feat(release): add SubPlat tag schema and release workflow

.circleci/config.yml

@@ -1202,7 +1202,7 @@ workflows:
             branches:
               ignore: /.*/
             tags:
-              only: /.*/
+              only: /^v\d+\.\d+\.\d+(-rc\d+)?$/
           nx_run: run-many --no-cloud
           requires:
             - Build
@@ -1216,7 +1216,7 @@ workflows:
             branches:
               ignore: /.*/
             tags:
-              only: /.*/
+              only: /^v\d+\.\d+\.\d+(-rc\d+)?$/
           nx_run: run-many --no-cloud
           requires:
             - Build
@@ -1229,7 +1229,7 @@ workflows:
             branches:
               ignore: /.*/
             tags:
-              only: /.*/
+              only: /^v\d+\.\d+\.\d+(-rc\d+)?$/
           nx_run: run-many --no-cloud
           requires:
             - Build
@@ -1244,7 +1244,7 @@ workflows:
             branches:
               ignore: /.*/
             tags:
-              only: /.*/
+              only: /^v\d+\.\d+\.\d+(-rc\d+)?$/
           nx_run: run-many --no-cloud
           requires:
             - Build
@@ -1258,7 +1258,7 @@ workflows:
             branches:
               ignore: /.*/
             tags:
-              only: /.*/
+              only: /^v\d+\.\d+\.\d+(-rc\d+)?$/
           nx_run: run-many --no-cloud
           requires:
             - Build
@@ -1271,7 +1271,7 @@ workflows:
             branches:
               ignore: /.*/
             tags:
-              only: /.*/
+              only: /^v\d+\.\d+\.\d+(-rc\d+)?$/
           nx_run: run-many --no-cloud
           requires:
             - Build
@@ -1282,7 +1282,17 @@ workflows:
             branches:
               ignore: /.*/
             tags:
-              only: /.*/
+              only: /^v\d+\.\d+\.\d+(-rc\d+)?$/
+          requires:
+            - Build
+      - playwright-payments-tests:
+          name: Payments Functional Tests - Playwright
+          workflow: test_and_deploy_tag
+          filters:
+            branches:
+              ignore: /.*/
+            tags:
+              only: /^subplat-v\d+\.\d+\.\d+(-rc\d+)?$/
           requires:
             - Build
 

.github/workflows/docker.yml

@@ -19,7 +19,7 @@ jobs:
     steps:
       - id: determine
         run: |
-          if [[ ! "${GIT_TAG}" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-rc[0-9]+)?$ ]]; then
+          if [[ ! "${GIT_TAG}" =~ ^(subplat-)?v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-rc[0-9]+)?$ ]]; then
             echo "Invalid tag: ${GIT_TAG}"
             echo "Invalid tag format: ${GIT_TAG}" >> "$GITHUB_STEP_SUMMARY"
             exit 1

.github/workflows/tag-release-subplat.yml

@@ -0,0 +1,83 @@
+name: Tag Release SubPlat
+on:
+  workflow_dispatch: {}
+permissions: {}
+jobs:
+  tagrelease:
+    permissions:
+      contents: write # To create a branch and tags
+    runs-on: ubuntu-latest
+    outputs:
+      TAG: ${{ steps.echo.outputs.tag }}
+    steps:
+      - name: Show GitHub context
+        env:
+          GITHUB_CONTEXT: ${{ toJson(github) }}
+        run: echo "$GITHUB_CONTEXT"
+        shell: bash
+
+      - name: Check out code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Fetch all git tags
+        run: git fetch --tags origin
+
+      - name: Resolve latest FxA train tag
+        run: |
+          set -euo pipefail
+          latest_fxa_tag=$(git tag -l 'v1.*.0' --sort=version:refname | grep -v '-' | tail -1)
+          if [[ -z "${latest_fxa_tag}" ]]; then
+            echo "ERROR: no v1.*.0 FxA train tag found in this repo." >&2
+            exit 1
+          fi
+          if [[ ! "${latest_fxa_tag}" =~ ^v1\.([0-9]+)\.0$ ]]; then
+            echo "ERROR: latest FxA train tag '${latest_fxa_tag}' did not parse as v1.<TRAIN>.0." >&2
+            exit 1
+          fi
+          train="${BASH_REMATCH[1]}"
+          sha=$(git rev-list -n 1 "${latest_fxa_tag}")
+          {
+            echo "TRAIN=${train}"
+            echo "SUBPLAT_TAG=subplat-v1.${train}.0"
+            echo "SUBPLAT_BRANCH=subplat-train-${train}"
+            echo "SUBPLAT_SHA=${sha}"
+          } >> "$GITHUB_ENV"
+          echo "Resolved ${latest_fxa_tag} (sha ${sha}); preparing subplat-v1.${train}.0 / subplat-train-${train}"
+
+      - name: Pre-flight - SubPlat tag must not already exist
+        run: |
+          set -euo pipefail
+          if git ls-remote --exit-code --tags origin "refs/tags/${SUBPLAT_TAG}" >/dev/null 2>&1; then
+            echo "Refusing to create ${SUBPLAT_TAG} - tag already exists on origin." >&2
+            exit 1
+          fi
+
+      - name: Pre-flight - SubPlat branch must not already exist
+        run: |
+          set -euo pipefail
+          if git ls-remote --exit-code --heads origin "refs/heads/${SUBPLAT_BRANCH}" >/dev/null 2>&1; then
+            echo "Refusing to create ${SUBPLAT_BRANCH} - branch already exists on origin." >&2
+            exit 1
+          fi
+
+      - name: Add git tag to output
+        id: echo
+        run: |
+          echo "tag=${SUBPLAT_TAG}" >> "$GITHUB_OUTPUT"
+
+      - name: Create release branch
+        run: git checkout -b "${SUBPLAT_BRANCH}" "${SUBPLAT_SHA}"
+
+      - name: Initialize mandatory git config
+        run: |
+          git config user.name "${GITHUB_TRIGGERING_ACTOR}"
+          git config user.email "noreply@github.com"
+
+      - name: Push branch
+        run: |
+          git push origin "${SUBPLAT_BRANCH}"
+
+      - name: Make a new tag
+        run: |
+          git tag -a "${SUBPLAT_TAG}" -m "SubPlat train release ${SUBPLAT_TAG}"
+          git push origin "${SUBPLAT_TAG}"

_scripts/trigger-docker-push-subplat.sh

@@ -0,0 +1,44 @@
+#! /bin/bash
+#
+# Trigger the GitHub Actions docker.yml workflow to build and push the
+# fxa-mono image at a given SubPlat git tag.
+#
+# Usage:
+#   ./_scripts/trigger-docker-push-subplat.sh <tag>
+#
+# Examples:
+#   ./_scripts/trigger-docker-push-subplat.sh subplat-v1.338.0
+#   ./_scripts/trigger-docker-push-subplat.sh subplat-v1.338.1
+#
+# Requires the `gh` CLI authenticated (run `gh auth status` to check).
+
+set -euo pipefail
+
+tag="${1:-}"
+
+if [[ -z "${tag}" ]]; then
+  echo "Usage: ${0} <tag>" >&2
+  exit 1
+fi
+
+if [[ ! "${tag}" =~ ^subplat-v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-rc[0-9]+)?$ ]]; then
+  echo "ERROR: '${tag}' does not match the expected format (subplat-vMAJOR.MINOR.PATCH[-rcN])." >&2
+  exit 1
+fi
+
+if ! command -v gh >/dev/null 2>&1; then
+  echo "ERROR: the 'gh' CLI is not installed (https://cli.github.com)." >&2
+  exit 1
+fi
+
+repo="mozilla/fxa"
+
+if ! gh api "repos/${repo}/git/refs/tags/${tag}" --silent >/dev/null 2>&1; then
+  echo "ERROR: tag '${tag}' does not exist on github.com/${repo}." >&2
+  exit 1
+fi
+
+gh workflow run docker.yml --repo "${repo}" -f "git_tag=${tag}"
+
+echo "Triggered docker build for tag ${tag}"
+echo "https://github.com/${repo}/actions/workflows/docker.yml"

_scripts/trigger-dot-release-subplat.sh

@@ -0,0 +1,79 @@
+#! /bin/bash
+#
+# Tag a SubPlat patch release on the current subplat-train branch and push it
+# to a remote. Defaults to 'origin'. Pushing the tag is what kicks off the
+# docker.yml build via `yarn trigger:docker-push-subplat <tag>`.
+#
+# Usage:
+#   ./_scripts/trigger-dot-release-subplat.sh <tag>
+#   FXA_REMOTE=<remote> ./_scripts/trigger-dot-release-subplat.sh <tag>
+#
+# Environment variables:
+#   FXA_REMOTE   Git remote to fetch/push against (default: origin).
+#
+# Examples:
+#   ./_scripts/trigger-dot-release-subplat.sh subplat-v1.338.1
+#   ./_scripts/trigger-dot-release-subplat.sh subplat-v1.338.0-rc1
+#   FXA_REMOTE=upstream ./_scripts/trigger-dot-release-subplat.sh subplat-v1.338.1
+#
+# Pre-flight checklist (run yourself before invoking):
+#   - Patch has been merged into the subplat-train branch locally
+#   - You've run the server and tests to verify the patch behaves correctly
+
+set -euo pipefail
+
+tag="${1:-}"
+
+if [[ -z "${tag}" ]]; then
+  echo "Usage: [FXA_REMOTE=<remote>] ${0} <tag>" >&2
+  echo "  FXA_REMOTE  Git remote to fetch/push against (default: origin)." >&2
+  exit 1
+fi
+
+if [[ ! "${tag}" =~ ^subplat-v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-rc[0-9]+)?$ ]]; then
+  echo "ERROR: '${tag}' does not match the expected format (subplat-vMAJOR.MINOR.PATCH[-rcN])." >&2
+  exit 1
+fi
+
+minor="${BASH_REMATCH[2]}"
+branch="subplat-train-${minor}"
+remote="${FXA_REMOTE:-origin}"
+
+echo "Fetching latest tags from ${remote}..."
+git fetch "${remote}" --tags
+
+current_branch=$(git rev-parse --abbrev-ref HEAD)
+if [[ "${current_branch}" != "${branch}" ]]; then
+  echo "ERROR: current branch is '${current_branch}', expected '${branch}'." >&2
+  echo "Switch to ${branch} before tagging: git checkout ${branch}" >&2
+  exit 1
+fi
+
+if git rev-parse "${tag}" >/dev/null 2>&1; then
+  echo "ERROR: tag '${tag}' already exists locally." >&2
+  exit 1
+fi
+
+if git ls-remote --tags --exit-code "${remote}" "refs/tags/${tag}" >/dev/null 2>&1; then
+  echo "ERROR: tag '${tag}' already exists on ${remote}." >&2
+  exit 1
+fi
+
+echo "About to:"
+echo "  1. push ${branch} to ${remote}"
+echo "  2. create tag ${tag} at HEAD ($(git rev-parse --short HEAD))"
+echo "  3. push tag ${tag} to ${remote}"
+echo
+read -p "Proceed? (y/N): " confirm
+if [[ ! "${confirm}" =~ ^[yY]([eE][sS])?$ ]]; then
+  echo "Aborted."
+  exit 1
+fi
+
+git push "${remote}" "${branch}"
+git tag -a "${tag}" -m "SubPlat train release ${tag}"
+git push "${remote}" "${tag}"
+
+echo
+echo "Tagged ${tag}. Kick off the docker build with:"
+echo "  yarn trigger:docker-push-subplat ${tag}"

package.json

@@ -28,8 +28,10 @@
     "prepare": "husky",
     "check:frozen": "ts-node _scripts/check-frozen.ts",
     "trigger:docker-push": "_scripts/trigger-docker-push.sh",
+    "trigger:docker-push-subplat": "_scripts/trigger-docker-push-subplat.sh",
     "trigger:smoke-tests": "_scripts/trigger-smoke-tests.sh",
-    "trigger:dot-release": "_scripts/trigger-dot-release.sh"
+    "trigger:dot-release": "_scripts/trigger-dot-release.sh",
+    "trigger:dot-release-subplat": "_scripts/trigger-dot-release-subplat.sh"
   },
   "homepage": "https://github.com/mozilla/fxa",
   "bugs": {