ci(release): migrate release automation to release-please manifest mode

.github/workflows/release.yml

@@ -14,52 +14,19 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  setup-release-context:
-    runs-on: ubuntu-latest
-    outputs:
-      packages: ${{ steps.check-files.outputs.packages }}
-    steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-        with:
-          fetch-depth: 2
-      - name: Get list of workflows with changes
-        id: check-files
-        run: |
-          # Get list of workflows
-          workflow_list=($(basename -a -s .yml $(find .github/workflows/ -type f -print | xargs -I{} grep -l "workflow_call:$" {})))
-          # Get list of workflows to release
-          workflow_with_changes=$(printf "/%s[./]\n" ${workflow_list[@]} | xargs -I{} sh -c "git diff --name-only ${{ github.sha }} ${{ github.sha }}^ | grep -om1 -e '{}' || true" | tr -d /.)
-          releases_with_changes=$(printf "^%s[./]\n" ${workflow_list[@]} | xargs -I{} sh -c "git diff --name-only ${{ github.sha }} ${{ github.sha }}^ | grep -om1 -e '{}' || true" | tr -d /.)
-          # Set list of workflows to release
-          echo "packages=$(jq -cn --args '$ARGS.positional' -- ${workflow_with_changes[@]} ${releases_with_changes[@]})" >> "$GITHUB_OUTPUT"
-        shell: bash
-
   release-please:
-    needs: setup-release-context
-    if: ${{ needs.setup-release-context.outputs.packages != '[]' }}
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        package: ${{ fromJSON(needs.setup-release-context.outputs.packages) }}
     steps:
       - name: Get Token
         id: get_token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          client-id: "${{ secrets.RELEASE_PLEASE_APPLICATION_ID }}"
+          client-id: ${{ secrets.RELEASE_PLEASE_APPLICATION_ID }}
           private-key: ${{ secrets.RELEASE_PLEASE_PRIVATE_KEY }}
-      - uses: googleapis/release-please-action@db8f2c60ee802b3748b512940dde88eabd7b7e01 # v3.7.13
-        id: release
+          permission-contents: write
+          permission-issues: write
+          permission-pull-requests: write
+      - name: Run release-please
+        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         with:
-          default-branch: main
           token: ${{ steps.get_token.outputs.token }}
-          release-type: simple
-          package-name: ${{ matrix.package }}
-          version-file: ${{ matrix.package }}/version.txt
-          changelog-path: ${{ matrix.package }}/CHANGELOG.md
-          labels: ${{ matrix.package }}
-          bump-patch-for-minor-pre-major: true
-          bump-minor-pre-major: true
-          monorepo-tags: true
-          release-as: ""

.github/workflows/verify-workflow-sha256.yml

@@ -0,0 +1,21 @@
+name: verify-workflow-sha256
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: verify-workflow-sha256-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  verify-workflow-sha256:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Verify workflow-sha256 files are up to date
+        run: bash scripts/compute-workflow-sha256.sh --check

.release-please-manifest.json

@@ -0,0 +1,10 @@
+{
+  "conventional-commits": "1.2.1",
+  "docker-build": "3.5.2",
+  "docker-build-cloud": "1.1.1",
+  "propose-safe-multisig-tx": "1.1.1",
+  "publish-npm": "1.7.1",
+  "release-please": "2.2.1",
+  "rust-build": "3.0.0",
+  "stale": "1.0.1"
+}

CONTRIBUTING.md

@@ -0,0 +1,15 @@
+# Contributing
+
+## Editing a reusable workflow
+
+Each shared reusable workflow is backed by a Component directory `<name>/` that release-please versions independently. Release-please only sees changes under `<name>/`, so a commit that only edits the workflow file is otherwise invisible to it.
+
+After editing any `.github/workflows/<name>.yml` for a workflow listed in `release-please-config.json`, run:
+
+```sh
+bash scripts/compute-workflow-sha256.sh
+```
+
+This regenerates `<name>/workflow-sha256`, a checksum of the workflow file. Commit the resulting diff alongside your workflow change — this is what makes the change visible to release-please for that Component.
+
+CI enforces this on every pull request via `bash scripts/compute-workflow-sha256.sh --check`, which fails if any `workflow-sha256` file is out of date.

conventional-commits/workflow-sha256

@@ -0,0 +1 @@
+f4d93a8c6e9661da06e9cdc25bc14514ce8ba762289824d22b4e38ed55d53f45

docker-build-cloud/workflow-sha256

@@ -0,0 +1 @@
+f364b67e9d5c3795461d15b7bab21adddcd63490e097a15aa82678f80212bff4

docker-build/workflow-sha256

@@ -0,0 +1 @@
+02e205d604954431c03868fe49a190239b824e83173234bdb862a958bb63f4e3

propose-safe-multisig-tx/workflow-sha256

@@ -0,0 +1 @@
+2bc401eb56f124daf40536e5e7c2b46f93a6dc11752d05984d2031df30207b8b

publish-npm/workflow-sha256

@@ -0,0 +1 @@
+fad5473affcfa7afb6c30f6127c7851eb7d5bc613203ff3a780278f25e5fdf15

release-please-config.json

@@ -0,0 +1,51 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "separate-pull-requests": true,
+  "release-type": "simple",
+  "tag-separator": "-",
+  "always-update": true,
+  "bump-patch-for-minor-pre-major": true,
+  "bump-minor-pre-major": true,
+  "packages": {
+    "conventional-commits": {
+      "version-file": "conventional-commits/version.txt",
+      "changelog-path": "conventional-commits/CHANGELOG.md",
+      "extra-label": "conventional-commits"
+    },
+    "docker-build": {
+      "version-file": "docker-build/version.txt",
+      "changelog-path": "docker-build/CHANGELOG.md",
+      "extra-label": "docker-build"
+    },
+    "docker-build-cloud": {
+      "version-file": "docker-build-cloud/version.txt",
+      "changelog-path": "docker-build-cloud/CHANGELOG.md",
+      "extra-label": "docker-build-cloud"
+    },
+    "propose-safe-multisig-tx": {
+      "version-file": "propose-safe-multisig-tx/version.txt",
+      "changelog-path": "propose-safe-multisig-tx/CHANGELOG.md",
+      "extra-label": "propose-safe-multisig-tx"
+    },
+    "publish-npm": {
+      "version-file": "publish-npm/version.txt",
+      "changelog-path": "publish-npm/CHANGELOG.md",
+      "extra-label": "publish-npm"
+    },
+    "release-please": {
+      "version-file": "release-please/version.txt",
+      "changelog-path": "release-please/CHANGELOG.md",
+      "extra-label": "release-please"
+    },
+    "rust-build": {
+      "version-file": "rust-build/version.txt",
+      "changelog-path": "rust-build/CHANGELOG.md",
+      "extra-label": "rust-build"
+    },
+    "stale": {
+      "version-file": "stale/version.txt",
+      "changelog-path": "stale/CHANGELOG.md",
+      "extra-label": "stale"
+    }
+  }
+}

release-please/workflow-sha256

@@ -0,0 +1 @@
+1d9d54064d8a10354bfc6a5429a13770b9e185c82fb0a116ed2abc3ceb8dbbf7

rust-build/workflow-sha256

@@ -0,0 +1 @@
+e26af861c1aabbbc1d5468e9153f8e1bb1878713ce4ae501f7aaff3626008bdc

scripts/compute-workflow-sha256.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+check=false
+if [[ "${1:-}" == "--check" ]]; then
+  check=true
+fi
+
+outdated=false
+
+mapfile -t package_names < <(jq -r '.packages | keys[]' release-please-config.json)
+
+for name in "${package_names[@]}"; do
+  workflow_file=".github/workflows/$name.yml"
+  sha_file="$name/workflow-sha256"
+  computed_sha="$(sha256sum "$workflow_file" | awk '{print $1}')"
+
+  if [[ "$check" == true ]]; then
+    if [[ ! -f "$sha_file" ]] || [[ "$(cat "$sha_file")" != "$computed_sha" ]]; then
+      echo "outdated \`$sha_file\`" >&2
+      outdated=true
+    fi
+  else
+    mkdir -p "$name"
+    echo "$computed_sha" > "$sha_file"
+    echo "$sha_file: $computed_sha" >&2
+  fi
+done
+
+if [[ "$check" == true ]] && [[ "$outdated" == true ]]; then
+  echo "found outdated workflow sha256: execute \`compute-workflow-sha256.sh\` to refresh workflows sha256"
+  exit 1
+fi

stale/workflow-sha256

@@ -0,0 +1 @@
+28cbda1ec67a165c2bea5b6c83c4a50fdfa26f67852c47bc6dbeb84e31afd1f8