chore(gh-action): improve draft-release workflow (#1906)

.github/workflows/draft-release.yml

@@ -41,14 +41,29 @@ jobs:
           REPO_NAME="${GITHUB_REPOSITORY#*/}"
           TAG_NAME="${GITHUB_REF#refs/tags/}"
           TARGET_RELEASE_VERSION="${TAG_NAME#draft/}"
+          SRC_PACKAGE_NAME=${REPO_NAME}-source-${TARGET_RELEASE_VERSION}
+          SRC_PACKAGE_TAR=${SRC_PACKAGE_NAME}.tar
+          SRC_PACKAGE_TAR_GZ=${SRC_PACKAGE_NAME}.tar.gz
+          SRC_PACKAGE_ZIP=${SRC_PACKAGE_NAME}.zip
+          NPM_PACKAGE_NAME=${REPO_NAME}-npm-${TARGET_RELEASE_VERSION}
 
           echo "REPO_NAME=$REPO_NAME" >> $GITHUB_ENV
           echo "TAG_NAME=$TAG_NAME" >> $GITHUB_ENV
           echo "TARGET_RELEASE_VERSION=$TARGET_RELEASE_VERSION" >> $GITHUB_ENV
+          echo "SRC_PACKAGE_NAME=$SRC_PACKAGE_NAME" >> $GITHUB_ENV
+          echo "SRC_PACKAGE_TAR=$SRC_PACKAGE_TAR" >> $GITHUB_ENV
+          echo "SRC_PACKAGE_TAR_GZ=$SRC_PACKAGE_TAR_GZ" >> $GITHUB_ENV
+          echo "SRC_PACKAGE_ZIP=$SRC_PACKAGE_ZIP" >> $GITHUB_ENV
+          echo "NPM_PACKAGE_NAME=$NPM_PACKAGE_NAME" >> $GITHUB_ENV
 
           echo "REPO_NAME=$REPO_NAME"
           echo "TAG_NAME=$TAG_NAME"
           echo "TARGET_RELEASE_VERSION=$TARGET_RELEASE_VERSION"
+          echo "SRC_PACKAGE_NAME=$SRC_PACKAGE_NAME"
+          echo "SRC_PACKAGE_TAR=$SRC_PACKAGE_TAR"
+          echo "SRC_PACKAGE_TAR_GZ=$SRC_PACKAGE_TAR_GZ"
+          echo "SRC_PACKAGE_ZIP=$SRC_PACKAGE_ZIP"
+          echo "NPM_PACKAGE_NAME=$NPM_PACKAGE_NAME"
 
       - name: Verify Target Release Version
         run: |
@@ -70,21 +85,49 @@ jobs:
         run: |-
           npm install
           NPM_PKG_NAME=$(npm pack --json | jq -r '.[0].filename')
-          mv ./.asf-release/$NPM_PKG_NAME ./.asf-release/${REPO_NAME}-npm-${TARGET_RELEASE_VERSION}.tgz
+          mv ./.asf-release/$NPM_PKG_NAME ./.asf-release/${NPM_PACKAGE_NAME}.tgz
+        env:
+          TZ: UTC
+
+      - name: Generate "tar" source package
+        run: |-
+          export SRC_LAST_COMMIT_EPOCH=$(git log -1 --format=%ct "$TAG_NAME")
+
+          git archive \
+            --prefix=$SRC_PACKAGE_NAME/ \
+            --mtime=$SRC_LAST_COMMIT_EPOCH \
+            -o ./.asf-release/${SRC_PACKAGE_TAR} \
+            $TAG_NAME
+        env:
+          TZ: UTC
 
       - name: Generate "tar.gz" source archive
+        working-directory: ./.asf-release
         run: |-
-          git archive --format=tar.gz \
+          gzip -n -9 -c "$SRC_PACKAGE_TAR" > "$SRC_PACKAGE_TAR_GZ"
-            --prefix=${REPO_NAME}-source-${TARGET_RELEASE_VERSION}/ \
+        env:
-            -o ./.asf-release/${REPO_NAME}-source-${TARGET_RELEASE_VERSION}.tar.gz \
+          TZ: UTC
-            ${TAG_NAME}
 
       - name: Generate "zip" source archive
+        working-directory: ./.asf-release
         run: |-
-          git archive --format=zip \
+          export ASF_RELEASE_DIR=$(pwd)
-            --prefix=${REPO_NAME}-source-${TARGET_RELEASE_VERSION}/ \
+          export TMP_DIR=$(mktemp -d)
-            -o ./.asf-release/${REPO_NAME}-source-${TARGET_RELEASE_VERSION}.zip \
+
-            ${TAG_NAME}
+          tar -xf "$SRC_PACKAGE_TAR" -C "$TMP_DIR"
+          (
+            cd "$TMP_DIR"
+            find . -type f | LC_ALL=C sort | zip -X -q "$ASF_RELEASE_DIR/$SRC_PACKAGE_ZIP" -@
+          )
+          rm -rf $TMP_DIR
+        env:
+          TZ: UTC
+
+      - name: Cleanup Process
+        working-directory: ./.asf-release
+        run: |-
+          rm -rf $SRC_PACKAGE_TAR
+          rm -rf .gitkeep
 
       - name: Create Sign and Checksum
         working-directory: .asf-release
@@ -98,9 +141,6 @@ jobs:
         env:
           CORDOVA_GPG_SECRET_KEY: ${{ secrets.CORDOVA_GPG_SECRET_KEY }}
 
-      - name: Remove ".gitkeep" from ".asf-release"
-        run: rm -rf ./.asf-release/.gitkeep
-
       - name: Upload to Apache Trusted Release (ATR)
         uses: apache/tooling-actions/upload-to-atr@b7e972c11790ee16eca101900af1b3c7fd1b106e
         with: