chore: use stable tag to manage releases and ensure one-click-setup c… (#6540)

2025-12-30 02:10:12 -06:00 · 2025-09-12 19:03:13 +02:00
parent 47c3df0466
commit a93fa8ec76
7 changed files with 144 additions and 33 deletions
--- a/.github/workflows/formbricks-release.yml
+++ b/.github/workflows/formbricks-release.yml
@@ -45,4 +45,14 @@ jobs:
      VERSION: v${{ needs.docker-build.outputs.VERSION }}
      ENVIRONMENT: ${{ github.event.release.prerelease && 'staging' || 'production' }}

-
+  move-stable-tag:
+    name: Move stable tag to release
+    permissions:
+      contents: read
+    uses: ./.github/workflows/move-stable-tag.yml
+    needs:
+      - docker-build # Ensure release is successful first
+    with:
+      release_tag: ${{ github.event.release.tag_name }}
+      commit_sha: ${{ github.sha }}
+      is_prerelease: ${{ github.event.release.prerelease }}
--- a/.github/workflows/move-stable-tag.yml
+++ b/.github/workflows/move-stable-tag.yml
@@ -0,0 +1,96 @@
+name: Move Stable Tag
+
+on:
+  workflow_call:
+    inputs:
+      release_tag:
+        description: "The release tag name (e.g., v1.2.3)"
+        required: true
+        type: string
+      commit_sha:
+        description: "The commit SHA to point the stable tag to"
+        required: true
+        type: string
+      is_prerelease:
+        description: "Whether this is a prerelease (stable tag won't be moved for prereleases)"
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+# Prevent concurrent stable tag operations to avoid race conditions
+concurrency:
+  group: move-stable-tag-${{ github.repository }}
+  cancel-in-progress: true
+
+jobs:
+  move-stable-tag:
+    name: Move stable tag to release
+    runs-on: ubuntu-latest
+    timeout-minutes: 10 # Prevent hung git operations
+    permissions:
+      contents: write # Required to push tags
+    # Only move stable tag for non-prerelease versions
+    if: ${{ !inputs.is_prerelease }}
+    steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0 # Full history needed for tag operations
+
+      - name: Validate inputs
+        env:
+          RELEASE_TAG: ${{ inputs.release_tag }}
+          COMMIT_SHA: ${{ inputs.commit_sha }}
+        run: |
+          set -euo pipefail
+
+          # Validate release tag format
+          if [[ ! "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$ ]]; then
+            echo "❌ Error: Invalid release tag format. Expected format: v1.2.3, v1.2.3-alpha"
+            echo "Provided: $RELEASE_TAG"
+            exit 1
+          fi
+
+          # Validate commit SHA format (40 character hex)
+          if [[ ! "$COMMIT_SHA" =~ ^[a-f0-9]{40}$ ]]; then
+            echo "❌ Error: Invalid commit SHA format. Expected 40 character hex string"
+            echo "Provided: $COMMIT_SHA"
+            exit 1
+          fi
+
+          echo "✅ Input validation passed"
+          echo "Release tag: $RELEASE_TAG"
+          echo "Commit SHA: $COMMIT_SHA"
+
+      - name: Move stable tag
+        env:
+          RELEASE_TAG: ${{ inputs.release_tag }}
+          COMMIT_SHA: ${{ inputs.commit_sha }}
+        run: |
+          set -euo pipefail
+
+          # Configure git
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          # Verify the commit exists
+          if ! git cat-file -e "$COMMIT_SHA"; then
+            echo "❌ Error: Commit $COMMIT_SHA does not exist in this repository"
+            exit 1
+          fi
+
+          # Move stable tag to the release commit
+          echo "📌 Moving stable tag to commit: $COMMIT_SHA (release: $RELEASE_TAG)"
+          git tag -f stable "$COMMIT_SHA"
+          git push origin stable --force
+
+          echo "✅ Successfully moved stable tag to release $RELEASE_TAG"
+          echo "🔗 Stable tag now points to: https://github.com/${{ github.repository }}/commit/$COMMIT_SHA"
--- a/docker/README.md
+++ b/docker/README.md
@@ -15,7 +15,7 @@ Before you proceed, make sure you have the following:
 Copy and paste the following command into your terminal:

 ```bash
-/bin/sh -c "$(curl -fsSL https://raw.githubusercontent.com/formbricks/formbricks/main/docker/formbricks.sh)"
+/bin/sh -c "$(curl -fsSL https://raw.githubusercontent.com/formbricks/formbricks/stable/docker/formbricks.sh)"
 ```

 The script will prompt you for the following information:
--- a/docker/formbricks.sh
+++ b/docker/formbricks.sh
@@ -306,7 +306,7 @@ EOT
  fi

  echo "📥 Downloading docker-compose.yml from Formbricks GitHub repository..."
-  curl -fsSL -o docker-compose.yml https://raw.githubusercontent.com/formbricks/formbricks/main/docker/docker-compose.yml
+  curl -fsSL -o docker-compose.yml https://raw.githubusercontent.com/formbricks/formbricks/stable/docker/docker-compose.yml

  echo "🚙 Updating docker-compose.yml with your custom inputs..."
  sed -i "/WEBAPP_URL:/s|WEBAPP_URL:.*|WEBAPP_URL: \"https://$domain_name\"|" docker-compose.yml
--- a/docs/self-hosting/setup/cluster-setup.mdx
+++ b/docs/self-hosting/setup/cluster-setup.mdx
@@ -120,7 +120,9 @@ graph TD

 ## Redis Configuration

-<Note>Redis is required for Formbricks to function. The application will not start without a Redis URL configured.</Note>
+<Note>
+  Redis is required for Formbricks to function. The application will not start without a Redis URL configured.
+</Note>

 Configure Redis by adding the following **required** environment variable to your instances:

--- a/docs/self-hosting/setup/docker.mdx
+++ b/docs/self-hosting/setup/docker.mdx
@@ -11,7 +11,8 @@ The image is pre-built and requires minimal setup—just download it and start t
 Make sure Docker and Docker Compose are installed on your system. These are usually included in tools like Docker Desktop and Rancher Desktop.

 <Note>
-  `docker compose` without the hyphen is now the primary method of using docker-compose, according to the Docker documentation.
+  `docker compose` without the hyphen is now the primary method of using docker-compose, according to the
+  Docker documentation.
 </Note>

 ## Start
@@ -29,7 +30,7 @@ Make sure Docker and Docker Compose are installed on your system. These are usua
   Get the docker-compose file from the Formbricks repository by running:

   ```bash
-   curl -o docker-compose.yml https://raw.githubusercontent.com/formbricks/formbricks/main/docker/docker-compose.yml
+   curl -o docker-compose.yml https://raw.githubusercontent.com/formbricks/formbricks/stable/docker/docker-compose.yml
   ```

 1. **Generate NextAuth Secret**
@@ -64,21 +65,21 @@ Make sure Docker and Docker Compose are installed on your system. These are usua
   sed -i '' "s/ENCRYPTION_KEY:.*/ENCRYPTION_KEY: $(openssl rand -hex 32)/" docker-compose.yml
   ```

-1. **Generate Cron Secret**	
+1. **Generate Cron Secret**

-   You require a Cron secret to secure API access for running cron jobs. Run one of the commands below based on your operating system:	
+   You require a Cron secret to secure API access for running cron jobs. Run one of the commands below based on your operating system:

-   For Linux:	
+   For Linux:

-   ```bash	
-   sed -i "/CRON_SECRET:$/s/CRON_SECRET:.*/CRON_SECRET: $(openssl rand -hex 32)/" docker-compose.yml	
-   ```	
+   ```bash
+   sed -i "/CRON_SECRET:$/s/CRON_SECRET:.*/CRON_SECRET: $(openssl rand -hex 32)/" docker-compose.yml
+   ```

-   For macOS:	
+   For macOS:

-   ```bash	
-   sed -i '' "s/CRON_SECRET:.*/CRON_SECRET: $(openssl rand -hex 32)/" docker-compose.yml	
-   ```	
+   ```bash
+   sed -i '' "s/CRON_SECRET:.*/CRON_SECRET: $(openssl rand -hex 32)/" docker-compose.yml
+   ```

 1. **Start the Docker Setup**

--- a/docs/self-hosting/setup/one-click.mdx
+++ b/docs/self-hosting/setup/one-click.mdx
@@ -9,32 +9,34 @@ icon: "rocket"
 If you’re looking to quickly set up a production instance of Formbricks on an Ubuntu server, this guide is for you. Using a convenient shell script, you can install everything—including Docker, Postgres DB, and an SSL certificate—in just a few steps. The script takes care of all the dependencies and configuration for your server, making the process smooth and simple.

 <Note>
-  This setup uses **Traefik** as a **reverse proxy**, essential for directing incoming traffic to the correct container and enabling secure internet access to Formbricks. Traefik is chosen for its simplicity and automatic SSL management via Let’s Encrypt.
+  This setup uses **Traefik** as a **reverse proxy**, essential for directing incoming traffic to the correct
+  container and enabling secure internet access to Formbricks. Traefik is chosen for its simplicity and
+  automatic SSL management via Let’s Encrypt.
 </Note>

 For other operating systems or a more customized installation, please refer to the advanced installation guide with [Docker](/self-hosting/setup/docker).

 ### Requirements

-* An Ubuntu Virtual Machine with SSH access.
+- An Ubuntu Virtual Machine with SSH access.

-* A custom domain with an **A record** pointing to your server.
+- A custom domain with an **A record** pointing to your server.

-* Ports **80** and **443** are open in your VM's Security Group, allowing Traefik to create an SSL certificate.
+- Ports **80** and **443** are open in your VM's Security Group, allowing Traefik to create an SSL certificate.

 ### Deployment

 Run this command in your terminal:

 ```bash
-curl -fsSL https://raw.githubusercontent.com/formbricks/formbricks/main/docker/formbricks.sh -o formbricks.sh && chmod +x formbricks.sh && ./formbricks.sh install
+curl -fsSL https://raw.githubusercontent.com/formbricks/formbricks/stable/docker/formbricks.sh -o formbricks.sh && chmod +x formbricks.sh && ./formbricks.sh install
 ```

 ### Script Prompts

 During installation, the script will prompt you to provide some details:

-* **Overwriting Docker GPG Keys**:
+- **Overwriting Docker GPG Keys**:
  If Docker GPG keys already exist, the script will ask whether you want to overwrite them.

 ```
@@ -50,7 +52,7 @@ During installation, the script will prompt you to provide some details:
 File '/etc/apt/keyrings/docker.gpg' exists. Overwrite? (y/N)
 ```

-* **Domain Name**:
+- **Domain Name**:
  Enter the domain name where you’ll host Formbricks. The domain will be used to generate an SSL certificate. Do not include the protocol (http/https).

 ```
@@ -74,7 +76,7 @@ File '/etc/apt/keyrings/docker.gpg' exists. Overwrite? (y/N) y
 🔗 Please enter your domain name for the SSL certificate (🚨 do NOT enter the protocol (http/https/etc)):
 ```

-* **HTTPS Certificate Setup**:
+- **HTTPS Certificate Setup**:
  The script will ask if you’d like to create an HTTPS certificate for your domain. Enter `Y` to proceed (highly recommended for secure access).

 ```
@@ -100,7 +102,7 @@ my.hosted.url.com
 🔗 Do you want us to set up an HTTPS certificate for you? [Y/n]
 ```

-* **DNS Setup Prompt**: Ensure that your domain's DNS is correctly configured and ports 80 and 443 are open. Confirm this by entering `Y`. This step is crucial for proper SSL certificate issuance and secure server access.
+- **DNS Setup Prompt**: Ensure that your domain's DNS is correctly configured and ports 80 and 443 are open. Confirm this by entering `Y`. This step is crucial for proper SSL certificate issuance and secure server access.

 ```
 🚀 Executing default step of installing Formbricks
@@ -127,7 +129,7 @@ Y
 🔗 Please make sure that the domain points to the server's IP address and that ports 80 & 443 are open in your server's firewall. Is everything set up? [Y/n]
 ```

-* **Email Address for SSL Certificate**:
+- **Email Address for SSL Certificate**:
  Provide an email address to register the SSL certificate. Notifications regarding the certificate will be sent to this address.

 ```
@@ -157,7 +159,7 @@ Y
 💡 Please enter your email address for the SSL certificate:
 ```

-* **Enforce HTTPS with HSTS**:
+- **Enforce HTTPS with HSTS**:
  Enabling HTTP Strict Transport Security (HSTS) ensures all communication with your server is encrypted. It’s a recommended best practice. Enter `Y` to enforce HTTPS.

 ```
@@ -189,7 +191,7 @@ docs@formbricks.com
 🔗 Do you want to enforce HTTPS (HSTS)? [Y/n]
 ```

-* **Email Service Setup Prompt**: The script will ask if you want to set up the email service. Enter `Y` to proceed.(default is `N`). You can skip this step if you don't want to set up the email service. You will still be able to use Formbricks without setting up the email service.
+- **Email Service Setup Prompt**: The script will ask if you want to set up the email service. Enter `Y` to proceed.(default is `N`). You can skip this step if you don't want to set up the email service. You will still be able to use Formbricks without setting up the email service.

 ```
 🚀 Executing default step of installing Formbricks
@@ -267,7 +269,7 @@ Y
 🚙 Updating docker-compose.yml with your custom inputs...
 🚗 NEXTAUTH_SECRET updated successfully!
 🚗 ENCRYPTION_KEY updated successfully!
-🚗 CRON_SECRET updated successfully!	
+🚗 CRON_SECRET updated successfully!

 [+] Running 4/4
 ✔ Network formbricks_default         Created                                                                                                                                                    0.2s
@@ -332,13 +334,13 @@ If you encounter any issues, you can check the logs of the containers with:

 If you encounter any issues, consider the following steps:

-* **Inbound Rules**: Make sure you have added inbound rules for Port 80 and 443 in your VM's Security Group.
+- **Inbound Rules**: Make sure you have added inbound rules for Port 80 and 443 in your VM's Security Group.

-* **A Record**: Verify that you have set up an A record for your domain, pointing to your VM's IP address.
+- **A Record**: Verify that you have set up an A record for your domain, pointing to your VM's IP address.

-* **Check Docker Instances**: Run `docker ps` to check the status of the Docker instances.
+- **Check Docker Instances**: Run `docker ps` to check the status of the Docker instances.

-* **Check Formbricks Logs**: Run `cd formbricks && docker compose logs` to check the logs of the Formbricks stack.
+- **Check Formbricks Logs**: Run `cd formbricks && docker compose logs` to check the logs of the Formbricks stack.

 If you have any questions or require help, feel free to reach out to us on [**GitHub Discussions**](https://github.com/formbricks/formbricks/discussions). 😃[
 ](https://formbricks.com/docs/developer-docs/rest-api)