Main -> Next Server

.github/workflows/build-and-publish-docker.yml

@@ -0,0 +1,123 @@
+name: Build and Publish Docker Image
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version tag for the Docker image (e.g., 1.2.3 or v1.2.3)'
+        required: true
+        type: string
+      publish:
+        description: 'Push the image to Docker Hub'
+        required: false
+        type: boolean
+        default: true
+      tag_latest:
+        description: 'Also tag this image as latest'
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  build-and-publish:
+    name: Build and Publish Docker Image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Get build metadata from release
+        id: meta
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
+          INPUT_TAG_LATEST: ${{ inputs.tag_latest }}
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const inputVersion = process.env.INPUT_VERSION;
+            const inputTagLatest = process.env.INPUT_TAG_LATEST;
+
+            const version = inputVersion.startsWith('v') ? inputVersion.slice(1) : inputVersion;
+            const releaseTag = inputVersion.startsWith('v') ? inputVersion : `v${inputVersion}`;
+
+            const { data: release } = await github.rest.repos.getReleaseByTag({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              tag: releaseTag
+            });
+
+            const cliSha = release.target_commitish;
+            const imageShaTag = cliSha.substring(0, 7);
+
+            core.setOutput('cli_sha', cliSha);
+            core.setOutput('image_sha_tag', imageShaTag);
+            core.setOutput('version', version);
+            core.setOutput('release_tag', releaseTag);
+            core.setOutput('tag_latest', inputTagLatest === 'true');
+
+      - name: Download release assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ steps.meta.outputs.release_tag }}
+        run: |
+          echo "Downloading assets from release ${RELEASE_TAG}..."
+          gh release download "${RELEASE_TAG}" --pattern "temporal_*_linux_*.tar.gz"
+
+          echo "Extracting and organizing binaries..."
+          mkdir -p dist/amd64 dist/arm64
+
+          tar -xzf temporal_*_linux_amd64.tar.gz
+          mv temporal dist/amd64/temporal
+
+          tar -xzf temporal_*_linux_arm64.tar.gz
+          mv temporal dist/arm64/temporal
+
+          echo "Verifying binaries..."
+          ls -lh dist/amd64/temporal
+          ls -lh dist/arm64/temporal
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        if: inputs.publish
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Build and push Docker image
+        if: inputs.publish
+        run: |
+          docker buildx bake \
+            --file docker-bake.hcl \
+            --push \
+            cli
+        env:
+          CLI_SHA: ${{ steps.meta.outputs.cli_sha }}
+          IMAGE_SHA_TAG: ${{ steps.meta.outputs.image_sha_tag }}
+          VERSION: ${{ steps.meta.outputs.version }}
+          TAG_LATEST: ${{ steps.meta.outputs.tag_latest }}
+          IMAGE_NAMESPACE: temporalio
+          IMAGE_NAME: temporal
+          GITHUB_REPOSITORY: ${{ github.repository }}
+
+      - name: Build Docker image (no push)
+        if: ${{ !inputs.publish }}
+        run: |
+          docker buildx bake \
+            --file docker-bake.hcl \
+            cli
+        env:
+          CLI_SHA: ${{ steps.meta.outputs.cli_sha }}
+          IMAGE_SHA_TAG: ${{ steps.meta.outputs.image_sha_tag }}
+          VERSION: ${{ steps.meta.outputs.version }}
+          TAG_LATEST: ${{ steps.meta.outputs.tag_latest }}
+          IMAGE_NAMESPACE: temporalio
+          IMAGE_NAME: temporal
+          GITHUB_REPOSITORY: ${{ github.repository }}

.github/workflows/ci.yaml

@@ -10,10 +10,17 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, macos-13, windows-latest, ubuntu-arm]
+        os:
+          [
+            ubuntu-latest,
+            macos-latest,
+            macos-15-intel,
+            windows-latest,
+            ubuntu-arm,
+          ]
         include:
           - os: ubuntu-latest
-            checkGenCodeTarget: true
+            checkGenCommands: true
             cloudTestTarget: true
           - os: ubuntu-arm
             runsOn: buildjet-4vcpu-ubuntu-2204-arm
@@ -31,7 +38,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version-file: 'go.mod'
+          go-version-file: go.mod
 
       - name: Install gotestsum
         run: go install gotest.tools/gotestsum@latest
@@ -42,7 +49,7 @@ jobs:
       - name: Test
         run: gotestsum --junitfile junit-xml/${{matrix.os}}.xml -- ./...
 
-      - name: 'Upload junit-xml artifacts'
+      - name: Upload junit-xml artifacts
         uses: actions/upload-artifact@v4
         if: always()
         with:
@@ -51,11 +58,16 @@ jobs:
           retention-days: 14
 
       - name: Regen code, confirm unchanged
-        if: ${{ matrix.checkGenCodeTarget }}
+        if: ${{ matrix.checkGenCommands }}
         run: |
-          go run ./temporalcli/internal/cmd/gen-commands
+          go run ./cmd/gen-commands -input internal/temporalcli/commands.yaml -pkg temporalcli -context "*CommandContext" > internal/temporalcli/commands.gen.go
           git diff --exit-code
 
+      - name: Generate docs, confirm working
+        if: ${{ matrix.checkGenCommands }}
+        run: |
+          go run ./cmd/gen-docs -input internal/temporalcli/commands.yaml -output dist/docs
+
       - name: Test cloud mTLS
         if: ${{ matrix.cloudTestTarget && env.HAS_SECRETS == 'true' }}
         env:

.github/workflows/goreleaser.yml → .github/workflows/release.yml

@@ -1,50 +1,55 @@
-name: goreleaser
+name: Release
 
 on:
   workflow_dispatch:
   release:
     types:
       - published
 
+permissions:
+  contents: write
+
 jobs:
-  goreleaser:
+  release:
+    name: Release
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
+        uses: actions/setup-go@v6
         with:
           go-version-file: "go.mod"
           check-latest: true
+          cache: true
 
       - name: Get build date
         id: date
-        run: echo "::set-output name=date::$(date '+%F-%T')"
+        run: echo "date=$(date '+%F-%T')" >> "$GITHUB_OUTPUT"
 
       - name: Get build unix timestamp
         id: timestamp
-        run: echo "::set-output name=timestamp::$(date '+%s')"
+        run: echo "timestamp=$(date '+%s')" >> "$GITHUB_OUTPUT"
 
       - name: Get git branch
         id: branch
-        run: echo "::set-output name=branch::$(git rev-parse --abbrev-ref HEAD)"
+        run: echo "branch=$(git rev-parse --abbrev-ref HEAD)" >> "$GITHUB_OUTPUT"
 
       - name: Get build platform
         id: platform
-        run: echo "::set-output name=platform::$(go version | cut -d ' ' -f 4)"
+        run: echo "platform=$(go version | cut -d ' ' -f 4)" >> "$GITHUB_OUTPUT"
 
       - name: Get Go version
         id: go
-        run: echo "::set-output name=go::$(go version | cut -d ' ' -f 3)"
+        run: echo "go=$(go version | cut -d ' ' -f 3)" >> "$GITHUB_OUTPUT"
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@336e29918d653399e599bfca99fadc1d7ffbc9f7 # v4.3.0
+        uses: goreleaser/goreleaser-action@v6
         with:
-          version: v1.26.2
+          version: v2.12.7
           args: release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/trigger-docs.yml

@@ -3,41 +3,50 @@ on:
   workflow_dispatch:
   release:
     types: [published]
+
+permissions:
+  contents: read
+
 jobs:
   update:
+    if: github.repository == 'temporalio/cli'
     runs-on: ubuntu-latest
     defaults:
       run:
         shell: bash
     steps:
       - name: Get user info from GitHub API
         id: get_user
+        env:
+          GITHUB_ACTOR: ${{ github.actor }}
         run: |
-          echo "GitHub actor: ${{ github.actor }}"
+          echo "GitHub actor: ${GITHUB_ACTOR}"
           # Query the GitHub API for the user's details.
           curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
-            https://api.github.com/users/${{ github.actor }} > user.json
-          
+            "https://api.github.com/users/${GITHUB_ACTOR}" > user.json
+
           # Extract the user's full name if available, default to the username otherwise.
           git_name=$(jq -r '.name // empty' user.json)
           if [ -z "$git_name" ]; then
-            git_name="${{ github.actor }}"
+            git_name="${GITHUB_ACTOR}"
           fi
-          
-          git_email="${{ github.actor }}@users.noreply.github.com"
-          
+
+          git_email="${GITHUB_ACTOR}@users.noreply.github.com"
+
           # Set the outputs for subsequent steps.
-          echo "GIT_NAME=$git_name" >> $GITHUB_OUTPUT
-          echo "GIT_EMAIL=$git_email" >> $GITHUB_OUTPUT
+          echo "GIT_NAME=$git_name" >> "$GITHUB_OUTPUT"
+          echo "GIT_EMAIL=$git_email" >> "$GITHUB_OUTPUT"
 
       - name: Generate token
         id: generate_token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ secrets.TEMPORAL_CICD_APP_ID }}
           private-key: ${{ secrets.TEMPORAL_CICD_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
-          repositories: documentation # generate a token with permissions to trigger GHA in documentation repo
+          # Generate a token with permissions to trigger GHA in documentation repo.
+          repositories: |
+            documentation
 
       - name: Trigger Documentation Workflow
         env: