WinGet schemas, and opens a pull request against `microsoft/winget-pkgs`. 1. Watch that pull request. Submissions are reviewed, and validation failures are reported there. -For the submission step the `release` environment needs a secret named +For the submission step the workflow needs a secret named `WINGET_TOKEN`: a **classic** GitHub personal access token with the `public_repo` scope. Fine-grained tokens are not supported by `wingetcreate`. Without it the workflow still renders and validates the manifests and leaves them as an