From 12cbe20ae4f8b228009c2300268f10692169bdcb Mon Sep 17 00:00:00 2001 From: Yaniv Zalach Date: Sat, 15 Aug 2026 13:18:20 +0300 Subject: [PATCH 1/2] Better relese notes --- .github/workflows/deploy.yml | 4 +- .github/workflows/docker-publish.yml | 4 +- .github/workflows/publish-icegraph-client.yml | 4 +- .github/workflows/release.yml | 70 +++++++++++++++++++ 4 files changed, 73 insertions(+), 9 deletions(-) create mode 100644 .github/workflows/release.yml diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 63be792..1a4c31e 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -1,9 +1,7 @@ name: Deploy to GitHub Pages on: - push: - tags: - - "v*" + workflow_call: permissions: contents: write diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index ccac01e..89e5d38 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -1,9 +1,7 @@ name: Publish Docker image on: - push: - tags: - - 'v*' + workflow_call: jobs: push_to_registry: diff --git a/.github/workflows/publish-icegraph-client.yml b/.github/workflows/publish-icegraph-client.yml index 7e09f43..06a7387 100644 --- a/.github/workflows/publish-icegraph-client.yml +++ b/.github/workflows/publish-icegraph-client.yml @@ -1,9 +1,7 @@ name: Publish icegraph-client to PyPI on: - push: - tags: - - "v*" + workflow_call: jobs: publish: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..b78dad2 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,70 @@ +name: Release + +on: + push: + tags: + - "v*" + +permissions: + contents: write + +jobs: + docker: + name: Docker image + uses: ./.github/workflows/docker-publish.yml + secrets: inherit + + pypi: + name: Python client + uses: ./.github/workflows/publish-icegraph-client.yml + secrets: inherit + + pages: + name: Frontend demo + uses: ./.github/workflows/deploy.yml + secrets: inherit + + release-notes: + name: Write release notes + runs-on: ubuntu-latest + needs: [docker, pypi, pages] + steps: + - name: Build notes and publish release + env: + GH_TOKEN: ${{ github.token }} + REPO: ${{ github.repository }} + TAG: ${{ github.ref_name }} + DOCKER_IMAGE: yanivzalach/icegraph + DEMO_URL: https://yanivzalach.github.io/IceGraph/ + run: | + set -euo pipefail + + VERSION="${TAG#v}" + NOTES_FILE="$RUNNER_TEMP/release-notes.md" + + GENERATED="$(gh api "repos/$REPO/releases/generate-notes" -f tag_name="$TAG" --jq .body)" + CONTRIBUTORS="$(printf '%s\n' "$GENERATED" | grep -oE '@[A-Za-z0-9-]+' | sort -u | paste -sd , - | sed 's/,/, /g' || true)" + + cat > "$NOTES_FILE" <[Docker Hub](https://hub.docker.com/r/$DOCKER_IMAGE/tags?name=$TAG) | + | 🐍 Python client | \`pip install icegraph-client==$VERSION\`
[PyPI](https://pypi.org/project/icegraph-client/$VERSION/) | + | 🌐 Live demo | [$DEMO_URL]($DEMO_URL) | + | 📖 Docs | [${DEMO_URL}docs](${DEMO_URL}docs) | + + EOF + + printf '%s\n' "$GENERATED" >> "$NOTES_FILE" + + if [ -n "$CONTRIBUTORS" ]; then + printf '\n## Contributors\n\nThanks to %s 🧊\n' "$CONTRIBUTORS" >> "$NOTES_FILE" + fi + + if gh release view "$TAG" --repo "$REPO" >/dev/null 2>&1; then + gh release edit "$TAG" --repo "$REPO" --notes-file "$NOTES_FILE" --latest + else + gh release create "$TAG" --repo "$REPO" --title "IceGraph $TAG" --notes-file "$NOTES_FILE" --latest + fi From 52b448626346a6caa6700a2a8120b57a65feb4a5 Mon Sep 17 00:00:00 2001 From: Yaniv Zalach Date: Sat, 15 Aug 2026 13:24:33 +0300 Subject: [PATCH 2/2] Better sec --- .github/dependabot.yml | 11 +++++++++++ .github/workflows/docker-publish.yml | 5 +++++ .github/workflows/publish-icegraph-client.yml | 5 +++++ .github/workflows/release.yml | 19 ++++++++++++++----- 4 files changed, 35 insertions(+), 5 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..17b65ec --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 + +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + groups: + actions: + patterns: + - "*" diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 89e5d38..98c4e07 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -2,6 +2,11 @@ name: Publish Docker image on: workflow_call: + secrets: + DOCKERHUB_USERNAME: + required: true + DOCKERHUB_TOKEN: + required: true jobs: push_to_registry: diff --git a/.github/workflows/publish-icegraph-client.yml b/.github/workflows/publish-icegraph-client.yml index 06a7387..03ffc37 100644 --- a/.github/workflows/publish-icegraph-client.yml +++ b/.github/workflows/publish-icegraph-client.yml @@ -2,11 +2,16 @@ name: Publish icegraph-client to PyPI on: workflow_call: + secrets: + PYPI_API_TOKEN: + required: true jobs: publish: name: Build and publish to PyPI runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Check out the repo uses: actions/checkout@v4 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b78dad2..4145cc5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -5,29 +5,38 @@ on: tags: - "v*" -permissions: - contents: write +permissions: {} jobs: docker: name: Docker image uses: ./.github/workflows/docker-publish.yml - secrets: inherit + permissions: + contents: read + secrets: + DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} + DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} pypi: name: Python client uses: ./.github/workflows/publish-icegraph-client.yml - secrets: inherit + permissions: + contents: read + secrets: + PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }} pages: name: Frontend demo uses: ./.github/workflows/deploy.yml - secrets: inherit + permissions: + contents: write release-notes: name: Write release notes runs-on: ubuntu-latest needs: [docker, pypi, pages] + permissions: + contents: write steps: - name: Build notes and publish release env: