{{ message }}
Repository navigation
324 lines (296 loc) · 13.4 KB
/
Copy pathpublish.yml
File metadata and controls
324 lines (296 loc) · 13.4 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
name: Publish to npm
permissions: {}
on:
push:
tags:
# Stable tags are created only by a merged, reviewed release PR. Direct
# tag pushes are reserved for prerelease channels.
- "v*-*"
pull_request:
types: [closed]
branches: [main]
jobs:
lambda-arm64-ffmpeg:
name: Lambda arm64 ffmpeg
runs-on: ubuntu-24.04-arm
# A cache miss compiles ffmpeg natively, 15-20 minutes.
timeout-minutes: 60
permissions:
contents: read
env:
EXPECTED_RELEASE_SHA: >-
${{ github.event_name == 'pull_request'
&& github.event.pull_request.merge_commit_sha
|| github.sha }}
if: >-
github.event_name == 'push' ||
(github.event.pull_request.merged == true &&
startsWith(github.event.pull_request.head.ref, 'release/v'))
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
ref: ${{ env.EXPECTED_RELEASE_SHA }}
# lambda-arm64-image.yml saves this key on main; a release run's own saves reach only its re-runs.
- id: cache
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
with:
path: out/
key: hf-media-linux-aarch64-${{ hashFiles('packages/aws-lambda/image/**') }}
- if: steps.cache.outputs.cache-hit != 'true'
run: >-
docker buildx build --progress=plain --platform linux/arm64 --target artifact
--output type=local,dest=out packages/aws-lambda/image
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: hf-media-linux-aarch64
path: out/hf-media-linux-aarch64.tar.gz
if-no-files-found: error
publish:
name: Publish
needs: lambda-arm64-ffmpeg
runs-on: ubuntu-latest
timeout-minutes: 30
environment: npm-publish
permissions:
contents: write
id-token: write
env:
EXPECTED_RELEASE_SHA: >-
${{ github.event_name == 'pull_request'
&& github.event.pull_request.merge_commit_sha
|| github.sha }}
# Stable releases come only from reviewed release PRs. Tag pushes are
# prerelease-only because the trigger pattern requires a hyphenated version.
if: >-
github.event_name == 'push' ||
(github.event.pull_request.merged == true &&
startsWith(github.event.pull_request.head.ref, 'release/v'))
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
fetch-depth: 0
# Pin every release to an immutable ref. In particular, a merged
# release PR event exposes main as github.ref, which may advance
# before this job starts; use the event's exact merge commit instead.
ref: ${{ env.EXPECTED_RELEASE_SHA }}
- name: Verify immutable release checkout
run: |
ACTUAL_SHA="$(git rev-parse HEAD)"
EXPECTED_COMMIT_SHA="$(git rev-parse "${EXPECTED_RELEASE_SHA}^{commit}")"
if [ "$ACTUAL_SHA" != "$EXPECTED_COMMIT_SHA" ]; then
echo "::error::Expected release commit $EXPECTED_COMMIT_SHA, checked out $ACTUAL_SHA"
exit 1
fi
- name: Resolve version
id: version
env:
EVENT_NAME: ${{ github.event_name }}
PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
run: |
if [ "$EVENT_NAME" = "push" ]; then
VERSION="${GITHUB_REF_NAME#v}"
else
BRANCH="${PR_HEAD_REF}"
VERSION="${BRANCH#release/v}"
fi
echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
# Detect pre-release tag (e.g. 0.1.16-alpha.1 → alpha, 0.1.16-beta.2 → beta)
if [[ "$VERSION" =~ -([a-zA-Z]+) ]]; then
DIST_TAG="${BASH_REMATCH[1]}"
echo "prerelease=true" >> "$GITHUB_OUTPUT"
else
DIST_TAG="latest"
echo "prerelease=false" >> "$GITHUB_OUTPUT"
fi
echo "dist_tag=${DIST_TAG}" >> "$GITHUB_OUTPUT"
echo "Resolved version=${VERSION} dist_tag=${DIST_TAG}"
- name: Validate release channel
env:
VERSION: ${{ steps.version.outputs.version }}
DIST_TAG: ${{ steps.version.outputs.dist_tag }}
EVENT_NAME: ${{ github.event_name }}
PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
run: node scripts/validate-release-channel.mjs
- name: Create release tag
if: github.event_name == 'pull_request'
env:
VERSION: ${{ steps.version.outputs.version }}
run: |
TAG="v$VERSION"
EXPECTED_TAG_SHA="$(git rev-parse HEAD)"
verify_remote_tag() {
git fetch --force --no-tags origin "+refs/tags/$TAG:refs/tags/$TAG"
ACTUAL_TAG_SHA="$(git rev-parse "refs/tags/$TAG^{commit}")"
if [ "$ACTUAL_TAG_SHA" != "$EXPECTED_TAG_SHA" ]; then
echo "::error::Release tag $TAG points to $ACTUAL_TAG_SHA, expected $EXPECTED_TAG_SHA"
exit 1
fi
echo "Release tag $TAG already exists at the expected commit — skipping"
}
if [ -n "$(git ls-remote --refs origin "refs/tags/$TAG")" ]; then
verify_remote_tag
else
git tag --no-sign "$TAG" "$EXPECTED_TAG_SHA"
if ! git push origin "refs/tags/$TAG"; then
# A concurrent retry may have created the tag after ls-remote.
git tag -d "$TAG"
verify_remote_tag
fi
fi
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: 24
registry-url: "https://registry.npmjs.org"
- run: corepack enable
- run: corepack prepare pnpm@10.17.1 --activate
- run: bun install --frozen-lockfile
- run: bun run build
# Before `npm publish`, so @hyperframes/aws-lambda pins this exact zip.
- name: Build Lambda handler zip
id: lambda_zip
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
VERSION: ${{ steps.version.outputs.version }}
REPO: ${{ github.repository }}
run: |
# A retried run reuses the zip already on the release, so the pin still matches it.
if gh release download "v${VERSION}" --repo "$REPO" --pattern hyperframes-lambda-handler.zip --dir dist; then
echo "attached=true" >> "$GITHUB_OUTPUT"
else
bun run --cwd packages/aws-lambda build:zip
fi
bun packages/aws-lambda/scripts/pin-handler-zip.ts
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
with:
name: hf-media-linux-aarch64
path: dist/hf-media
# Built from the zip pinned above. The video stage only copies files, so no emulation is needed.
- name: Build Lambda video image
id: lambda_video_image
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
VERSION: ${{ steps.version.outputs.version }}
REPO: ${{ github.repository }}
run: |
# A retried run reuses the image already on the release, so the pin still matches it.
if gh release download "v${VERSION}" --repo "$REPO" --pattern hyperframes-lambda-video-arm64.oci.tar --dir dist; then
echo "attached=true" >> "$GITHUB_OUTPUT"
else
bun packages/aws-lambda/scripts/stage-arm64-image.ts --zip=dist/hyperframes-lambda-handler.zip \
--ffmpeg=dist/hf-media/hf-media-linux-aarch64.tar.gz --out=dist/arm64-image
# OCI export needs a docker-container builder; no attestations, so index.json lists one image.
docker buildx create --use
docker buildx build --progress=plain --platform linux/arm64 --target video \
--provenance=false --sbom=false --build-context task=dist/arm64-image/task \
--output type=oci,dest=dist/hyperframes-lambda-video-arm64.oci.tar packages/aws-lambda/image
fi
bun packages/aws-lambda/scripts/pin-handler-zip.ts --video-image
- run: bun run verify:packed-manifests
- name: Create GitHub Release
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
VERSION: ${{ steps.version.outputs.version }}
PRERELEASE: ${{ steps.version.outputs.prerelease }}
REPO: ${{ github.repository }}
run: |
NOTES_FILE="releases/v${VERSION}.md"
# Skip if release already exists (idempotent re-runs)
if gh release view "v${VERSION}" --repo "$REPO" >/dev/null 2>&1; then
echo "Release v${VERSION} already exists — skipping"
else
FLAGS=(--repo "$REPO" --title "v${VERSION}")
if [ -f "$NOTES_FILE" ]; then
FLAGS+=(--notes-file "$NOTES_FILE")
else
echo "No reviewed release notes found at $NOTES_FILE — using GitHub generated notes"
FLAGS+=(--generate-notes)
fi
if [ "$PRERELEASE" = "true" ]; then
FLAGS+=(--prerelease)
fi
gh release create "v${VERSION}" "${FLAGS[@]}"
fi
- name: Attach Lambda handler zip to release
if: steps.lambda_zip.outputs.attached != 'true'
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
VERSION: ${{ steps.version.outputs.version }}
REPO: ${{ github.repository }}
run: gh release upload "v${VERSION}" dist/hyperframes-lambda-handler.zip dist/hyperframes-lambda-handler.sha256 --repo "$REPO"
- name: Attach Lambda video image to release
if: steps.lambda_video_image.outputs.attached != 'true'
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
VERSION: ${{ steps.version.outputs.version }}
REPO: ${{ github.repository }}
run: gh release upload "v${VERSION}" dist/hyperframes-lambda-video-arm64.oci.tar dist/hyperframes-lambda-video-arm64.sha256 --repo "$REPO"
- name: Publish packages
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
VERSION: ${{ steps.version.outputs.version }}
DIST_TAG: ${{ steps.version.outputs.dist_tag }}
run: |
FAILED=0
publish_pkg() {
local filter="$1"
local name="$2"
# Check if this version is already published
if npm view "${name}@${VERSION}" version >/dev/null 2>&1; then
echo "⏭️ ${name}@${VERSION} already published — skipping"
return 0
fi
echo "📦 Publishing ${name}@${VERSION}..."
if pnpm --filter "$filter" publish --access public --no-git-checks --tag "$DIST_TAG"; then
echo "✅ ${name}@${VERSION} published"
else
echo "❌ ${name}@${VERSION} failed to publish"
FAILED=1
fi
}
publish_pkg "@hyperframes/parsers" "@hyperframes/parsers"
publish_pkg "@hyperframes/lint" "@hyperframes/lint"
publish_pkg "@hyperframes/studio-server" "@hyperframes/studio-server"
publish_pkg "@hyperframes/core" "@hyperframes/core"
publish_pkg "@hyperframes/inspector" "@hyperframes/inspector"
publish_pkg "@hyperframes/sdk" "@hyperframes/sdk"
publish_pkg "@hyperframes/engine" "@hyperframes/engine"
publish_pkg "@hyperframes/player" "@hyperframes/player"
publish_pkg "@hyperframes/producer" "@hyperframes/producer"
publish_pkg "@hyperframes/shader-transitions" "@hyperframes/shader-transitions"
publish_pkg "@hyperframes/studio" "@hyperframes/studio"
publish_pkg "@hyperframes/aws-lambda" "@hyperframes/aws-lambda"
publish_pkg "@hyperframes/gcp-cloud-run" "@hyperframes/gcp-cloud-run"
# CLI is @hyperframes/cli in the monorepo but published as unscoped "hyperframes" on npm.
# Rewrite the name in package.json before publishing, then use npm publish directly
# since pnpm --filter won't match the rewritten name.
if npm view "hyperframes@${VERSION}" version >/dev/null 2>&1; then
echo "⏭️ hyperframes@${VERSION} already published — skipping"
else
node -e "
const fs = require('fs');
const p = 'packages/cli/package.json';
const pkg = JSON.parse(fs.readFileSync(p, 'utf8'));
pkg.name = 'hyperframes';
fs.writeFileSync(p, JSON.stringify(pkg, null, 2) + '\n');
"
echo "📦 Publishing hyperframes@${VERSION}..."
if (cd packages/cli && npm publish --access public --tag "$DIST_TAG"); then
echo "✅ hyperframes@${VERSION} published"
else
echo "❌ hyperframes@${VERSION} failed to publish"
FAILED=1
fi
fi
if [ "$FAILED" -ne 0 ]; then
echo "::error::One or more packages failed to publish"
exit 1
fi
- name: Build portable agent plugin
run: node scripts/package-agent-plugin.mjs
- name: Attach portable plugin to release
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
VERSION: ${{ steps.version.outputs.version }}
REPO: ${{ github.repository }}
run: gh release upload "v${VERSION}" dist/hyperframes-agent-plugin.zip dist/hyperframes-agent-plugin.sha256 dist/hyperframes-agent-plugin.json --repo "$REPO" --clobber
You can’t perform that action at this time.