[repo] Release automation improvements

.github/workflows/automation.yml

@@ -0,0 +1,34 @@
+name: Resolve automation settings
+
+on:
+  workflow_call:
+    outputs:
+      enabled:
+        value: ${{ jobs.resolve-automation.outputs.enabled == 'true' }}
+      token-secret-name:
+        value: ${{ jobs.resolve-automation.outputs.token-secret-name }}
+      username:
+        value: ${{ vars.AUTOMATION_USERNAME }}
+      email:
+        value: ${{ vars.AUTOMATION_EMAIL }}
+    secrets:
+      OPENTELEMETRYBOT_GITHUB_TOKEN:
+        required: true
+
+jobs:
+  resolve-automation:
+
+    runs-on: ubuntu-latest
+
+    outputs:
+      enabled: ${{ steps.evaluate.outputs.enabled }}
+      token-secret-name: ${{ steps.evaluate.outputs.token-secret-name }}
+
+    env:
+      OPENTELEMETRYBOT_GITHUB_TOKEN_EXISTS: ${{ secrets.OPENTELEMETRYBOT_GITHUB_TOKEN != '' }}
+
+    steps:
+    - id: evaluate
+      run: |
+        echo "enabled=${{ env.OPENTELEMETRYBOT_GITHUB_TOKEN_EXISTS == 'true' }}" >> "$GITHUB_OUTPUT"
+        echo "token-secret-name=OPENTELEMETRYBOT_GITHUB_TOKEN" >> "$GITHUB_OUTPUT"

.github/workflows/post-release.yml

@@ -0,0 +1,51 @@
+name: Complete release
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        required: true
+        description: 'Release tag'
+        type: string
+  release:
+    types: [published]
+
+jobs:
+  automation:
+    uses: ./.github/workflows/automation.yml
+    secrets: inherit
+
+  post-release:
+    runs-on: ubuntu-latest
+
+    needs:
+    - automation
+
+    if: |
+      needs.automation.outputs.enabled
+      &&
+      (
+        (github.ref_type == 'tag' && startsWith(github.ref_name, 'core-') && !contains(github.ref_name, '-alpha') && !contains(github.ref_name, '-beta') && !contains(github.ref_name, '-rc'))
+        || (inputs.tag && startsWith(inputs.tag, 'core-') && !contains(inputs.tag, '-alpha') && !contains(inputs.tag, '-beta') && !contains(inputs.tag, '-rc'))
+      )
+
+    env:
+      GH_TOKEN: ${{ secrets[needs.automation.outputs.token-secret-name] }}
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        ref: ${{ github.event.repository.default_branch }}
+        token: ${{ secrets[needs.automation.outputs.token-secret-name] }}
+
+    - name: Create GitHub Pull Request to update stable build version in props
+      shell: pwsh
+      run: |
+        Import-Module .\build\scripts\post-release.psm1
+
+        CreateStableVersionUpdatePullRequest `
+          -gitRepository '${{ github.repository }}' `
+          -tag '${{ inputs.tag || github.ref_name }}' `
+          -targetBranch '${{ github.event.repository.default_branch }}' `
+          -gitUserName '${{ needs.automation.outputs.username }}' `
+          -gitUserEmail '${{ needs.automation.outputs.email }}'

.github/workflows/prepare-release.yml

@@ -23,117 +23,107 @@ on:
     types:
     - created
 
-permissions:
-  contents: write
-  pull-requests: write
-
 jobs:
+  automation:
+    uses: ./.github/workflows/automation.yml
+    secrets: inherit
+
   prepare-release-pr:
-    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+
+    needs: automation
 
-    runs-on: windows-latest
+    if: github.event_name == 'workflow_dispatch' && needs.automation.outputs.enabled
+
+    env:
+      GH_TOKEN: ${{ secrets[needs.automation.outputs.token-secret-name] }}
 
     steps:
     - name: check out code
       uses: actions/checkout@v4
+      with:
+        token: ${{ secrets[needs.automation.outputs.token-secret-name] }}
 
     - name: Create GitHub Pull Request to prepare release
       shell: pwsh
       run: |
         Import-Module .\build\scripts\prepare-release.psm1
 
         CreatePullRequestToUpdateChangelogsAndPublicApis `
+          -gitRepository '${{ github.repository }}' `
           -minVerTagPrefix '${{ inputs.tag-prefix }}' `
           -version '${{ inputs.version }}' `
-          -targetBranch '${{ github.ref_name }}'
-      env:
-        GH_TOKEN: ${{ github.token }}
+          -targetBranch '${{ github.ref_name }}' `
+          -gitUserName '${{ needs.automation.outputs.username }}' `
+          -gitUserEmail '${{ needs.automation.outputs.email }}'
 
   lock-pr-and-post-notice-to-create-release-tag:
+    runs-on: ubuntu-latest
+
+    needs: automation
+
     if: |
       github.event_name == 'pull_request'
       && github.event.action == 'closed'
-      && github.event.pull_request.user.login == 'github-actions[bot]'
+      && github.event.pull_request.user.login == needs.automation.outputs.username
       && github.event.pull_request.merged == true
       && startsWith(github.event.pull_request.title, '[repo] Prepare release ')
+      && needs.automation.outputs.enabled
 
-    runs-on: windows-latest
+    env:
+      GH_TOKEN: ${{ secrets[needs.automation.outputs.token-secret-name] }}
 
     steps:
     - name: check out code
       uses: actions/checkout@v4
+      with:
+        token: ${{ secrets[needs.automation.outputs.token-secret-name] }}
 
     - name: Lock GitHub Pull Request to prepare release
       shell: pwsh
       run: |
         Import-Module .\build\scripts\prepare-release.psm1
 
         LockPullRequestAndPostNoticeToCreateReleaseTag `
-          -pullRequestNumber '${{ github.event.pull_request.number }}'
-      env:
-        GH_TOKEN: ${{ github.token }}
+          -gitRepository '${{ github.repository }}' `
+          -pullRequestNumber '${{ github.event.pull_request.number }}' `
+          -botUserName '${{ needs.automation.outputs.username }}'
 
   create-release-tag-unlock-pr-post-notice:
+    runs-on: ubuntu-latest
+
+    needs: automation
+
     if: |
       github.event_name == 'issue_comment'
       && github.event.issue.pull_request
       && github.event.issue.locked == true
+      && github.event.comment.user.login != needs.automation.outputs.username
       && contains(github.event.comment.body, '/CreateReleaseTag')
       && startsWith(github.event.issue.title, '[repo] Prepare release ')
       && github.event.issue.pull_request.merged_at
+      && needs.automation.outputs.enabled
 
-    runs-on: windows-latest
-
-    outputs:
-      tag: ${{ steps.create-tag.outputs.tag }}
+    env:
+      GH_TOKEN: ${{ secrets[needs.automation.outputs.token-secret-name] }}
 
     steps:
     - name: check out code
       uses: actions/checkout@v4
       with:
         # Note: By default GitHub only fetches 1 commit which fails the git tag operation below
         fetch-depth: 0
+        token: ${{ secrets[needs.automation.outputs.token-secret-name] }}
 
     - name: Create release tag
       id: create-tag
       shell: pwsh
       run: |
         Import-Module .\build\scripts\prepare-release.psm1
 
-        $tag = ''
-
-        CreateReleaseTag `
-          -pullRequestNumber '${{ github.event.issue.number }}' `
-          -actionRunId '${{ github.run_id }}' `
-          -tag ([ref]$tag)
-
-        echo "tag=$tag" >> $env:GITHUB_OUTPUT
-      env:
-        GH_TOKEN: ${{ github.token }}
-
-  invoke-package-workflow:
-    needs: create-release-tag-unlock-pr-post-notice
-    uses: ./.github/workflows/publish-packages-1.0.yml
-    with:
-      tag: ${{ needs.create-release-tag-unlock-pr-post-notice.outputs.tag }}
-
-  post-packages-ready-notice:
-    needs:
-    - create-release-tag-unlock-pr-post-notice
-    - invoke-package-workflow
-    runs-on: windows-latest
-    steps:
-    - name: check out code
-      uses: actions/checkout@v4
-
-    - name: Post notice when packages are ready
-      shell: pwsh
-      run: |
-        Import-Module .\build\scripts\prepare-release.psm1
-
-        PostPackagesReadyNotice `
+        CreateReleaseTagAndPostNoticeOnPullRequest `
+          -gitRepository '${{ github.repository }}' `
           -pullRequestNumber '${{ github.event.issue.number }}' `
-          -tag '${{ needs.create-release-tag-unlock-pr-post-notice.outputs.tag }}' `
-          -packagesUrl '${{ needs.invoke-package-workflow.outputs.artifact-url }}'
-      env:
-        GH_TOKEN: ${{ github.token }}
+          -botUserName '${{ needs.automation.outputs.username }}' `
+          -gitUserName '${{ needs.automation.outputs.username }}' `
+          -gitUserEmail '${{ needs.automation.outputs.email }}'

.github/workflows/publish-packages-1.0.yml

@@ -13,29 +13,18 @@ on:
     tags:
       - 'core-*'
       - 'coreunstable-*'
-  workflow_call:
-    inputs:
-      tag:
-        required: true
-        type: string
-    outputs:
-      artifact-id:
-        value: ${{ jobs.build-pack-publish.outputs.artifact-id }}
-      artifact-url:
-        value: ${{ jobs.build-pack-publish.outputs.artifact-url }}
   schedule:
     - cron: '0 0 * * *' # once in a day at 00:00
 
-permissions:
-  contents: write
-  pull-requests: write
-
 jobs:
+  automation:
+    uses: ./.github/workflows/automation.yml
+    secrets: inherit
+
   build-pack-publish:
     runs-on: windows-latest
 
     outputs:
-      artifact-id: ${{ steps.upload-artifacts.outputs.artifact-id }}
       artifact-url: ${{ steps.upload-artifacts.outputs.artifact-url }}
 
     steps:
@@ -45,7 +34,6 @@ jobs:
         # the version tag which is typically NOT on the first commit so we
         # retrieve them all.
         fetch-depth: 0
-        ref: ${{ inputs.tag || github.ref || 'main' }}
 
     - name: Setup dotnet
       uses: actions/setup-dotnet@v4
@@ -57,13 +45,13 @@ jobs:
       run: dotnet build ./build/OpenTelemetry.proj --configuration Release --no-restore -p:Deterministic=true -p:BuildNumber=${{ github.run_number }} -p:RunningDotNetPack=true
 
     - name: dotnet pack
-      run: dotnet pack ./build/OpenTelemetry.proj --configuration Release --no-restore --no-build -p:PackTag=${{ github.ref_type == 'tag' && github.ref_name || inputs.tag || '' }}
+      run: dotnet pack ./build/OpenTelemetry.proj --configuration Release --no-restore --no-build -p:PackTag=${{ github.ref_type == 'tag' && github.ref_name || '' }}
 
     - name: Publish Artifacts
       id: upload-artifacts
       uses: actions/upload-artifact@v4
       with:
-        name: ${{ inputs.tag || github.ref_name }}-packages
+        name: ${{ github.ref_name }}-packages
         path: '**/bin/**/*.*nupkg'
 
     - name: Publish MyGet
@@ -74,26 +62,43 @@ jobs:
         nuget setApiKey ${{ secrets.MYGET_TOKEN }} -Source https://www.myget.org/F/opentelemetry/api/v2/package
         nuget push **/bin/**/*.nupkg -Source https://www.myget.org/F/opentelemetry/api/v2/package
 
+  post-build:
+    runs-on: ubuntu-latest
+
+    needs:
+    - automation
+    - build-pack-publish
+
+    if: needs.automation.outputs.enabled && github.event_name == 'push'
+
+    env:
+      GH_TOKEN: ${{ secrets[needs.automation.outputs.token-secret-name] }}
+
+    steps:
+    - name: check out code
+      uses: actions/checkout@v4
+      with:
+        token: ${{ secrets[needs.automation.outputs.token-secret-name] }}
+
     - name: Create GitHub Release draft
-      if: github.ref_type == 'tag' || inputs.tag
       shell: pwsh
       run: |
         Import-Module .\build\scripts\post-release.psm1
 
         CreateDraftRelease `
-          -tag '${{ inputs.tag || github.ref_name }}'
-      env:
-        GH_TOKEN: ${{ github.token }}
+          -gitRepository '${{ github.repository }}' `
+          -tag '${{ github.ref_name }}'
 
-    - name: Create GitHub draft Pull Request to update stable build version in props
-      if: |
-        (github.ref_type == 'tag' && startsWith(github.ref_name, 'core-') && !contains(github.ref_name, '-alpha') && !contains(github.ref_name, '-beta') && !contains(github.ref_name, '-rc'))
-        || (inputs.tag && startsWith(inputs.tag, 'core-') && !contains(inputs.tag, '-alpha') && !contains(inputs.tag, '-beta') && !contains(inputs.tag, '-rc'))
+    - name: Post notice when packages are ready
       shell: pwsh
       run: |
         Import-Module .\build\scripts\post-release.psm1
 
-        CreateStableVersionUpdatePullRequest `
-          -tag '${{ inputs.tag || github.ref_name }}'
-      env:
-        GH_TOKEN: ${{ github.token }}
+        TryPostPackagesReadyNoticeOnPrepareReleasePullRequest `
+          -gitRepository '${{ github.repository }}' `
+          -tag '${{ github.ref_name }}' `
+          -tagSha '${{ github.sha }}' `
+          -packagesUrl '${{ needs.build-pack-publish.outputs.artifact-url }}' `
+          -botUserName '${{ needs.automation.outputs.username }}'
+
+

OpenTelemetry.sln

@@ -86,6 +86,7 @@ EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "workflows", "workflows", "{E69578EB-B456-4062-A645-877CD964528B}"
 	ProjectSection(SolutionItems) = preProject
 		.github\workflows\add-labels.yml = .github\workflows\add-labels.yml
+		.github\workflows\automation.yml = .github\workflows\automation.yml
 		.github\workflows\ci.yml = .github\workflows\ci.yml
 		.github\workflows\codeql-analysis.yml = .github\workflows\codeql-analysis.yml
 		.github\workflows\Component.BuildTest.yml = .github\workflows\Component.BuildTest.yml
@@ -94,6 +95,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "workflows", "workflows", "{
 		.github\workflows\dotnet-format.yml = .github\workflows\dotnet-format.yml
 		.github\workflows\markdownlint.yml = .github\workflows\markdownlint.yml
 		.github\workflows\package-validation.yml = .github\workflows\package-validation.yml
+		.github\workflows\post-release.yml = .github\workflows\post-release.yml
 		.github\workflows\prepare-release.yml = .github\workflows\prepare-release.yml
 		.github\workflows\publish-packages-1.0.yml = .github\workflows\publish-packages-1.0.yml
 		.github\workflows\sanitycheck.yml = .github\workflows\sanitycheck.yml