[release]: OpenSearch-PHP 1-click

[harshavamsi]

What is the name of your component?

OpenSearch-PHP

What is the link to your GitHub repo?

https://github.com/opensearch-project/opensearch-php

Targeted release date

2/3/2023

Where should we publish this component?

https://packagist.org/

What type of artifact(s) will be generated for this component?

.tar.gz

Have you completed the required reviews including security reviews, UX reviews?

Yes

Have you on-boarded automated security scanning for the GitHub repo associated with this component?

Yes

Additional context

No response

[zelinh]

[Triages] Adding @gaiksaya here.

[gaiksaya]

Looks like we can use API to programmatically submit a new package https://packagist.org/apidoc#create-package
@harshavamsi @shyim Let me know if there is a better way using an available CLI or something.

Thanks!

[shyim]

We don't need new packages, but a Webhook in the repository would be nice so it updates automatically

https://packagist.org/about#how-to-update-packages

[Divyaasm]

Hi @shyim @harshavamsi , please confirm if https://packagist.org/about#how-to-update-packages is the recommended approach so that we can move forward with the next steps.

[shyim]

Yes that is the recommended way

[gaiksaya]

I believe we don't want to keep updating the package on every push right? Does it make sense to update the package when a tag is cut on GitHub?
Adding @harshavamsi @wbeckler to this.

[harshavamsi]

I believe we don't want to keep updating the package on every push right? Does it make sense to update the package when a tag is cut on GitHub? Adding @harshavamsi @wbeckler to this.

Yes, only when a tag is cut. Let's do that.

[gaiksaya]

Cool. In that case it is pretty straight foward process:
Please useManual hook setup https://packagist.org/about#how-to-update-packages as GitHub does NOT have the mechanism to push only tag webhook event. Also we want to add 2PR approval (example) in the workflow.
Can the maintainers look into adding that workflow to GitHub Actions.

Publish to Packagist:
1. Checkout repo
2. Add 2PR approval that will create an issue asking maintainers' approval. Example. Once approved, the workflow will auto-continue.
3. Get the API token similar to https://github.com/opensearch-project/opensearch-hadoop/blob/main/.github/workflows/publish_snapshot.yml#L91-L101
4. Run the update package API:

curl -XPOST -H'content-type:application/json' 'https://packagist.org/api/update-package?username=opensearch&apiToken=API_TOKEN' -d'{"repository":{"url":"https://packagist.org/packages/opensearch-project/opensearch-php"}}'

5. Once successful, create a release on GitHub.

[shyim]

This looks for me like an abuse of Github Actions (and I really hope they forbid this in future with their runners) 🙈. Really waste of resources to let the job run wait until everyone approves, also is pretty unstable what when nobody writes and the action timeouts

[gaiksaya]

I believe the window is 72 hours.

Note: This approval duration is subject to the broader 72 hours timeout for a workflow. So keep that in mind when figuring out how quickly an approver must respond.

https://github.com/trstringer/manual-approval

Why 2PR? Here is the issue for more details: #3111

[VachaShah]

Hi @gaiksaya, what would be the next steps for getting the automated release for php client?

[prudhvigodithi]

Hey @gaiksaya can you please add your thoughts on adding this to one-click release process?

[wbeckler]

@gaiksaya should have the permissions to finish setting this up as per #1108

[gaiksaya]

Sorry for the delayed response. Will look into it.

[gaiksaya]

OpenSearch-PHP has been onboarded to 1-click release now. There are further enhancement suggested by maintainers which can be followed up in different issue.
Thanks!