Skip to content

ci: migrate release workflow to grafana/plugin-actions/build-plugin #205

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Sh4d1 merged 1 commit into from
Jul 20, 2026
Merged

ci: migrate release workflow to grafana/plugin-actions/build-plugin #205

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
126 changes: 9 additions & 117 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,124 +8,16 @@
jobs:
release:
runs-on: ubuntu-latest
env:
GRAFANA_API_KEY: ${{ secrets.GRAFANA_API_KEY }} # Requires a Grafana API key from Grafana.com.
permissions:
contents: write
id-token: write
attestations: write
steps:
- uses: actions/checkout@v6
- name: Setup Node.js environment
uses: actions/setup-node@v6
with:
node-version: '22'
cache: 'npm'

- name: Setup Go environment
uses: actions/setup-go@v3
with:
go-version: '1.25'

- name: Install dependencies
run: npm ci

- name: Build and test frontend
run: npm run build

- name: Check for backend
id: check-for-backend
run: |
if [ -f "Magefile.go" ]
then
echo "has-backend=true" >> $GITHUB_OUTPUT
fi

- name: Test backend
if: steps.check-for-backend.outputs.has-backend == 'true'
uses: magefile/mage-action@v2
with:
version: latest
args: coverage

- name: Build backend
if: steps.check-for-backend.outputs.has-backend == 'true'
uses: magefile/mage-action@v2
with:
version: latest
args: buildAll

- name: Warn missing Grafana API key
run: |
echo Please generate a Grafana API key: https://grafana.com/docs/grafana/latest/developers/plugins/sign-a-plugin/#generate-an-api-key
echo Once done please follow the instructions found here: https://github.com/${{github.repository}}/blob/main/README.md#using-github-actions-release-workflow
if: ${{ env.GRAFANA_API_KEY == '' }}

- name: Sign plugin
run: npm run sign
if: ${{ env.GRAFANA_API_KEY != '' }}

- name: Get plugin metadata
id: metadata
run: |
sudo apt-get install jq

export GRAFANA_PLUGIN_ID=$(cat dist/plugin.json | jq -r .id)
export GRAFANA_PLUGIN_VERSION=$(cat dist/plugin.json | jq -r .info.version)
export GRAFANA_PLUGIN_TYPE=$(cat dist/plugin.json | jq -r .type)
export GRAFANA_PLUGIN_ARTIFACT=${GRAFANA_PLUGIN_ID}-${GRAFANA_PLUGIN_VERSION}.zip
export GRAFANA_PLUGIN_ARTIFACT_CHECKSUM=${GRAFANA_PLUGIN_ARTIFACT}.md5

echo "plugin-id=${GRAFANA_PLUGIN_ID}" >> $GITHUB_OUTPUT
echo "plugin-version=${GRAFANA_PLUGIN_VERSION}" >> $GITHUB_OUTPUT
echo "plugin-type=${GRAFANA_PLUGIN_TYPE}" >> $GITHUB_OUTPUT
echo "archive=${GRAFANA_PLUGIN_ARTIFACT}" >> $GITHUB_OUTPUT
echo "archive-checksum=${GRAFANA_PLUGIN_ARTIFACT_CHECKSUM}" >> $GITHUB_OUTPUT

echo "github-tag=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT

- name: Read changelog
id: changelog
run: |
awk '/^## / {s++} s == 1 {print}' CHANGELOG.md > release_notes.md
echo "path=release_notes.md" >> $GITHUB_OUTPUT

- name: Check package version
run: if [ "v${{ steps.metadata.outputs.plugin-version }}" != "${{ steps.metadata.outputs.github-tag }}" ]; then printf "\033[0;31mPlugin version doesn't match tag name\033[0m\n"; exit 1; fi

- name: Package plugin
id: package-plugin
run: |
mv dist ${{ steps.metadata.outputs.plugin-id }}
zip ${{ steps.metadata.outputs.archive }} ${{ steps.metadata.outputs.plugin-id }} -r
md5sum ${{ steps.metadata.outputs.archive }} > ${{ steps.metadata.outputs.archive-checksum }}
echo "checksum=$(cat ./${{ steps.metadata.outputs.archive-checksum }} | cut -d' ' -f1)" >> $GITHUB_OUTPUT

# - name: Validate plugin
# run: |
# git clone https://github.com/grafana/plugin-validator
# pushd ./plugin-validator/pkg/cmd/plugincheck2
# go install
# popd
# plugincheck2 -config ./plugin-validator/config/default.yaml ${{ steps.metadata.outputs.archive }}

- name: Create Github release
uses: softprops/action-gh-release@v1
- uses: grafana/plugin-actions/build-plugin@build-plugin/v1.2.0

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow or composite action Medium

Unpinned 3rd party Action 'Release' step
Uses Step
Loading
uses 'grafana/plugin-actions/build-plugin' with ref 'build-plugin/v1.2.0', not a pinned commit hash
with:
draft: true
generate_release_notes: true
files: |
./${{ steps.metadata.outputs.archive }}
./${{ steps.metadata.outputs.archive-checksum }}
body: |
**This Github draft release has been created for your plugin.**

_Note: if this is the first release for your plugin please consult the [distributing-your-plugin section](https://github.com/${{github.repository}}/blob/main/README.md#distributing-your-plugin) of the README_

If you would like to submit this release to Grafana please consider the following steps:

- Check the Validate plugin step in the [release workflow](https://github.com/${{github.repository}}/commit/${{github.sha}}/checks/${{github.run_id}}) for any warnings that need attention
- Navigate to https://grafana.com/auth/sign-in/ to sign into your account
- Once logged in click **My Plugins** in the admin navigation
- Click the **Submit Plugin** button
- Fill in the Plugin Submission form:
- Paste this [.zip asset link](https://github.com/${{ github.repository }}/releases/download/v${{ steps.metadata.outputs.plugin-version }}/${{ steps.metadata.outputs.archive }}) in the Plugin URL field
- Paste this [.zip.md5 link](https://github.com/${{ github.repository }}/releases/download/v${{ steps.metadata.outputs.plugin-version }}/${{ steps.metadata.outputs.archive-checksum }}) in the MD5 field

Once done please remove these instructions and publish this release.
policy_token: ${{ secrets.GRAFANA_API_KEY }}

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Use the access policy token secret

The new build-plugin action treats policy_token as the Grafana Access Policy Token, and the migration notes for this commit say to create GRAFANA_ACCESS_POLICY_TOKEN; pointing it at the old GRAFANA_API_KEY secret means repositories that follow the migration will pass an empty token here, causing the action to skip signing and publish an unsigned release archive. Wire this input to the new access-policy-token secret instead.

Useful? React with 👍 / 👎.

attestation: true
node-version: '22'
go-version: '1.26'
Loading