diff --git a/.changeset/cicd-changesets-bun-support.md b/.changeset/cicd-changesets-bun-support.md deleted file mode 100644 index e3461cbac..000000000 --- a/.changeset/cicd-changesets-bun-support.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -"cicd-changesets": minor ---- - -Let a bun repo run its own releases. - -The action installed Node and pnpm unconditionally and ran `pnpm install`, so a -repo whose dependencies are managed by bun could not use it: there was no pnpm -lockfile to install from, and `node-version-file` had no `engines.node` to read -in a package.json that pins `engines.bun` instead. It failed at the Node setup -step, before any changesets work. - -A new `package-manager` input selects the toolchain. It defaults to `pnpm`, so -every existing caller is unaffected. Set it to `bun` and Node and pnpm are not -installed at all: bun is set up and `bun install --frozen-lockfile` runs -instead. - -The bun version is read from the repo's own pin, so the workflow does not have -to restate it (and let it drift). `bun-version` still wins when set, but it -defaults to empty, and the action then resolves the version from -`bun-version-file` or auto-detection. setup-bun already reads `.tool-versions`, -`.bun-version`, and `package.json` natively, so those are forwarded to it -unchanged; the action reads `mise.toml`, `.mise.toml`, and -`.config/mise/config.toml` itself (setup-bun does not understand mise) and -passes the version to setup-bun. Auto-detection tries a mise file first, then -forwards `.tool-versions` or `.bun-version` if present, and setup-bun finally -reads `package.json` or installs `latest`. - -`changesets-publish-cmd` and `changesets-version-cmd` now default to -` run ci:changeset:{publish,version}` rather than hard-coding -`pnpm`, so a bun caller that overrides neither does not shell out to a pnpm that -was never installed. A pnpm caller resolves to the same two commands as before. - -The `signed-commits` action needed no change. It runs whichever commands it is -given, and bun installs a normal `node_modules` tree, so it resolves -`@changesets/cli/bin.js` exactly as it does under pnpm. diff --git a/.changeset/flat-worms-escape.md b/.changeset/flat-worms-escape.md deleted file mode 100644 index 906f9e633..000000000 --- a/.changeset/flat-worms-escape.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"cicd-changesets": minor ---- - -Support bun for package management diff --git a/.changeset/promote-image-ecr-cosign-refs.md b/.changeset/promote-image-ecr-cosign-refs.md deleted file mode 100644 index 84ff955a5..000000000 --- a/.changeset/promote-image-ecr-cosign-refs.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -"promote-image-ecr": minor ---- - -Stop passing skopeo transport URLs to cosign. - -The action copies with `cosign copy`, but the script still built image references -in skopeo's form, `docker:///:`. cosign parses references -with go-containerregistry, which reads everything before the first `/` as the -registry: it took `docker:` as the host and tried to reach `https://docker/v2/`, -so every promotion failed on DNS before a registry was contacted. - - Error: Get "https://docker/v2/": dial tcp: lookup docker on 127.0.0.53:53: server misbehaving - -This affected both the single-image and the images-matrix paths, and every -released version, so no promotion this action ran has ever succeeded. - -The rest is the remainder of the same unfinished skopeo-to-cosign migration. - -`copy-signatures` is removed. It was documented as a switch to skopeo, but no -skopeo path exists and the script never read the value, so setting it to `false` -did not change what the action did. `cosign copy` always carries signatures and -attestations. No caller in the org passes it. - -`SKOPEO_ARGS` and the `SRC_PASS`/`DST_PASS` environment variables are removed -from the copy step. `SKOPEO_ARGS` was populated from `inputs.skopeo-additional-args`, -an input this action does not declare, so it always expanded to empty. The two -passwords were what skopeo's `--creds` flags needed; cosign authenticates from -the Docker config that `amazon-ecr-login` writes, and nothing read them. They no -longer enter the step environment. - -Three fixes to the images-matrix path, which was unusable beyond the reference -bug above: - -- The loop read from a pipe, so it ran in a subshell. Its `IMAGE_COUNT` was - discarded and the run always reported `All 0 images copied successfully!`, - and the failure `exit 1` left the subshell rather than the script. It now - reads from a process substitution. -- `sed -i "4i\"` is rejected by GNU sed as `i` with no text after it, so the - summary write failed once copying had succeeded. The total is now inserted by - rewriting the file. The heading it writes was `** Total Images Promoted:**`, - which Markdown does not render as bold; the stray space is gone. -- `action.yaml` described the `images` objects with camelCase keys - (`sourceRepository`), while the script and the README both use snake_case - (`source_repository`). Following the documented casing produced nulls. The - description now matches. - -The `promoted-images` output returns the promotions it promised. It read -`/tmp/promotion-results/promoted-images.json`, a file the script never writes; -results land in `promotion-results.json`. The output was `[]` on every run, -including successful ones. It now reads the `.promotions` array. - -The README's examples were not runnable: they passed underscore input names -(`source_role_arn`) that the action does not declare, all of which are -kebab-case, and pointed `uses:` at a local `./.github/actions/promote-image` -path that does not exist in a consuming repo. diff --git a/actions/cicd-changesets/CHANGELOG.md b/actions/cicd-changesets/CHANGELOG.md index 2fd08b5d9..27a544161 100644 --- a/actions/cicd-changesets/CHANGELOG.md +++ b/actions/cicd-changesets/CHANGELOG.md @@ -1,5 +1,51 @@ # cicd-changesets +## 1.5.0 + +### Minor Changes + +- [#1638](https://github.com/smartcontractkit/.github/pull/1638) + [`6f1ff16`](https://github.com/smartcontractkit/.github/commit/6f1ff166a79b960b7772cc20c08e28436634d3be) + Thanks [@chainchad](https://github.com/chainchad)! - Let a bun repo run its + own releases. + + The action installed Node and pnpm unconditionally and ran `pnpm install`, so + a repo whose dependencies are managed by bun could not use it: there was no + pnpm lockfile to install from, and `node-version-file` had no `engines.node` + to read in a package.json that pins `engines.bun` instead. It failed at the + Node setup step, before any changesets work. + + A new `package-manager` input selects the toolchain. It defaults to `pnpm`, so + every existing caller is unaffected. Set it to `bun` and Node and pnpm are not + installed at all: bun is set up and `bun install --frozen-lockfile` runs + instead. + + The bun version is read from the repo's own pin, so the workflow does not have + to restate it (and let it drift). `bun-version` still wins when set, but it + defaults to empty, and the action then resolves the version from + `bun-version-file` or auto-detection. setup-bun already reads + `.tool-versions`, `.bun-version`, and `package.json` natively, so those are + forwarded to it unchanged; the action reads `mise.toml`, `.mise.toml`, and + `.config/mise/config.toml` itself (setup-bun does not understand mise) and + passes the version to setup-bun. Auto-detection tries a mise file first, then + forwards `.tool-versions` or `.bun-version` if present, and setup-bun finally + reads `package.json` or installs `latest`. + + `changesets-publish-cmd` and `changesets-version-cmd` now default to + ` run ci:changeset:{publish,version}` rather than hard-coding + `pnpm`, so a bun caller that overrides neither does not shell out to a pnpm + that was never installed. A pnpm caller resolves to the same two commands as + before. + + The `signed-commits` action needed no change. It runs whichever commands it is + given, and bun installs a normal `node_modules` tree, so it resolves + `@changesets/cli/bin.js` exactly as it does under pnpm. + +- [#1638](https://github.com/smartcontractkit/.github/pull/1638) + [`6f1ff16`](https://github.com/smartcontractkit/.github/commit/6f1ff166a79b960b7772cc20c08e28436634d3be) + Thanks [@chainchad](https://github.com/chainchad)! - Support bun for package + management + ## 1.4.0 ### Minor Changes diff --git a/actions/cicd-changesets/package.json b/actions/cicd-changesets/package.json index 67d6ceb41..d6e6bdc69 100644 --- a/actions/cicd-changesets/package.json +++ b/actions/cicd-changesets/package.json @@ -1,6 +1,6 @@ { "name": "cicd-changesets", - "version": "1.4.0", + "version": "1.5.0", "description": "changesets", "private": true, "scripts": {}, diff --git a/actions/promote-image-ecr/CHANGELOG.md b/actions/promote-image-ecr/CHANGELOG.md index 5c5db4a31..163d08e77 100644 --- a/actions/promote-image-ecr/CHANGELOG.md +++ b/actions/promote-image-ecr/CHANGELOG.md @@ -1,5 +1,67 @@ # promote-image-ecr +## 0.5.0 + +### Minor Changes + +- [#1640](https://github.com/smartcontractkit/.github/pull/1640) + [`5701615`](https://github.com/smartcontractkit/.github/commit/57016153c0918b1aed29592d6a9a9f50a0cbf74d) + Thanks [@chainchad](https://github.com/chainchad)! - Stop passing skopeo + transport URLs to cosign. + + The action copies with `cosign copy`, but the script still built image + references in skopeo's form, `docker:///:`. cosign parses + references with go-containerregistry, which reads everything before the first + `/` as the registry: it took `docker:` as the host and tried to reach + `https://docker/v2/`, so every promotion failed on DNS before a registry was + contacted. + + Error: Get "https://docker/v2/": dial tcp: lookup docker on 127.0.0.53:53: server misbehaving + + This affected both the single-image and the images-matrix paths, and every + released version, so no promotion this action ran has ever succeeded. + + The rest is the remainder of the same unfinished skopeo-to-cosign migration. + + `copy-signatures` is removed. It was documented as a switch to skopeo, but no + skopeo path exists and the script never read the value, so setting it to + `false` did not change what the action did. `cosign copy` always carries + signatures and attestations. No caller in the org passes it. + + `SKOPEO_ARGS` and the `SRC_PASS`/`DST_PASS` environment variables are removed + from the copy step. `SKOPEO_ARGS` was populated from + `inputs.skopeo-additional-args`, an input this action does not declare, so it + always expanded to empty. The two passwords were what skopeo's `--creds` flags + needed; cosign authenticates from the Docker config that `amazon-ecr-login` + writes, and nothing read them. They no longer enter the step environment. + + Three fixes to the images-matrix path, which was unusable beyond the reference + bug above: + + - The loop read from a pipe, so it ran in a subshell. Its `IMAGE_COUNT` was + discarded and the run always reported `All 0 images copied successfully!`, + and the failure `exit 1` left the subshell rather than the script. It now + reads from a process substitution. + - `sed -i "4i\"` is rejected by GNU sed as `i` with no text after it, so the + summary write failed once copying had succeeded. The total is now inserted + by rewriting the file. The heading it writes was + `** Total Images Promoted:**`, which Markdown does not render as bold; the + stray space is gone. + - `action.yaml` described the `images` objects with camelCase keys + (`sourceRepository`), while the script and the README both use snake_case + (`source_repository`). Following the documented casing produced nulls. The + description now matches. + + The `promoted-images` output returns the promotions it promised. It read + `/tmp/promotion-results/promoted-images.json`, a file the script never writes; + results land in `promotion-results.json`. The output was `[]` on every run, + including successful ones. It now reads the `.promotions` array. + + The README's examples were not runnable: they passed underscore input names + (`source_role_arn`) that the action does not declare, all of which are + kebab-case, and pointed `uses:` at a local `./.github/actions/promote-image` + path that does not exist in a consuming repo. + ## 0.4.0 ### Minor Changes diff --git a/actions/promote-image-ecr/package.json b/actions/promote-image-ecr/package.json index 809e6cde7..cf2a43e6d 100644 --- a/actions/promote-image-ecr/package.json +++ b/actions/promote-image-ecr/package.json @@ -1,6 +1,6 @@ { "name": "promote-image-ecr", - "version": "0.4.0", + "version": "0.5.0", "description": "", "private": true, "scripts": {},