Release automation

.github/workflows/release-finalize.yml

@@ -33,7 +33,6 @@ jobs:
 
       - uses: actions/checkout@v4
         with:
-          persist-credentials: false
           ref: main
           fetch-depth: 0
 
@@ -76,18 +75,11 @@ jobs:
             "docs: update ${LANGUAGE} layer ARNs for ${TAG}"
 
       - name: Push release branch
-        env:
-          REMOTE: >-
-            https://x-access-token:${{ secrets.RELEASE_PAT
-            }}@github.com/${{ github.repository }}
-        run: |
-          git remote set-url origin "${REMOTE}"
-          git push origin \
-            "${{ steps.parse.outputs.release_branch }}"
+        run: git push origin "${{ steps.parse.outputs.release_branch }}"
 
       - name: Create pull request
         env:
-          GH_TOKEN: ${{ secrets.RELEASE_PAT }}
+          GH_TOKEN: ${{ github.token }}
           TAG: ${{ steps.parse.outputs.tag }}
           LANGUAGE: ${{ steps.parse.outputs.language }}
           RELEASE_BRANCH: >-

.github/workflows/release-prepare.yml

@@ -44,7 +44,6 @@ jobs:
 
       - uses: actions/checkout@v4
         with:
-          persist-credentials: false
           fetch-depth: 0
           submodules: true
 
@@ -87,17 +86,11 @@ jobs:
           git commit -m "${COMMIT_MSG}"
 
       - name: Push branch
-        env:
-          REMOTE: >-
-            https://x-access-token:${{ secrets.RELEASE_PAT
-            }}@github.com/${{ github.repository }}
-        run: |
-          git remote set-url origin "${REMOTE}"
-          git push origin "${BRANCH}"
+        run: git push origin "${BRANCH}"
 
       - name: Ensure release label exists
         env:
-          GH_TOKEN: ${{ secrets.RELEASE_PAT }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           gh label create release \
             --color "0075ca" \
@@ -106,7 +99,7 @@ jobs:
 
       - name: Create pull request
         env:
-          GH_TOKEN: ${{ secrets.RELEASE_PAT }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           gh pr create \
             --title "feat: prepare release ${LANGUAGE} v${VERSION}" \

.github/workflows/release-tag.yml

@@ -32,7 +32,6 @@ jobs:
 
       - uses: actions/checkout@v4
         with:
-          persist-credentials: false
           ref: main
           fetch-depth: 0
 
@@ -45,10 +44,6 @@ jobs:
       - name: Create and push tag
         env:
           TAG: ${{ steps.parse.outputs.tag }}
-          REMOTE: >-
-            https://x-access-token:${{ secrets.RELEASE_PAT
-            }}@github.com/${{ github.repository }}
         run: |
           git tag -m "${TAG}" "${TAG}"
-          git remote set-url origin "${REMOTE}"
           git push origin "${TAG}"

ci/release-finalize.sh

@@ -0,0 +1,110 @@
+#!/bin/bash
+
+set -euo pipefail
+
+: "${TAG:?TAG is required (e.g. python-v1.41.0)}"
+: "${LANGUAGE:?LANGUAGE is required (java, nodejs, or python)}"
+: "${VERSION:?VERSION is required (e.g. 1.41.0)}"
+
+README="${LANGUAGE}/README.md"
+
+gh api "repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}" \
+  --jq '.body' > /tmp/release_body.md
+
+python3 - "${README}" "${TAG}" "${VERSION}" /tmp/release_body.md <<'PYEOF'
+import re
+import sys
+
+readme_path = sys.argv[1]
+tag = sys.argv[2]
+version = sys.argv[3]
+release_body_path = sys.argv[4]
+
+with open(release_body_path) as f:
+    body = f.read()
+
+def extract_table(text, heading_fragment):
+    lines = text.splitlines()
+    capture = False
+    table_lines = []
+    for line in lines:
+        if heading_fragment.lower() in line.lower():
+            capture = True
+            continue
+        if capture:
+            if line.startswith("##"):
+                break
+            if line.strip():
+                table_lines.append(line)
+    return "\n".join(table_lines)
+
+amd64_table = extract_table(body, "AMD64 Lambda Layers List")
+arm64_table = extract_table(body, "ARM64 Lambda Layers List")
+
+if not amd64_table:
+    print("ERROR: Could not extract AMD64 table from pre-release body",
+          file=sys.stderr)
+    sys.exit(1)
+if not arm64_table:
+    print("ERROR: Could not extract ARM64 table from pre-release body",
+          file=sys.stderr)
+    sys.exit(1)
+
+with open(readme_path) as f:
+    content = f.read()
+
+if "unreleased version" not in content:
+    print(f"ERROR: 'unreleased version' not found in {readme_path}",
+          file=sys.stderr)
+    sys.exit(1)
+
+content = re.sub(
+    r"unreleased version",
+    f"v{version}",
+    content,
+    count=1,
+)
+
+def replace_section(text, heading, new_table):
+    lines = text.splitlines()
+    result = []
+    skip = False
+    found = False
+    for line in lines:
+        if line.strip().startswith("##") and heading.lower() in line.lower():
+            found = True
+            result.append(line)
+            result.append("")
+            result.append(new_table)
+            result.append("")
+            skip = True
+            continue
+        if skip:
+            if line.strip().startswith("##"):
+                skip = False
+                result.append(line)
+            continue
+        result.append(line)
+    if not found:
+        print(f"ERROR: heading '{heading}' not found in {readme_path}",
+              file=sys.stderr)
+        sys.exit(1)
+    return "\n".join(result)
+
+content = replace_section(content, "AMD64 Lambda Layers List", amd64_table)
+content = replace_section(content, "ARM64 Lambda Layers List", arm64_table)
+
+content = re.sub(
+    r"releases/download/[^/]+/",
+    f"releases/download/{tag}/",
+    content,
+)
+
+if not content.endswith("\n"):
+    content += "\n"
+
+with open(readme_path, "w") as f:
+    f.write(content)
+
+print(f"Updated {readme_path} with ARN tables for {tag}")
+PYEOF

ci/release-prepare.sh

@@ -0,0 +1,128 @@
+#!/bin/bash
+
+set -euo pipefail
+
+: "${LANGUAGE:?LANGUAGE is required (java, nodejs, or python)}"
+: "${VERSION:?VERSION is required (e.g. 1.41.0)}"
+
+VERSION_DASHED="v${VERSION//./-}"
+TAG="${LANGUAGE}-v${VERSION}"
+RELEASE_BRANCH="release-${TAG}"
+DATE="$(date +%Y-%m-%d)"
+
+LAYER_DATA="${LANGUAGE}/layer-data.sh"
+TEMPLATE="${LANGUAGE}/sample-apps/template.yaml"
+
+# Clean up .bak files on exit (including early exits)
+cleanup() { find . -maxdepth 3 -name '*.bak' -delete; }
+trap cleanup EXIT
+
+OLD_VERSION_DASHED=$(grep '^VERSION=' "${LAYER_DATA}" | cut -d= -f2)
+if [[ -z "${OLD_VERSION_DASHED}" ]]; then
+  echo "ERROR: could not extract VERSION from ${LAYER_DATA}" >&2
+  exit 1
+fi
+
+# --- Update CHANGELOG.md ---
+
+cat > /tmp/changelog_block.md <<EOF
+
+## [${TAG}]
+
+### Released ${DATE}
+
+### Changed
+
+- TODO: fill in changelog
+
+[${TAG}]: https://github.com/SumoLogic/sumologic-otel-lambda/releases/tag/${TAG}
+EOF
+
+if ! grep -q '^All notable changes' CHANGELOG.md; then
+  echo "ERROR: could not find 'All notable changes' header in CHANGELOG.md" >&2
+  exit 1
+fi
+sed -i.bak "/^All notable changes/r /tmp/changelog_block.md" CHANGELOG.md
+
+# --- Update layer-data.sh ---
+
+sed -i.bak "s|^VERSION=.*|VERSION=${VERSION_DASHED}|" "${LAYER_DATA}"
+
+sed -i.bak \
+  "s|tree/[^/]*/\{0,1\}${LANGUAGE}|tree/${RELEASE_BRANCH}/${LANGUAGE}|" \
+  "${LAYER_DATA}"
+
+# --- Update template.yaml ---
+
+sed -i.bak "s|${OLD_VERSION_DASHED}|${VERSION_DASHED}|g" "${TEMPLATE}"
+
+# --- Detect component versions from submodule ---
+
+COLLECTOR_VERSION=$(grep "go.opentelemetry.io/collector/otelcol v" \
+  opentelemetry-lambda/collector/go.mod | awk '{print $2}')
+if [[ -z "${COLLECTOR_VERSION}" ]]; then
+  echo "ERROR: could not extract COLLECTOR_VERSION from collector/go.mod" >&2
+  exit 1
+fi
+
+case "${LANGUAGE}" in
+  python)
+    SDK_VERSION=$(grep "^opentelemetry-sdk==" \
+      opentelemetry-lambda/python/src/otel/otel_sdk/requirements.txt \
+      | cut -d= -f3)
+    INSTRUMENTATION_VERSION=$(grep "^opentelemetry-distro==" \
+      opentelemetry-lambda/python/src/otel/otel_sdk/requirements.txt \
+      | cut -d= -f3)
+    if [[ -z "${SDK_VERSION}" ]]; then
+      echo "ERROR: could not extract opentelemetry-sdk version from requirements.txt" >&2
+      exit 1
+    fi
+    if [[ -z "${INSTRUMENTATION_VERSION}" ]]; then
+      echo "ERROR: could not extract opentelemetry-distro version from requirements.txt" >&2
+      exit 1
+    fi
+    ;;
+  nodejs)
+    # Extract version from the resolved field which is stable across npm lock formats
+    SDK_VERSION=v$(grep -A5 '"node_modules/@opentelemetry/sdk-trace-node"' \
+      opentelemetry-lambda/nodejs/package-lock.json \
+      | grep '"version"' | grep -o '[0-9][0-9.]*' | head -1)
+    if [[ "${SDK_VERSION}" == "v" ]]; then
+      echo "ERROR: could not extract @opentelemetry/sdk-trace-node version from package-lock.json" >&2
+      exit 1
+    fi
+    ;;
+  java)
+    SDK_VERSION=$(grep 'opentelemetry-javaagent:' \
+      opentelemetry-lambda/java/dependencyManagement/build.gradle.kts \
+      | grep -o '[0-9][0-9.]*' | head -1)
+    if [[ -z "${SDK_VERSION}" ]]; then
+      echo "ERROR: could not extract opentelemetry-javaagent version from build.gradle.kts" >&2
+      exit 1
+    fi
+    ;;
+esac
+
+# --- Update root README.md ---
+
+sed -i.bak \
+  "s|release-${LANGUAGE}-v[0-9][0-9.]*/${LANGUAGE}|release-${LANGUAGE}-v${VERSION}/${LANGUAGE}|g" \
+  README.md
+
+case "${LANGUAGE}" in
+  python)
+    sed -i.bak "/Python layer/s|SDK \`v[^\`]*\`|SDK \`v${SDK_VERSION}\`|" README.md
+    sed -i.bak "/Python layer/s|instrumentation \`v[^\`]*\`|instrumentation \`v${INSTRUMENTATION_VERSION}\`|" README.md
+    sed -i.bak "/Python layer/s|Collector \`v[^\`]*\`|Collector \`${COLLECTOR_VERSION}\`|" README.md
+    ;;
+  nodejs)
+    sed -i.bak "/NodeJS layer/s|SDK \`v[^\`]*\`|SDK \`${SDK_VERSION}\`|" README.md
+    sed -i.bak "/NodeJS layer/s|Collector \`v[^\`]*\`|Collector \`${COLLECTOR_VERSION}\`|" README.md
+    ;;
+  java)
+    sed -i.bak "/Java wrapper/s|Java \`v[^\`]*\`|Java \`v${SDK_VERSION}\`|" README.md
+    sed -i.bak "/Java wrapper/s|Collector \`v[^\`]*\`|Collector \`${COLLECTOR_VERSION}\`|" README.md
+    ;;
+esac
+
+echo "Release preparation complete for ${TAG}"