Release production

.github/scripts/chart-release.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+# Compute chart version bumps since the last chart-apps@v<version> tag
+# and apply them to the working tree, using git-cliff.
+#
+# Prints to on stdout:
+#   INITIAL chart-apps@vX.Y.Z      initial tag on first run
+#   RELEASE <chart> vX, ...        version bumps applied to charts/<chart>/Chart.yaml
+#   NONE                           nothing to release
+#
+# Run from the repository root. Requires git-cliff on PATH. Set DRY_RUN=true to
+# preview changes that would be made.
+set -euo pipefail
+
+DRY_RUN="${DRY_RUN:-}"
+
+apps_file="charts/apps/Chart.yaml"
+apps_current=$(sed -n 's/^version: *//p' "${apps_file}")
+apps_tag="chart-apps@v${apps_current}"
+
+# No apps tag yet: first run. Create an initial for the current state.
+if ! git rev-parse -q --verify "refs/tags/${apps_tag}" >/dev/null; then
+  git tag "${apps_tag}" HEAD
+  echo "INITIAL ${apps_tag}"
+  exit 0
+fi
+
+# Nothing changed since the last apps tag: no release.
+if [ -z "$(git log --format=%h "${apps_tag}..HEAD" -- charts/)" ]; then
+  echo "NONE"
+  exit 0
+fi
+
+bumped=()
+
+# Determine next charts/apps version
+apps_next=$(git cliff "${apps_tag}..HEAD" \
+  --include-path "charts/apps/**" \
+  --tag-pattern "chart-apps@v[0-9]*" \
+  --bumped-version 2>/dev/null)
+apps_next=${apps_next#chart-apps@v}
+if [ -z "${apps_next}" ]; then
+  echo "error: could not determine the next version for apps" >&2
+  exit 1
+fi
+if [ "${apps_next}" = "${apps_current}" ]; then
+  # apps itself but another changed. Patch bump apps.
+  apps_next=$(awk -F. '{$NF=$NF+1; print}' OFS=. <<<"${apps_current}")
+fi
+echo "apps: ${apps_current} -> ${apps_next}"
+bumped+=("apps v${apps_next}")
+if [ -z "${DRY_RUN}" ]; then
+  sed -i "s/^version: .*/version: ${apps_next}/" "${apps_file}"
+fi
+
+# Determine next charts/apps version
+for dir in charts/*/; do
+  [ -f "${dir}Chart.yaml" ] || continue
+  [ "${dir%/}" = "charts/apps" ] && continue
+  chart=$(basename "${dir}")
+  file="${dir}Chart.yaml"
+  current=$(sed -n 's/^version: *//p' "${file}")
+  # Baseline = this chart's released version at the last apps tag.
+  baseline=$(git show "${apps_tag}:${file}" 2>/dev/null | sed -n 's/^version: *//p')
+  baseline="${baseline:-${current}}"   # chart added after the apps tag
+
+  # Temporary tag needed by git-cliff to compute
+  # this chart's version bump since last release
+  git tag -f "temporary-chart-${chart}@v${baseline}" "${apps_tag}" >/dev/null
+
+  next=$(git cliff "${apps_tag}..HEAD" \
+    --include-path "charts/${chart}/**" \
+    --tag-pattern "temporary-chart-${chart}@v[0-9]*" \
+    --bumped-version 2>/dev/null)
+  next=${next#temporary-chart-"${chart}"@v}
+
+  git tag -d "temporary-chart-${chart}@v${baseline}" >/dev/null
+
+  if [ -z "${next}" ]; then
+    echo "error: could not determine the next version for ${chart}" >&2
+    exit 1
+  fi
+  if [ "${next}" = "${current}" ]; then
+    continue
+  fi
+
+  echo "${chart}: ${current} -> ${next}"
+  bumped+=("${chart} v${next}")
+  if [ -z "${DRY_RUN}" ]; then
+    sed -i "s/^version: .*/version: ${next}/" "${file}"
+  fi
+done
+
+if [ ${#bumped[@]} -eq 0 ]; then
+  echo "NONE"
+  exit 0
+fi
+
+echo "RELEASE $(printf '%s, ' "${bumped[@]}" | sed 's/, $//')"

.github/workflows/_auth_broker_code.yaml

@@ -8,16 +8,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install stable toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1.16.1
+        uses: actions-rust-lang/setup-rust-toolchain@a188e68d0fd2bd36ad51dccb2b07ba6e75105f30 # v2.0.1
         with:
           cache: false
           components: clippy,rustfmt
 
       - name: Cache Rust Build
-        uses: Swatinem/rust-cache@v2.9.1
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           shared-key: backend/auth-broker
           workspaces: backend
@@ -39,25 +39,25 @@ jobs:
           --deny warnings
 
       - name: Check Dependencies with Cargo Deny
-        uses: EmbarkStudios/cargo-deny-action@v2.0.20
+        uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
         with:
-          command: check licenses ban
+          command: check licenses bans
           manifest-path: backend/Cargo.toml
 
   test:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install stable toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1.16.1
+        uses: actions-rust-lang/setup-rust-toolchain@a188e68d0fd2bd36ad51dccb2b07ba6e75105f30 # v2.0.1
         with:
           cache: false
           components: rustfmt
 
       - name: Cache Rust Build
-        uses: Swatinem/rust-cache@v2.9.1
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           shared-key: backend/auth-broker
           workspaces: backend

.github/workflows/_auth_broker_container.yaml

@@ -10,14 +10,14 @@ jobs:
       packages: write
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Generate Image Name
         run: echo IMAGE_REPOSITORY=ghcr.io/$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]' | tr '[_]' '[\-]')-auth-broker >> $GITHUB_ENV
 
       - name: Log in to GitHub Docker Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4.2.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -29,18 +29,18 @@ jobs:
 
       - name: Docker Metadata
         id: meta
-        uses: docker/metadata-action@v6.1.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ${{ env.IMAGE_REPOSITORY }}
           tags: |
             type=raw,value=${{ steps.tags.outputs.version }}
             type=raw,value=staging
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4.0.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build Image
-        uses: docker/build-push-action@v6.18.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: backend
           file: backend/Dockerfile.auth-broker

.github/workflows/_auth_core_code.yaml

@@ -8,16 +8,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install stable toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1.16.1
+        uses: actions-rust-lang/setup-rust-toolchain@a188e68d0fd2bd36ad51dccb2b07ba6e75105f30 # v2.0.1
         with:
           cache: false
           components: clippy,rustfmt
 
       - name: Cache Rust Build
-        uses: Swatinem/rust-cache@v2.9.1
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           shared-key: backend/auth-core
           workspaces: backend
@@ -39,25 +39,25 @@ jobs:
           --deny warnings
 
       - name: Check Dependencies with Cargo Deny
-        uses: EmbarkStudios/cargo-deny-action@v2.0.20
+        uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
         with:
-          command: check licenses ban
+          command: check licenses bans
           manifest-path: backend/Cargo.toml
 
   test:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install stable toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1.16.1
+        uses: actions-rust-lang/setup-rust-toolchain@a188e68d0fd2bd36ad51dccb2b07ba6e75105f30 # v2.0.1
         with:
           cache: false
           components: rustfmt
 
       - name: Cache Rust Build
-        uses: Swatinem/rust-cache@v2.9.1
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           shared-key: backend/auth-core
           workspaces: backend

.github/workflows/_auth_gateway_code.yaml

@@ -8,16 +8,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install stable toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1.16.1
+        uses: actions-rust-lang/setup-rust-toolchain@a188e68d0fd2bd36ad51dccb2b07ba6e75105f30 # v2.0.1
         with:
           cache: false
           components: clippy,rustfmt
 
       - name: Cache Rust Build
-        uses: Swatinem/rust-cache@v2.9.1
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           shared-key: backend/auth-gateway
           workspaces: backend
@@ -39,25 +39,25 @@ jobs:
           --deny warnings
 
       - name: Check Dependencies with Cargo Deny
-        uses: EmbarkStudios/cargo-deny-action@v2.0.20
+        uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
         with:
-          command: check licenses ban
+          command: check licenses bans
           manifest-path: backend/Cargo.toml
 
   test:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install stable toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1.16.1
+        uses: actions-rust-lang/setup-rust-toolchain@a188e68d0fd2bd36ad51dccb2b07ba6e75105f30 # v2.0.1
         with:
           cache: false
           components: rustfmt
 
       - name: Cache Rust Build
-        uses: Swatinem/rust-cache@v2.9.1
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           shared-key: backend/auth-gateway
           workspaces: backend

.github/workflows/_auth_gateway_container.yaml

@@ -10,14 +10,14 @@ jobs:
       packages: write
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Generate Image Name
         run: echo IMAGE_REPOSITORY=ghcr.io/$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]' | tr '[_]' '[\-]')-auth-gateway >> $GITHUB_ENV
 
       - name: Log in to GitHub Docker Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4.2.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -29,18 +29,18 @@ jobs:
 
       - name: Docker Metadata
         id: meta
-        uses: docker/metadata-action@v6.1.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ${{ env.IMAGE_REPOSITORY }}
           tags: |
             type=raw,value=${{ steps.tags.outputs.version }}
             type=raw,value=latest
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.11.1
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build Image
-        uses: docker/build-push-action@v6.18.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: backend
           file: backend/Dockerfile.auth-gateway

.github/workflows/_auto_assign.yaml

@@ -10,6 +10,6 @@ jobs:
       !startsWith(github.head_ref, 'release-please--') &&
       !startsWith(github.head_ref, 'dependabot/')
     steps:
-      - uses: kentaro-m/auto-assign-action@v2.0.2
+      - uses: kentaro-m/auto-assign-action@0a2c53d3721e4c5cfcce6afd4014aecc337979f6 # v2.0.2
         with:
           configuration-path: .github/auto_assign_config.yaml