This is an automated email from the ASF dual-hosted git repository. hsluoyz pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/casbin-mongodb-adapter.git
commit 4d914990ff16e9e362971c74142c3dbe5928efeb Author: Yang Luo <[email protected]> AuthorDate: Wed Aug 5 22:56:06 2026 +0800 ci: replace disallowed third-party actions with native steps --- .github/workflows/ci.yml | 66 ++++++++++++++++++++++++++++++++++--------- .github/workflows/release.yml | 54 +++++++++++++++++++++-------------- 2 files changed, 86 insertions(+), 34 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b9dfe60..ee75d76 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,35 +1,75 @@ name: CI -on: [push,pull_request] +on: [push, pull_request] + +permissions: + contents: read jobs: - test: + test: runs-on: ubuntu-latest services: mongodb: - image: mongo + image: mongo:8.0 ports: - 27017:27017 steps: + - uses: actions/checkout@v4 + - name: Set up Go - uses: actions/setup-go@v2 + uses: actions/setup-go@v5 with: go-version: '1.20' - - name: Start MongoDB - uses: supercharge/[email protected] - with: - mongodb-version: 4.4 - mongodb-replica-set: test-rs - mongodb-port: 42069 + # Started with plain docker instead of a third-party action: the ASF org + # only allows actions owned by GitHub or by the enterprise allow-list. + # A service container cannot be used here because the replica set needs a + # custom mongod command plus rs.initiate(). + - name: Start MongoDB replica set + run: | + set -euo pipefail + docker run -d --name mongo-rs -p 42069:42069 mongo:8.0 \ + mongod --replSet test-rs --port 42069 --bind_ip_all + + echo "Waiting for mongod to accept connections..." + for _ in $(seq 1 60); do + if docker exec mongo-rs mongosh --port 42069 --quiet \ + --eval 'db.adminCommand({ ping: 1 })' >/dev/null 2>&1; then + break + fi + sleep 2 + done + + docker exec mongo-rs mongosh --port 42069 --quiet --eval \ + 'rs.initiate({ _id: "test-rs", members: [{ _id: 0, host: "127.0.0.1:42069" }] })' + + echo "Waiting for the replica set to elect a primary..." + for _ in $(seq 1 60); do + if docker exec mongo-rs mongosh --port 42069 --quiet \ + --eval 'quit(db.hello().isWritablePrimary ? 0 : 1)' >/dev/null 2>&1; then + exit 0 + fi + sleep 2 + done + + echo "Replica set did not become primary in time" >&2 + docker logs mongo-rs + exit 1 - - uses: actions/checkout@v2 - name: Run Unit tests run: go test -v -coverprofile=./profile.cov ./... - - uses: shogo82148/actions-goveralls@v1 + - name: Coverage summary + if: always() + run: go tool cover -func=./profile.cov + + - name: Upload coverage profile + if: always() + uses: actions/upload-artifact@v4 with: - path-to-profile: ./profile.cov + name: coverage-profile + path: ./profile.cov + if-no-files-found: ignore diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fc33d44..c2e09c0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -70,26 +70,38 @@ jobs: PRERELEASE: ${{ steps.meta.outputs.prerelease }} BASENAME: ${{ steps.meta.outputs.basename }} run: | - if [[ "${PRERELEASE}" == "true" ]]; then - printf 'Release candidate for version `%s`. This is **not** a released version; it is the source artifact for the Apache release vote.\n' "${VERSION%%-rc*}" - else - printf 'Version `%s`.\n' "${VERSION}" - fi - printf '\n| Asset | Description |\n| --- | --- |\n' - printf '| `%s.tar.gz` | Source release |\n' "${BASENAME}" - printf '| `%s.tar.gz.sha512` | SHA-512 checksum |\n\n' "${BASENAME}" - printf 'The release manager signs the tarball locally with their own GPG key before starting the vote.\n' - # shellcheck: the script above deliberately keeps release notes minimal - # (per the project's policy: no extra Apache processes in CI). + set -euo pipefail + { + if [[ "${PRERELEASE}" == "true" ]]; then + printf 'Release candidate for version `%s`. This is **not** a released version; it is the source artifact for the Apache release vote.\n' "${VERSION%%-rc*}" + else + printf 'Version `%s`.\n' "${VERSION}" + fi + printf '\n| Asset | Description |\n| --- | --- |\n' + printf '| `%s.tar.gz` | Source release |\n' "${BASENAME}" + printf '| `%s.tar.gz.sha512` | SHA-512 checksum |\n\n' "${BASENAME}" + printf 'The release manager signs the tarball locally with their own GPG key before starting the vote.\n' + } > release-notes.md + cat release-notes.md + # The gh CLI is used instead of a marketplace action: the ASF org only + # allows actions owned by GitHub or by the enterprise allow-list. - name: Create GitHub release - uses: softprops/action-gh-release@v2 - with: - tag_name: ${{ steps.meta.outputs.tag }} - name: Casbin MongoDB Adapter ${{ steps.meta.outputs.tag }} - body_path: release-notes.md - draft: false - prerelease: ${{ steps.meta.outputs.prerelease == 'true' }} - files: | - dist/${{ steps.meta.outputs.basename }}.tar.gz - dist/${{ steps.meta.outputs.basename }}.tar.gz.sha512 + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG: ${{ steps.meta.outputs.tag }} + BASENAME: ${{ steps.meta.outputs.basename }} + PRERELEASE: ${{ steps.meta.outputs.prerelease }} + run: | + set -euo pipefail + args=( + "${TAG}" + --title "Casbin MongoDB Adapter ${TAG}" + --notes-file release-notes.md + ) + if [[ "${PRERELEASE}" == "true" ]]; then + args+=(--prerelease) + fi + gh release create "${args[@]}" \ + "dist/${BASENAME}.tar.gz" \ + "dist/${BASENAME}.tar.gz.sha512" --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
