Github Workflow migrations

.github/scripts/common/lib.sh

@@ -264,3 +264,41 @@ function check_gpg() {
     echo "Checking GPG Signature for $1"
     gpg --no-tty --verify -q $1.asc $1
 }
+
+# GITHUB_REF will typically be like:
+# - refs/heads/release-v1.2.3
+# - refs/heads/release-polkadot-v1.2.3-rc2
+# This function extracts the version
+function get_version_from_ghref() {
+  GITHUB_REF=$1
+  stripped=${GITHUB_REF#refs/heads/release-}
+  re="v([0-9]+\.[0-9]+\.[0-9]+)"
+  if [[ $stripped =~ $re ]]; then
+    echo ${BASH_REMATCH[0]};
+    return 0
+  else
+    return 1
+  fi
+}
+
+# Get latest rc tag based on the release version and product
+function get_latest_rc_tag() {
+  version=$1
+  product=$2
+
+  if [[ "$product" == "polkadot" ]]; then
+    last_rc=$(git tag -l "$version-rc*" | sort -V | tail -n 1)
+  elif [[ "$product" == "polkadot-parachain"  ]]; then
+    last_rc=$(git tag -l "polkadot-parachains-$version-rc*" | sort -V | tail -n 1)
+  fi
+  echo "${last_rc}"
+}
+
+# Increment rc tag number based on the value of a suffix of the current rc tag
+function increment_rc_tag() {
+  last_rc=$1
+
+  suffix=$(echo "$last_rc" | grep -Eo '[0-9]+$')
+  ((suffix++))
+  echo $suffix
+}

.github/workflows/check-licenses.yml

@@ -9,7 +9,7 @@ permissions:
 
 jobs:
   check-licenses:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     env:
       LICENSES: "'Apache-2.0' 'GPL-3.0-only' 'GPL-3.0-or-later WITH Classpath-exception-2.0'"
       NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/notif-burnin-label.yml

@@ -0,0 +1,24 @@
+name: Notify DevOps when burn-in label applied
+on:
+  pull_request:
+    types: [labeled]
+
+jobs:
+  notify-devops:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        channel:
+          - name: 'Team: DevOps'
+            room: '!lUslSijLMgNcEKcAiE:parity.io'
+
+    steps:
+      - name: Send Matrix message to ${{ matrix.channel.name }}
+        if: startsWith(github.event.label.name, 'A0-')
+        uses: s3krit/matrix-message-action@70ad3fb812ee0e45ff8999d6af11cafad11a6ecf # v0.0.3
+        with:
+          room_id: ${{ matrix.channel.room }}
+          access_token: ${{ secrets.RELEASENOTES_MATRIX_V2_ACCESS_TOKEN }}
+          server: m.parity.io
+          message: |
+            @room Burn-in request received for [${{ github.event.pull_request.title }}](${{ github.event.pull_request.html_url }})

.github/workflows/release-10_rc-automation.yml

@@ -0,0 +1,112 @@
+name: Release - RC automation
+on:
+  push:
+    branches:
+      # Catches release-polkadot-v1.2.3, release-v1.2.3-rc1, etc
+      - release-v[0-9]+.[0-9]+.[0-9]+*
+      - release-cumulus-v[0-9]+*
+      - release-polkadot-v[0-9]+*
+
+  workflow_dispatch:
+
+jobs:
+  tag_rc:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        channel:
+          - name: "RelEng: Polkadot Release Coordination"
+            room: '!cqAmzdIcbOFwrdrubV:parity.io'
+
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          fetch-depth: 0
+
+      - name: Get release product
+        id: get_rel_product
+        shell: bash
+        run: |
+          current_branch=$(git branch --show-current)
+          echo "Current branch: $current_branch"
+          if [[ "$current_branch" =~ "release-polkadot" ]]; then
+            echo "product=polkadot" >> $GITHUB_OUTPUT
+          elif [[ "$current_branch" =~ "release-cumulus" ]]; then
+            echo "product=polkadot-parachain" >> $GITHUB_OUTPUT
+          fi
+
+
+      - name: Compute next rc tag for polkadot
+        if: ${{ steps.get_rel_product.outputs.product == 'polkadot' }}
+        id: compute_tag_polkadot
+        shell: bash
+        run: |
+          . ./.github/scripts/common/lib.sh
+
+          # Get last rc tag if exists, else set it to {version}-rc1
+          version=$(get_version_from_ghref ${GITHUB_REF})
+          echo "$version"
+          echo "version=$version" >> $GITHUB_OUTPUT
+
+          last_rc=$(get_latest_rc_tag $version polkadot)
+
+          if [ -n "$last_rc" ]; then
+            suffix=$(increment_rc_tag $last_rc)
+            echo "new_tag=$version-rc$suffix" >> $GITHUB_OUTPUT
+            echo "first_rc=false" >> $GITHUB_OUTPUT
+          else
+            echo "new_tag=$version-rc1" >> $GITHUB_OUTPUT
+            echo "first_rc=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Compute next rc tag for polkadot-parachain
+        if: ${{ steps.get_rel_product.outputs.product == 'polkadot-parachain' }}
+        id: compute_tag_cumulus
+        shell: bash
+        run: |
+          . ./.github/scripts/common/lib.sh
+
+          # Get last rc tag if exists, else set it to polkadot-parachains-{version}-rc1
+          version=$(get_version_from_ghref ${GITHUB_REF})
+          echo "$version"
+          echo "version=$version" >> $GITHUB_OUTPUT
+
+          last_rc=$(get_latest_rc_tag $version polkadot-parachain)
+          if [ -n "$last_rc" ]; then
+            suffix=$(increment_rc_tag $last_rc)
+            echo "new_tag=polkadot-parachains-$version-rc$suffix" >> $GITHUB_OUTPUT
+            echo "first_rc=false" >> $GITHUB_OUTPUT
+          else
+            echo "new_tag=polkadot-parachain-$version-rc1" >> $GITHUB_OUTPUT
+            echo "first_rc=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Apply new tag
+        uses: tvdias/github-tagger@ed7350546e3e503b5e942dffd65bc8751a95e49d # v0.0.2
+        with:
+          # We can't use the normal GITHUB_TOKEN for the following reason:
+          # https://docs.github.com/en/actions/reference/events-that-trigger-workflows#triggering-new-workflows-using-a-personal-access-token
+          # RELEASE_BRANCH_TOKEN requires public_repo OAuth scope
+          repo-token: "${{ secrets.RELEASE_BRANCH_TOKEN }}"
+          tag: ${{ steps.compute_tag_polkadot.outputs.new_tag || steps.compute_tag_cumulus.outputs.new_tag }}
+
+      # - id: create-issue
+      #   uses: JasonEtco/create-an-issue@e27dddc79c92bc6e4562f268fffa5ed752639abd # v2.9.1
+      #   # Only create the issue if it's the first release candidate
+      #   if: steps.compute_tag.outputs.first_rc == 'true'
+      #   env:
+      #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      #     VERSION: ${{ steps.compute_tag.outputs.version }}
+      #   with:
+      #     filename: .github/ISSUE_TEMPLATE/release.md
+
+      - name: Send Matrix message to ${{ matrix.channel.name }}
+        uses: s3krit/matrix-message-action@70ad3fb812ee0e45ff8999d6af11cafad11a6ecf # v0.0.3
+        # if: steps.create-issue.outputs.url != ''
+        with:
+          room_id: ${{ matrix.channel.room }}
+          access_token: ${{ secrets.RELEASENOTES_MATRIX_V2_ACCESS_TOKEN }}
+          server: m.parity.io
+          message: |
+            Release process for polkadot ${{ steps.compute_tag_polkadot.outputs.new_tag || steps.compute_tag_cumulus.outputs.new_tag }} has been started.<br/>

.github/workflows/release-99_notif-published.yml

@@ -0,0 +1,61 @@
+name: Release - Announce release to Matrix rooms
+on:
+  release:
+    types:
+      - published
+      - prereleased
+
+jobs:
+  ping_matrix:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        channel:
+          # Internal
+          - name: 'RelEng: Cumulus Release Coordination'
+            room: '!NAEMyPAHWOiOQHsvus:parity.io'
+            pre-releases: true
+          - name: "RelEng: Polkadot Release Coordination"
+            room: '!cqAmzdIcbOFwrdrubV:parity.io'
+            pre-release: true
+          - name: 'General: Rust, Polkadot, Substrate'
+            room: '!aJymqQYtCjjqImFLSb:parity.io'
+            pre-release: false
+          - name: 'Team: DevOps'
+            room: '!lUslSijLMgNcEKcAiE:parity.io'
+            pre-release: true
+
+         # External
+          - name: 'Ledger <> Polkadot Coordination'
+            room: '!EoIhaKfGPmFOBrNSHT:web3.foundation'
+            pre-release: true
+
+          # Public
+          # - name: '#KusamaValidatorLounge:polkadot.builders'
+          #   room: '!LhjZccBOqFNYKLdmbb:polkadot.builders'
+          #   pre-releases: false
+          # - name: '#kusama-announcements:matrix.parity.io'
+          #   room: '!FMwxpQnYhRCNDRsYGI:matrix.parity.io'
+          #   pre-release: false
+          # - name: '#polkadotvalidatorlounge:web3.foundation'
+          #   room: '!NZrbtteFeqYKCUGQtr:matrix.parity.io'
+          #   pre-release: false
+          # - name: '#polkadot-announcements:matrix.parity.io'
+          #   room: '!UqHPWiCBGZWxrmYBkF:matrix.parity.io'
+          #   pre-release: false
+
+    steps:
+      - name: Matrix notification to ${{ matrix.channel.name }}
+        if: github.event.release.prerelease == false || matrix.channel.pre-release
+        uses: s3krit/matrix-message-action@70ad3fb812ee0e45ff8999d6af11cafad11a6ecf # v0.0.3
+        with:
+          room_id: ${{ matrix.channel.room }}
+          access_token: ${{ secrets.RELEASENOTES_MATRIX_V2_ACCESS_TOKEN }}
+          server: m.parity.io
+          message: |
+            A (pre)release has been ${{github.event.action}} in **${{github.event.repository.full_name}}:**<br/>
+            Release version: [${{github.event.release.tag_name}}](${{github.event.release.html_url}})
+
+            -----
+
+            ${{github.event.release.body}}