Skip to content

Commit 0fab760

Browse files
seebeesseebees
authored
chore: break up release build (#655)
When doing releases having the steps in parts make it easer to follow. This also makes partial re-try simpler. Finally, the release now shares the exact tests with CI. So the release process is better tested.
1 parent affe237 commit 0fab760

File tree

6 files changed

+157
-75
lines changed

6 files changed

+157
-75
lines changed

‎buildspec.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@ batch:
2020
- identifier: testVectorsNodejsLatest
2121
buildspec: codebuild/test_vectors/nodejs_latest.yml
2222
env:
23+
variables:
24+
PUBLISH_LOCAL: "true"
2325
image: aws/codebuild/standard:5.0
2426
- identifier: testVectorsNodejs12
2527
buildspec: codebuild/test_vectors/nodejs12.yml
@@ -29,3 +31,7 @@ batch:
2931
image: aws/codebuild/standard:5.0
3032
- identifier: testVectorsBrowser
3133
buildspec: codebuild/test_vectors/browser.yml
34+
env:
35+
variables:
36+
PUBLISH_LOCAL: "true"
37+
image: aws/codebuild/standard:5.0

‎codebuild/release/prod-release.yml

Lines changed: 60 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -1,76 +1,65 @@
11
version: 0.2
22

3-
env:
4-
variables:
5-
NPM_CONFIG_UNSAFE_PERM: true
6-
NODE_OPTIONS: "--max-old-space-size=4096"
7-
BRANCH: "master"
8-
# An explicit version bump
9-
VERSION_BUMP: ""
10-
secrets-manager:
11-
OTP_SECRET_KEY: npm/aws-crypto-tools-ci-bot/2FA:OTP_SECRET_KEY
12-
NPM_TOKEN: npm/aws-crypto-tools-ci-bot/2FA:NPM_TOKEN
13-
git-credential-helper: yes
14-
15-
phases:
16-
install:
17-
commands:
18-
- npm ci --unsafe-perm
19-
# Install `otplib` to extract the OTP from the npm 2FA secret
20-
- npm install otplib --no-save
21-
- npm run build
22-
runtime-versions:
23-
nodejs: 12
24-
pre_build:
25-
commands:
26-
- git config --global user.name "aws-crypto-tools-ci-bot"
27-
- git config --global user.email "no-reply@noemail.local"
28-
- git checkout $BRANCH
29-
build:
30-
commands:
31-
# Pre-check, make sure everything is happy
32-
- npm test
33-
- npm run test_conditions
34-
# Publish to a local verdaccio server and run all tests against it
35-
- npm run verdaccio
36-
# Generate new version and CHANGELOG entry and push it
37-
- npx lerna version --conventional-commits --git-remote origin --yes ${VERSION_BUMP:+$VERSION_BUMP --force-publish}
38-
# Log the commit for posterity
39-
- git log -n 1
40-
# Extract the otp using the secrets environment variables from above.
41-
# This will wait for the next token. This is because npm uses
42-
# TOTP and the tokens time out after 30 seconds. If the process just
43-
# extracted the token then the lifetime for this token
44-
# would be very random. This will maximize the amount of time
45-
# available on the OTP to publish.
46-
- >-
47-
OTP=`node -e "
48-
auth=require('otplib').authenticator;
49-
setTimeout(() =>
50-
console.log(auth.generate(process.env.OTP_SECRET_KEY)),
51-
auth.timeRemaining() * 1000);
52-
"`
53-
# npm will only expand env vars inside .npmrc
54-
# NOTE the ' this is to keep the env var NPM_TOKEN from expanding!
55-
- echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' > .npmrc
56-
# Now we publish to npm.
57-
# This is going to use the OTP generated above and the NPM_TOKEN
58-
# environment variable. This will only publish things that are
59-
# missing from npm. It is therefore safe to run repeatedly.
60-
- npx lerna publish from-package --yes --otp $OTP
61-
# remove after publishing
62-
- rm .npmrc
63-
# Clear out the verdaccio cache so that we get the latest version
64-
# of everything from public npm
65-
- rm -rf verdaccio/storage/
66-
# Since the cache is empty, and we don't call `verdaccio-publish`
67-
# this will run the integrations from the public code in npm
68-
- npx run-s verdaccio-publish-*
69-
70-
71-
# Batching is technically unnecessary for now since we have just the one
72-
# buildspec, but leaving it in place makes it easier to extend later on
733
batch:
744
fast-fail: true
755
build-graph:
76-
- identifier: release_to_prod
6+
7+
# Lint and specification compliance
8+
- identifier: compliance
9+
buildspec: codebuild/compliance.yml
10+
11+
# Unit Tests
12+
- identifier: testNodejsLatest
13+
buildspec: codebuild/nodejs_latest.yml
14+
env:
15+
image: aws/codebuild/standard:5.0
16+
- identifier: testBrowser
17+
buildspec: codebuild/browser.yml
18+
19+
# Integration Tests
20+
- identifier: testVectorsNodejsLatest
21+
buildspec: codebuild/test_vectors/nodejs_latest.yml
22+
env:
23+
variables:
24+
PUBLISH_LOCAL: "true"
25+
image: aws/codebuild/standard:5.0
26+
- identifier: testVectorsBrowser
27+
buildspec: codebuild/test_vectors/browser.yml
28+
env:
29+
variables:
30+
PUBLISH_LOCAL: "true"
31+
image: aws/codebuild/standard:5.0
32+
33+
# Version the project and push git commits and tags
34+
- identifier: version
35+
depend-on:
36+
- compliance
37+
- testNodejsLatest
38+
- testBrowser
39+
- testVectorsNodejsLatest
40+
- testVectorsBrowser
41+
buildspec: codebuild/release/version.yml
42+
43+
# Publish the release to npm
44+
- identifier: publish
45+
depend-on:
46+
- version
47+
buildspec: codebuild/release/publish.yml
48+
49+
# Validate that the published versions are available
50+
- identifier: validateNodejs
51+
depend-on:
52+
- publish
53+
buildspec: codebuild/test_vectors/nodejs_latest.yml
54+
env:
55+
variables:
56+
PUBLISH_LOCAL: "false"
57+
image: aws/codebuild/standard:5.0
58+
- identifier: validateBrowser
59+
depend-on:
60+
- publish
61+
buildspec: codebuild/test_vectors/browser.yml
62+
env:
63+
variables:
64+
PUBLISH_LOCAL: "false"
65+
image: aws/codebuild/standard:5.0

‎codebuild/release/publish.yml

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
version: 0.2
2+
3+
env:
4+
variables:
5+
NODE_OPTIONS: "--max-old-space-size=4096"
6+
BRANCH: "master"
7+
secrets-manager:
8+
OTP_SECRET_KEY: npm/aws-crypto-tools-ci-bot/2FA:OTP_SECRET_KEY
9+
NPM_TOKEN: npm/aws-crypto-tools-ci-bot/2FA:NPM_TOKEN
10+
11+
phases:
12+
install:
13+
commands:
14+
- npm ci --unsafe-perm
15+
# Install `otplib` to extract the OTP from the npm 2FA secret
16+
- npm install otplib --no-save
17+
- npm run build
18+
runtime-versions:
19+
nodejs: 12
20+
pre_build:
21+
commands:
22+
- git checkout $BRANCH
23+
build:
24+
commands:
25+
# Extract the otp using the secrets environment variables from above.
26+
# This will wait for the next token. This is because npm uses
27+
# TOTP and the tokens time out after 30 seconds. If the process just
28+
# extracted the token then the lifetime for this token
29+
# would be very random. This will maximize the amount of time
30+
# available on the OTP to publish.
31+
- >-
32+
OTP=`node -e "
33+
auth=require('otplib').authenticator;
34+
setTimeout(() =>
35+
console.log(auth.generate(process.env.OTP_SECRET_KEY)),
36+
auth.timeRemaining() * 1000);
37+
"`
38+
# npm will only expand env vars inside .npmrc
39+
# NOTE the ' this is to keep the env var NPM_TOKEN from expanding!
40+
- echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' > .npmrc
41+
# Now we publish to npm.
42+
# This is going to use the OTP generated above and the NPM_TOKEN
43+
# environment variable. This will only publish things that are
44+
# missing from npm. It is therefore safe to run repeatedly.
45+
- npx lerna publish from-package --yes --otp $OTP
46+
# remove after publishing
47+
- rm .npmrc
48+

‎codebuild/release/version.yml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
version: 0.2
2+
3+
env:
4+
variables:
5+
NODE_OPTIONS: "--max-old-space-size=4096"
6+
BRANCH: "master"
7+
# An explicit version bump
8+
VERSION_BUMP: ""
9+
git-credential-helper: yes
10+
11+
phases:
12+
install:
13+
commands:
14+
- npm ci --unsafe-perm
15+
runtime-versions:
16+
nodejs: 12
17+
pre_build:
18+
commands:
19+
- git config --global user.name "aws-crypto-tools-ci-bot"
20+
- git config --global user.email "no-reply@noemail.local"
21+
- git checkout $BRANCH
22+
build:
23+
commands:
24+
# Generate new version and CHANGELOG entry and push it
25+
- npx lerna version --conventional-commits --git-remote origin --yes ${VERSION_BUMP:+$VERSION_BUMP --force-publish}
26+
# Log the commit for posterity
27+
- git log -n 1

‎codebuild/test_vectors/browser.yml

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,15 @@ phases:
1111
nodejs: latest
1212
commands:
1313
- npm ci
14-
- npm run build
14+
- |-
15+
if [ "$PUBLISH_LOCAL" = "true" ]; then
16+
npm run build
17+
fi
1518
build:
1619
commands:
17-
- npm run verdaccio-publish
20+
- |-
21+
if [ "$PUBLISH_LOCAL" = "true" ]; then
22+
npm run verdaccio-publish
23+
fi
1824
- npm run verdaccio-browser-decrypt
1925
- npm run verdaccio-browser-encrypt

‎codebuild/test_vectors/nodejs_latest.yml

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,15 @@ phases:
1111
nodejs: latest
1212
commands:
1313
- npm ci
14-
- npm run build
14+
- |-
15+
if [ "$PUBLISH_LOCAL" = "true" ]; then
16+
npm run build
17+
fi
1518
build:
1619
commands:
17-
- npm run verdaccio-publish
20+
- |-
21+
if [ "$PUBLISH_LOCAL" = "true" ]; then
22+
npm run verdaccio-publish
23+
fi
1824
- npm run verdaccio-node-decrypt
1925
- npm run verdaccio-node-encrypt

0 commit comments

Comments
 (0)