diff --git a/.github/workflows/release-documentation.yml b/.github/workflows/release-documentation.yml index c19148017cfec..b41998ddce0cf 100644 --- a/.github/workflows/release-documentation.yml +++ b/.github/workflows/release-documentation.yml @@ -61,12 +61,18 @@ jobs: release-documentation: name: Build and Upload Release Documentation and Man Pages runs-on: ubuntu-24.04 + env: + DOXYGEN_FILE_PATTERN: '*doxygen*.tar.xz' if: >- github.repository_owner == 'llvm' && github.event.action != 'closed' + permissions: + contents: read outputs: - man-page-digest: ${{ steps.man-page-digest.outputs.man-page-digest }} + man-page-digest: ${{ steps.digests.outputs.man-page-digest }} man-page-artifact-id: ${{ steps.man-page-artifact-upload.outputs.artifact-id }} + doxygen-digest: ${{ steps.digests.outputs.doxygen-digest }} + doxygen-artifact-id: ${{ steps.doxygen-artifact-upload.outputs.artifact-id }} steps: - name: Checkout LLVM uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 @@ -95,6 +101,12 @@ jobs: texlive-font-utils pip3 install --require-hashes --user -r ./llvm/docs/requirements.txt + # Install Doxygen + curl -L https://github.com/doxygen/doxygen/releases/download/Release_1_17_0/doxygen-1.17.0.linux.bin.tar.gz -o doxygen.tar.gz + echo "75419ef4f446fc1c24ef12514b574e66e898ee6f527c6ae2ad84f91a905823c2 doxygen.tar.gz" | shasum --check - + tar -xf doxygen.tar.gz + sudo install -m 755 doxygen-1.17.0/bin/doxygen /usr/local/bin/doxygen + - name: Build Documentation id: build env: @@ -102,17 +114,17 @@ jobs: INPUTS_RELEASE_VERSION: ${{ inputs.release-version }} run: | ./llvm/utils/release/build-docs.sh \ - $(test -n "$INPUTS_RELEASE_VERSION" && echo -release "$INPUTS_RELEASE_VERSION" || echo -srcdir llvm) -no-doxygen + $(test -n "$INPUTS_RELEASE_VERSION" && echo -release "$INPUTS_RELEASE_VERSION" || echo -srcdir llvm) echo "man-page-tarball-name=$(basename $(find . -iname 'llvm_man_pages-*.tar.xz'))" >> "$GITHUB_OUTPUT" - - - name: Generate sha256 digest for man page tarball - id: man-page-digest + - name: Generate sha256 digest for tarballs + id: digests shell: bash env: - TARBALL_NAME: ${{ steps.build.outputs.man-page-tarball-name }} + MAN_PAGE_TARBALL_NAME: ${{ steps.build.outputs.man-page-tarball-name }} run: | - echo "man-page-digest=$(cat "$TARBALL_NAME" | sha256sum | cut -d ' ' -f 1)" >> "$GITHUB_OUTPUT" + echo "man-page-digest=$(cat "$MAN_PAGE_TARBALL_NAME" | sha256sum | cut -d ' ' -f 1)" >> "$GITHUB_OUTPUT" + echo "doxygen-digest=$(cat $(xargs <<< "$DOXYGEN_FILE_PATTERN") | sha256sum | cut -d ' ' -f 1)" >> "$GITHUB_OUTPUT" - id: man-page-artifact-upload uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 @@ -121,6 +133,13 @@ jobs: path: | ${{ steps.build.outputs.man-page-tarball-name }} + - id: doxygen-artifact-upload + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: doxygen + path: | + ${{ env.DOXYGEN_FILE_PATTERN }} + - name: Create Release Notes Artifact uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: @@ -174,8 +193,8 @@ jobs: git push --force "https://$PUSH_TOKEN@github.com/llvmbot/www-releases.git" HEAD:refs/heads/$INPUTS_RELEASE_VERSION gh pr create -f -B main -H llvmbot:$INPUTS_RELEASE_VERSION - upload-man-pages: - name: "Upload Man Pages" + upload-documentation: + name: "Upload Documentation" runs-on: ubuntu-24.04 environment: deployment: false @@ -188,16 +207,24 @@ jobs: contents: write # For man page uploads id-token: write # For artifact attestations attestations: write # For artifact attestations - + strategy: + matrix: + include: + - artifact-id: ${{ needs.release-documentation.outputs.man-page-artifact-id }} + attestation-name: release-man-page-attestation + digest: ${{ needs.release-documentation.outputs.man-page-digest }} + - artifact-id: ${{ needs.release-documentation.outputs.doxygen-artifact-id }} + attestation-name: release-doxygen-attestation + digest: ${{ needs.release-documentation.outputs.doxygen-digest }} steps: - name: Upload Man Page Artifacts id: man-page-artifact-upload uses: $/.github/workflows/upload-release-artifact with: release-version: ${{ inputs.release-version }} - artifact-id: ${{ needs.release-documentation.outputs.man-page-artifact-id }} - attestation-name: ${{ runner.os }}-${{ runner.arch }}-release-man-page-attestation - digest: ${{ needs.release-documentation.outputs.man-page-digest }} + artifact-id: ${{ matrix.artifact-id }} + attestation-name: ${{ runner.os }}-${{ runner.arch }}-${{ matrix.attestation-name }} + digest: ${{ matrix.digest }} upload: ${{ inputs.upload }} LLVM_TOKEN_GENERATOR_CLIENT_ID: ${{ secrets.LLVM_TOKEN_GENERATOR_CLIENT_ID }} LLVM_TOKEN_GENERATOR_PRIVATE_KEY: ${{ secrets.LLVM_TOKEN_GENERATOR_PRIVATE_KEY }} diff --git a/.github/workflows/release-doxygen.yml b/.github/workflows/release-doxygen.yml deleted file mode 100644 index d0cc56c6c22d2..0000000000000 --- a/.github/workflows/release-doxygen.yml +++ /dev/null @@ -1,130 +0,0 @@ -name: Release Doxygen - -permissions: - contents: read - -on: - workflow_dispatch: - inputs: - release-version: - description: 'Release Version' - required: true - type: string - upload: - description: 'Upload documentation' - required: false - type: boolean - - workflow_call: - inputs: - release-version: - description: 'Release Version' - required: true - type: string - upload: - description: 'Upload documentation' - required: false - type: boolean - secrets: - LLVM_TOKEN_GENERATOR_CLIENT_ID: - description: "Client ID for our GitHub App we use for generating access tokens." - required: true - LLVM_TOKEN_GENERATOR_PRIVATE_KEY: - description: "Private key for our GitHub App we use for generating access tokens." - required: true - -jobs: - # This job checks permissions and validates inputs to prevent potential - # malicious actions. Since the release-doxygen job has contents: write - # permissions we need to be extra careful about who can run the job and - # what inputs can be provided. - release-doxygen-validate-input: - name: Release Doxygen Validate Input - runs-on: ubuntu-24.04 - environment: - name: release - deployment: false - permissions: - contents: read - steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - with: - persist-credentials: false - sparse-checkout: | - .github/workflows/ - - - name: Check Permissions - uses: ./.github/workflows/require-team-membership - with: - team-slug: llvm-release-managers - LLVM_TOKEN_GENERATOR_CLIENT_ID: ${{ secrets.LLVM_TOKEN_GENERATOR_CLIENT_ID }} - LLVM_TOKEN_GENERATOR_PRIVATE_KEY: ${{ secrets.LLVM_TOKEN_GENERATOR_PRIVATE_KEY }} - - - name: Validate Input - uses: ./.github/workflows/validate-release-version - with: - release-version: ${{ inputs.release-version }} - - release-doxygen: - name: Build and Upload Release Doxygen - runs-on: ubuntu-24.04 - environment: - name: release - deployment: false - permissions: - contents: write - needs: - - release-doxygen-validate-input - env: - upload: ${{ inputs.upload && !contains(inputs.release-version, 'rc') }} - steps: - - name: Checkout LLVM - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - with: - persist-credentials: false - - - name: Setup Python env - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 - with: - cache: 'pip' - cache-dependency-path: './llvm/docs/requirements.txt' - - - name: Install Dependencies - run: | - sudo apt-get update - sudo apt-get install -y \ - graphviz \ - python3-github \ - ninja-build \ - texlive-font-utils - pip3 install --require-hashes --user -r ./llvm/docs/requirements.txt - - - name: Install Doxygen - run: | - curl -L https://github.com/doxygen/doxygen/releases/download/Release_1_17_0/doxygen-1.17.0.linux.bin.tar.gz -o doxygen.tar.gz - echo "75419ef4f446fc1c24ef12514b574e66e898ee6f527c6ae2ad84f91a905823c2 doxygen.tar.gz" | shasum --check - - tar -xf doxygen.tar.gz - sudo install -m 755 doxygen-1.17.0/bin/doxygen /usr/local/bin/doxygen - - - name: Build Doxygen - env: - RELEASE_VERSION: ${{ inputs.release-version }} - run: | - ./llvm/utils/release/build-docs.sh -release "$RELEASE_VERSION" -no-sphinx -no-man-pages - - - id: app-token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 - with: - app-id: ${{ secrets.LLVM_TOKEN_GENERATOR_CLIENT_ID }} - private-key: ${{ secrets.LLVM_TOKEN_GENERATOR_PRIVATE_KEY }} - owner: ${{ github.repository_owner }} - permission-members: read - - - name: Upload Doxygen - if: env.upload - env: - GITHUB_TOKEN: ${{ github.token }} - USER_TOKEN: ${{ steps.app-token.outputs.token }} - RELEASE_VERSION: ${{ inputs.release-version }} - run: | - ./llvm/utils/release/github-upload-release.py --token "$GITHUB_TOKEN" --release "$RELEASE_VERSION" --user "$GITHUB_ACTOR" --user-token "$USER_TOKEN" upload --files ./*doxygen*.tar.xz diff --git a/.github/workflows/release-tasks.yml b/.github/workflows/release-tasks.yml index 5b9cdc64d1b8d..426c701cc5e29 100644 --- a/.github/workflows/release-tasks.yml +++ b/.github/workflows/release-tasks.yml @@ -78,22 +78,6 @@ jobs: LLVM_TOKEN_GENERATOR_CLIENT_ID: ${{ secrets.LLVM_TOKEN_GENERATOR_CLIENT_ID }} LLVM_TOKEN_GENERATOR_PRIVATE_KEY: ${{ secrets.LLVM_TOKEN_GENERATOR_PRIVATE_KEY }} - release-doxygen: - name: Build and Upload Release Doxygen - permissions: - contents: write - needs: - - validate-tag - - release-create - uses: ./.github/workflows/release-doxygen.yml - with: - release-version: ${{ needs.validate-tag.outputs.release-version }} - upload: true - # Called workflows don't have access to secrets by default, so we need to explicitly pass secrets that we use. - secrets: - LLVM_TOKEN_GENERATOR_CLIENT_ID: ${{ secrets.LLVM_TOKEN_GENERATOR_CLIENT_ID }} - LLVM_TOKEN_GENERATOR_PRIVATE_KEY: ${{ secrets.LLVM_TOKEN_GENERATOR_PRIVATE_KEY }} - # The pypi trusted publishing does not support called workflows, so we # can't use them here. release-lit: