From c92eb393a658d1c8116ece01108afafcb6cef3d6 Mon Sep 17 00:00:00 2001 From: Noel <329000203+0xNoel@users.noreply.github.com> Date: Thu, 15 Oct 2026 15:51:24 +0800 Subject: [PATCH 1/2] ci: bump actions to latest versions --- .github/workflows/architecture.yml | 2 +- .github/workflows/build.yml | 2 +- .github/workflows/crowdin.yml | 2 +- .github/workflows/format.yml | 2 +- .github/workflows/nightly.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/architecture.yml b/.github/workflows/architecture.yml index c416a18..d6278bd 100644 --- a/.github/workflows/architecture.yml +++ b/.github/workflows/architecture.yml @@ -24,7 +24,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK 21 - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: distribution: temurin java-version: '21' diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index c16a35d..5e533e5 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -41,7 +41,7 @@ jobs: cache-dependency-path: web-ui/package-lock.json - name: Set up JDK 21 - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: distribution: temurin java-version: '21' diff --git a/.github/workflows/crowdin.yml b/.github/workflows/crowdin.yml index 1388715..69588f2 100644 --- a/.github/workflows/crowdin.yml +++ b/.github/workflows/crowdin.yml @@ -23,7 +23,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python 3.15 - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.15' diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml index c56a410..05e7f16 100644 --- a/.github/workflows/format.yml +++ b/.github/workflows/format.yml @@ -33,7 +33,7 @@ jobs: cache-dependency-path: web-ui/package-lock.json - name: Set up JDK 21 - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: distribution: temurin java-version: '21' diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 4fa52e5..45a0784 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -33,7 +33,7 @@ jobs: cache-dependency-path: web-ui/package-lock.json - name: Set up JDK 21 - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: distribution: temurin java-version: '21' From 6e11a0e922a5e9c98114203b7fc9c0a51901a7fe Mon Sep 17 00:00:00 2001 From: Noel <329000203+0xNoel@users.noreply.github.com> Date: Thu, 15 Oct 2026 16:54:29 +0800 Subject: [PATCH 2/2] ci: add draft release workflow --- .github/workflows/release.yml | 96 +++++++++++++++++++++++++++++++++++ 1 file changed, 96 insertions(+) create mode 100644 .github/workflows/release.yml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..159027c --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,96 @@ +name: Release + +on: + workflow_dispatch: + +permissions: + actions: read + contents: write + id-token: write + attestations: write + +concurrency: + group: release + cancel-in-progress: false + +jobs: + release: + name: Draft release + if: github.ref == 'refs/heads/main' + runs-on: ubuntu-latest + env: + GRADLE_ENCRYPTION_KEY: ${{ secrets.GRADLE_ENCRYPTION_KEY }} + + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - name: Select release token + id: release-token + env: + GH_TOKEN: ${{ github.token }} + run: | + actor_id="$(gh api \ + "repos/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/attempts/${GITHUB_RUN_ATTEMPT}" \ + --jq '.triggering_actor.id')" + echo "secret-name=PAT_${actor_id}" >> "${GITHUB_OUTPUT}" + + - name: Set up Node.js 24 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 + with: + node-version: '24' + cache: npm + cache-dependency-path: web-ui/package-lock.json + + - name: Set up JDK 21 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 + with: + distribution: temurin + java-version: '21' + + - name: Set up Gradle + uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0 + with: + cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }} + + - name: Cache Gradle configuration + if: env.GRADLE_ENCRYPTION_KEY != '' + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: .gradle/configuration-cache + key: cc-${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }}-${{ github.sha }} + restore-keys: | + cc-${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }}- + + - name: Build + run: | + chmod +x gradlew + ./gradlew assemble -PreleaseBuild=true --no-daemon --console=plain + + - name: Attest build provenance + id: attest + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 + with: + subject-path: build/libs/12pit.jar + + - name: Create draft release + env: + GH_TOKEN: ${{ secrets[steps.release-token.outputs.secret-name] || github.token }} + ATTESTATION_BUNDLE: ${{ steps.attest.outputs.bundle-path }} + ATTESTATION_URL: ${{ steps.attest.outputs.attestation-url }} + run: | + set -euo pipefail + + release_version="$(sed -n 's/^modVersion=//p' gradle.properties)" + cp "${ATTESTATION_BUNDLE}" build/libs/12pit.jar.sigstore.json + cat > "${RUNNER_TEMP}/release-notes.md" <