Conversation
IdansPort
force-pushed
the
OCEAN-RC-RELEASE-WORKFLOW
branch
from
796b903 to
b7da745
Compare
PR Compliance Guide 🔍Below is a summary of compliance checks for this PR:
Compliance status legend🟢 - Fully Compliant🟡 - Partial Compliant 🔴 - Not Compliant ⚪ - Requires Further Human Verification 🏷️ - Compliance label |
||||||||||||||||||||||||||
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: Validate inputs | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| version: ${{ steps.validate.outputs.version }} | ||
| steps: | ||
| - name: Check out source branch | ||
| uses: actions/checkout@v5 | ||
| with: | ||
| ref: ${{ inputs.source_branch }} | ||
| fetch-depth: 1 | ||
|
|
||
| - name: Validate version format and pyproject.toml | ||
| id: validate | ||
| run: | | ||
| VERSION="${{ inputs.rc_version }}" | ||
| # Validate RC version format (X.Y.Z-rcN) | ||
| if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+-rc[0-9]+$ ]]; then | ||
| echo "::error::Invalid RC version format. Expected: X.Y.Z-rcN (e.g., 0.38.0-rc1)" | ||
| exit 1 | ||
| fi | ||
| # Check version in pyproject.toml matches | ||
| PYPROJECT_VERSION=$(grep -E '^version = ".*"' pyproject.toml | cut -d'"' -f2) | ||
| if [[ "$PYPROJECT_VERSION" != "$VERSION" ]]; then | ||
| echo "::error::Version in pyproject.toml ($PYPROJECT_VERSION) doesn't match input ($VERSION). Please update pyproject.toml on the source branch first." | ||
| exit 1 | ||
| fi | ||
| echo "version=$VERSION" >> $GITHUB_OUTPUT | ||
| echo "Version validation passed: $VERSION" | ||
| - name: Check tag doesn't exist | ||
| run: | | ||
| if git ls-remote --tags origin | grep -q "refs/tags/v${{ inputs.rc_version }}$"; then | ||
| echo "::error::Tag v${{ inputs.rc_version }} already exists. Use a different RC version." | ||
| exit 1 | ||
| fi | ||
| echo "Tag v${{ inputs.rc_version }} does not exist. Proceeding..." | ||
| publish-core-rc: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 7 hours ago
In general, the fix is to explicitly declare minimal GITHUB_TOKEN permissions in the workflow, rather than relying on repository or organization defaults. Since the shown jobs only need to read repository contents (for actions/checkout) and do not write to the repository, we can set contents: read at the workflow level. This will apply to all jobs unless they override permissions individually.
The single best way to fix this without changing functionality is to add a root-level permissions block directly under the name: Release RC line (before on:). Set contents: read as the starting point; no other scopes appear necessary for the code shown. This keeps behavior the same while documenting and constraining the token. No new imports, actions, or commands are required; it is purely a YAML configuration change in .github/workflows/release-rc.yml.
| @@ -1,4 +1,6 @@ | ||
| name: Release RC | ||
| permissions: | ||
| contents: read | ||
| on: | ||
| workflow_dispatch: | ||
| inputs: |
| name: Publish RC core to PyPI | ||
| needs: validate-inputs | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Set up Python 3.12 | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: '3.12' | ||
|
|
||
| - name: Checkout source branch | ||
| uses: actions/checkout@v5 | ||
| with: | ||
| ref: ${{ inputs.source_branch }} | ||
|
|
||
| - name: Build package | ||
| run: | | ||
| make install | ||
| make build | ||
| - name: Publish package to PyPI | ||
| uses: pypa/gh-action-pypi-publish@release/v1 | ||
| with: | ||
| user: ${{ env.PYPI_USERNAME }} | ||
| password: ${{ env.PYPI_PASSWORD }} | ||
| packages-dir: ${{ github.workspace }}/dist | ||
|
|
||
| - name: Wait for package to be available on PyPI | ||
| run: | | ||
| VERSION="${{ inputs.rc_version }}" | ||
| MAX_ATTEMPTS=30 | ||
| ATTEMPT=0 | ||
| echo "Waiting for port-ocean==$VERSION to be available on PyPI..." | ||
| while ! curl -s https://pypi.org/pypi/port-ocean/json | jq -e ".releases | has(\"$VERSION\")" > /dev/null; do | ||
| ATTEMPT=$((ATTEMPT + 1)) | ||
| if [ $ATTEMPT -ge $MAX_ATTEMPTS ]; then | ||
| echo "::error::Timeout waiting for package $VERSION to be available on PyPI after $((MAX_ATTEMPTS * 10)) seconds" | ||
| exit 1 | ||
| fi | ||
| echo "Waiting for package $VERSION to be available on PyPI... (attempt $ATTEMPT/$MAX_ATTEMPTS)" | ||
| sleep 10 | ||
| done | ||
| echo "Package port-ocean==$VERSION is now available on PyPI" | ||
| tag-source-branch: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 7 hours ago
To fix the problem, add an explicit permissions block specifying the minimal required GITHUB_TOKEN scope. Since the publish-core-rc job only needs to read the repository contents (to check out and build) and does not push code or modify GitHub resources, it can safely use contents: read. Other scopes (issues, pull-requests, packages, etc.) are not used here.
The best minimally invasive fix is to add a job-level permissions block under publish-core-rc:. This documents the job’s needs and prevents it from inheriting broader repository or organization defaults. Concretely, in .github/workflows/release-rc.yml, within the publish-core-rc job definition (around lines 80–84), add:
publish-core-rc:
name: Publish RC core to PyPI
needs: validate-inputs
runs-on: ubuntu-latest
permissions:
contents: readNo imports, methods, or additional definitions are needed; this is a pure workflow configuration change and does not alter the functional behavior of the job, only the permissions of GITHUB_TOKEN.
| @@ -81,6 +81,8 @@ | ||
| name: Publish RC core to PyPI | ||
| needs: validate-inputs | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| steps: | ||
| - name: Set up Python 3.12 | ||
| uses: actions/setup-python@v5 |
| name: Prepare integration matrix | ||
| runs-on: ubuntu-latest | ||
| needs: publish-core-rc | ||
| outputs: | ||
| matrix: ${{ steps.prepare-matrix.outputs.INTEGRATIONS_MATRIX }} | ||
| steps: | ||
| - name: Check out source branch | ||
| uses: actions/checkout@v5 | ||
| with: | ||
| ref: ${{ inputs.source_branch }} | ||
|
|
||
| - name: Prepare matrix of all integrations | ||
| id: prepare-matrix | ||
| run: | | ||
| integrations=() | ||
| # Get the list of all integrations | ||
| files=$(find integrations/*/.port -name "spec.yaml") | ||
| for file in $files; do | ||
| folder=$(dirname "$file") | ||
| # Skip fake-integration (test integration) | ||
| if [[ "$folder" == *"fake-integration"* ]]; then | ||
| echo "Skipping fake-integration" | ||
| continue | ||
| fi | ||
| integrations+=("$file") | ||
| done | ||
| if [ ${#integrations[@]} -eq 0 ]; then | ||
| matrix_json='[]' | ||
| echo "No integrations found" | ||
| else | ||
| matrix_json=$(printf '%s\n' "${integrations[@]}" | jq -R -s -c 'split("\n")[:-1]') | ||
| echo "Found ${#integrations[@]} integrations to build" | ||
| fi | ||
| echo "INTEGRATIONS_MATRIX=$matrix_json" >> $GITHUB_OUTPUT | ||
| build-rc-integrations: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 7 hours ago
In general, the fix is to explicitly declare minimal GITHUB_TOKEN permissions for any job or workflow that omits them, rather than relying on repository defaults. For this specific case, the prepare-matrix job checks out the repository and reads files via shell commands; it does not push commits, create tags, releases, or interact with packages. Therefore, it only requires contents: read.
The best fix without changing existing functionality is to add a permissions block to the prepare-matrix job with contents: read. This keeps the job’s behavior unchanged while ensuring that, even if the repo/org default token permissions are broader, this job will only have read access to repository contents. Concretely, in .github/workflows/release-rc.yml, under the prepare-matrix job (around line 190), insert:
permissions:
contents: readaligned with the existing job keys (name, runs-on, needs, etc.). No imports or additional definitions are needed, as this is pure workflow configuration.
| @@ -190,6 +190,8 @@ | ||
| name: Prepare integration matrix | ||
| runs-on: ubuntu-latest | ||
| needs: publish-core-rc | ||
| permissions: | ||
| contents: read | ||
| outputs: | ||
| matrix: ${{ steps.prepare-matrix.outputs.INTEGRATIONS_MATRIX }} | ||
| steps: |
| name: RC Release Summary | ||
| runs-on: ubuntu-latest | ||
| needs: [validate-inputs, publish-core-rc, tag-source-branch, build-rc-integrations] | ||
| if: always() | ||
| steps: | ||
| - name: Generate summary | ||
| run: | | ||
| echo "## RC Release Summary" >> $GITHUB_STEP_SUMMARY | ||
| echo "" >> $GITHUB_STEP_SUMMARY | ||
| echo "**Version:** ${{ inputs.rc_version }}" >> $GITHUB_STEP_SUMMARY | ||
| echo "**Source Branch:** ${{ inputs.source_branch }}" >> $GITHUB_STEP_SUMMARY | ||
| echo "" >> $GITHUB_STEP_SUMMARY | ||
| echo "### Job Results" >> $GITHUB_STEP_SUMMARY | ||
| echo "| Job | Status |" >> $GITHUB_STEP_SUMMARY | ||
| echo "|-----|--------|" >> $GITHUB_STEP_SUMMARY | ||
| echo "| Validate Inputs | ${{ needs.validate-inputs.result }} |" >> $GITHUB_STEP_SUMMARY | ||
| echo "| Publish Core RC | ${{ needs.publish-core-rc.result }} |" >> $GITHUB_STEP_SUMMARY | ||
| echo "| Tag Source Branch | ${{ needs.tag-source-branch.result }} |" >> $GITHUB_STEP_SUMMARY | ||
| echo "| Build RC Integrations | ${{ needs.build-rc-integrations.result }} |" >> $GITHUB_STEP_SUMMARY | ||
| echo "" >> $GITHUB_STEP_SUMMARY | ||
| if [[ "${{ needs.publish-core-rc.result }}" == "success" ]]; then | ||
| echo "### Published Artifacts" >> $GITHUB_STEP_SUMMARY | ||
| echo "- **PyPI:** \`pip install port-ocean==${{ inputs.rc_version }}\`" >> $GITHUB_STEP_SUMMARY | ||
| echo "- **Docker Images:** \`ghcr.io/port-labs/port-ocean-{integration}:rc-${{ inputs.rc_version }}\`" >> $GITHUB_STEP_SUMMARY | ||
| echo "- **GitHub Release:** [v${{ inputs.rc_version }}](https://github.com/${{ github.repository }}/releases/tag/v${{ inputs.rc_version }})" >> $GITHUB_STEP_SUMMARY | ||
| fi |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
PR Code Suggestions ✨Explore these optional code suggestions:
|
||||||||||||||
2 participants
User description
Description
What -
Added a new GitHub Actions workflow (release-rc.yml) for releasing Release Candidate
versions of the Ocean framework.
Why -
To enable companies to test pre-release core changes before they're merged to main.
This allows early validation of new features and bug fixes in production-like environments
without affecting the stable release channel.
How -
ghcr.io/port-labs/port-ocean-aws:rc-0.38.0-rc1)
Type of change
Please leave one option from the following and delete the rest:
All tests should be run against the port production environment(using a testing org).
Core testing checklist
Integration testing checklist
examplesfolder in the integration directory.Preflight checklist
Screenshots
Include screenshots from your environment showing how the resources of the integration will look.
API Documentation
Provide links to the API documentation used for this integration.
PR Type
Enhancement
Description
Added GitHub Actions workflow for releasing RC versions
Validates version format and pyproject.toml consistency
Publishes core package to PyPI as pre-release
Creates git tags and GitHub pre-releases
Builds Docker images for all integrations with rc- prefix
Generates comprehensive release summary with artifacts
Diagram Walkthrough
File Walkthrough
release-rc.yml
Complete RC release workflow implementation.github/workflows/release-rc.yml
triggered via manual dispatch
version matches
logic
release notes
updating dependencies
artifacts