| 1 | name: Relay stable release |
| 2 | run-name: Relay stable release ${{ github.ref_name }} |
| 3 | |
| 4 | # The tag event itself has a tag-shaped origin. Relay the immutable tag name to |
| 5 | # release-stable.yml on protected main-v2 so the production SignPath policy can |
| 6 | # allow exactly one branch name without trusting wildcard tag-like branches. |
| 7 | on: |
| 8 | push: |
| 9 | tags: |
| 10 | - 'v*' |
| 11 | - '!v*-*' |
| 12 | |
| 13 | permissions: |
| 14 | actions: write |
| 15 | contents: read |
| 16 | |
| 17 | jobs: |
| 18 | relay: |
| 19 | name: dispatch protected stable control plane |
| 20 | runs-on: ubuntu-latest |
| 21 | steps: |
| 22 | - name: Dispatch release-stable.yml on main-v2 |
| 23 | uses: actions/github-script@v9 |
| 24 | env: |
| 25 | RELEASE_TAG: ${{ github.ref_name }} |
| 26 | CONTROL_PLANE_REF: ${{ github.event.repository.default_branch }} |
| 27 | with: |
| 28 | script: | |
| 29 | if (process.env.CONTROL_PLANE_REF !== 'main-v2') { |
| 30 | core.setFailed(`Unexpected default branch: ${process.env.CONTROL_PLANE_REF}`); |
| 31 | return; |
| 32 | } |
| 33 | await github.rest.actions.createWorkflowDispatch({ |
| 34 | owner: context.repo.owner, |
| 35 | repo: context.repo.repo, |
| 36 | workflow_id: 'release-stable.yml', |
| 37 | ref: process.env.CONTROL_PLANE_REF, |
| 38 | inputs: { |
| 39 | tag: process.env.RELEASE_TAG, |
| 40 | allow_recovery: 'false', |
| 41 | }, |
| 42 | }); |
| 43 |