feat(release): host bridge script — cut+push a staging beta from a request
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>feat/v1-foundation
boban
parent
54b41591b9
commit
d4f973044b
|
|
@ -0,0 +1,113 @@
|
|||
#!/usr/bin/env bash
|
||||
# Host side of the dashboard release bridge. `serve-request` reads run/release-request.json (the
|
||||
# dashboard wrote it), cuts a beta — bump config version, commit, tag vX.Y.Z-betaN, push to Gitea —
|
||||
# and writes a result the dashboard polls. ALL git/token operations run here; the container never
|
||||
# holds credentials. `stage <target>` is the same path without the request file (used by the test).
|
||||
set -euo pipefail
|
||||
|
||||
SELF_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||
PROJ="${CLUSEV_DIR:-$(cd "${SELF_DIR}/../.." && pwd)}"
|
||||
RUN_DIR="${PROJ}/run"
|
||||
BRANCH="${CLUSEV_RELEASE_BRANCH:-feat/v1-foundation}"
|
||||
GITEA_ENV="${CLUSEV_GITEA_ENV:-/home/nexxo/.env.gitea}"
|
||||
|
||||
_json_str() {
|
||||
local s="$1"; s="${s//\\/\\\\}"; s="${s//\"/\\\"}"; s="${s//$'\r'/}"; s="${s//$'\t'/\\t}"; s="${s//$'\n'/\\n}"
|
||||
printf '"%s"' "$s"
|
||||
}
|
||||
|
||||
_write_result() { # id ok tag message
|
||||
local id="$1" ok="$2" tag="$3" msg="$4" f="${RUN_DIR}/release-result-$1.json"
|
||||
mkdir -p "$RUN_DIR" 2>/dev/null || true
|
||||
printf '{"id":"%s","ok":%s,"tag":%s,"message":%s,"at":%s}\n' \
|
||||
"$id" "$ok" "$(_json_str "$tag")" "$(_json_str "$msg")" "$(date +%s 2>/dev/null || echo 0)" > "${f}.tmp"
|
||||
mv -f "${f}.tmp" "$f" 2>/dev/null || { rm -f "${f}.tmp"; return 0; }
|
||||
chown "$(stat -c %u:%g "$RUN_DIR" 2>/dev/null || echo 0:0)" "$f" 2>/dev/null || true
|
||||
chmod 600 "$f" 2>/dev/null || true
|
||||
}
|
||||
|
||||
# numeric semver "$1 >= $2"
|
||||
_ver_ge() { [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$2" ]; }
|
||||
|
||||
_rollback() { # tag
|
||||
git -C "$PROJ" tag -d "$1" >/dev/null 2>&1 || true
|
||||
git -C "$PROJ" reset --hard "origin/${BRANCH}" >/dev/null 2>&1 || true
|
||||
}
|
||||
|
||||
# Preconditions. Echoes a one-word reason + returns non-zero on failure; silent + 0 on success.
|
||||
_precheck() {
|
||||
git -C "$PROJ" rev-parse --is-inside-work-tree >/dev/null 2>&1 || { echo "no-repo"; return 1; }
|
||||
[ "$(git -C "$PROJ" rev-parse --abbrev-ref HEAD)" = "$BRANCH" ] || { echo "wrong-branch"; return 1; }
|
||||
[ -z "$(git -C "$PROJ" status --porcelain)" ] || { echo "dirty-tree"; return 1; }
|
||||
git -C "$PROJ" fetch origin "$BRANCH" >/dev/null 2>&1 || { echo "fetch-failed"; return 1; }
|
||||
[ "$(git -C "$PROJ" rev-parse HEAD)" = "$(git -C "$PROJ" rev-parse "origin/${BRANCH}")" ] || { echo "unpushed"; return 1; }
|
||||
}
|
||||
|
||||
# Cut + push a beta of <target>. Echoes the new tag on success; reason on stderr + non-zero on failure.
|
||||
_do_stage() { # target
|
||||
local target="$1" cur base
|
||||
cur="$(grep -oE "'version' => '[^']*'" "${PROJ}/config/clusev.php" | head -n1 | sed -E "s/.*=> '//; s/'$//")"
|
||||
base="${cur%%-*}"
|
||||
_ver_ge "$target" "$base" || { echo "downgrade-rejected" >&2; return 1; }
|
||||
|
||||
local n=0 t k
|
||||
for t in $(git -C "$PROJ" tag -l "v${target}-beta*"); do
|
||||
k="${t##*-beta}"
|
||||
case "$k" in ''|*[!0-9]*) ;; *) [ "$k" -gt "$n" ] && n="$k" ;; esac
|
||||
done
|
||||
local ver="${target}-beta$((n + 1))" newtag="v${target}-beta$((n + 1))"
|
||||
|
||||
sed -i -E "s/('version' => ')[^']*(')/\\1${ver}\\2/" "${PROJ}/config/clusev.php"
|
||||
git -C "$PROJ" commit -q -am "chore(release): ${ver}" || { echo "commit-failed" >&2; git -C "$PROJ" checkout -- . 2>/dev/null || true; return 1; }
|
||||
git -C "$PROJ" tag "$newtag" || { echo "tag-failed" >&2; _rollback "$newtag"; return 1; }
|
||||
|
||||
local token origin host url
|
||||
# shellcheck source=/dev/null
|
||||
token="$( . "$GITEA_ENV" 2>/dev/null; printf '%s' "${GIT_ACCESS_TOKEN:-${GITEA_TOKEN:-}}" )"
|
||||
origin="$(git -C "$PROJ" remote get-url origin)"
|
||||
case "$origin" in
|
||||
https://*)
|
||||
[ -n "$token" ] || { echo "no-token" >&2; _rollback "$newtag"; return 1; }
|
||||
host="$(printf '%s' "$origin" | sed -E 's#^https://([^/]*@)?##')"
|
||||
url="https://oauth2:${token}@${host}" ;;
|
||||
*) url="$origin" ;; # local/file remote (tests): push directly
|
||||
esac
|
||||
|
||||
if ! git -C "$PROJ" push "$url" "$BRANCH" >/dev/null 2>&1 || ! git -C "$PROJ" push "$url" "$newtag" >/dev/null 2>&1; then
|
||||
echo "push-failed" >&2; _rollback "$newtag"; return 1
|
||||
fi
|
||||
printf '%s' "$newtag"
|
||||
}
|
||||
|
||||
cmd_serve_request() {
|
||||
local req="${RUN_DIR}/release-request.json" wf="${RUN_DIR}/release-request.processing"
|
||||
[ -f "$req" ] || return 0
|
||||
mv -f "$req" "$wf" 2>/dev/null || return 0
|
||||
local json id action target
|
||||
json="$(cat "$wf" 2>/dev/null || true)"; rm -f "$wf"
|
||||
id="$(printf '%s' "$json" | grep -oE '"id":"[A-Za-z0-9]{16,64}"' | head -n1 | sed -E 's/.*:"//; s/"$//' || true)"
|
||||
[ -n "$id" ] || return 0
|
||||
action="$(printf '%s' "$json" | grep -oE '"action":"[a-z-]{1,16}"' | head -n1 | sed -E 's/.*:"//; s/"$//' || true)"
|
||||
target="$(printf '%s' "$json" | grep -oE '"target":"[0-9]{1,4}\.[0-9]{1,4}\.[0-9]{1,4}"' | head -n1 | sed -E 's/.*:"//; s/"$//' || true)"
|
||||
|
||||
local ok=false tag='' msg='ok' reason errf
|
||||
errf="$(mktemp)"
|
||||
case "$action" in
|
||||
stage)
|
||||
if [ -z "$target" ]; then msg='invalid-target'
|
||||
elif ! reason="$(_precheck 2>&1)"; then msg="$reason"
|
||||
elif tag="$(_do_stage "$target" 2>"$errf")"; then ok=true; msg='ok'
|
||||
else msg="$(cat "$errf" 2>/dev/null || echo 'release-failed')"; tag='' ; fi ;;
|
||||
*) msg='unknown-action' ;;
|
||||
esac
|
||||
rm -f "$errf"
|
||||
_write_result "$id" "$ok" "$tag" "$msg"
|
||||
}
|
||||
|
||||
case "${1:-}" in
|
||||
serve-request) cmd_serve_request ;;
|
||||
stage)
|
||||
target="${2:?target required}"
|
||||
if reason="$(_precheck 2>&1)"; then _do_stage "$target"; else printf '%s\n' "$reason" >&2; exit 1; fi ;;
|
||||
*) echo "usage: $0 serve-request|stage <target>" >&2; exit 2 ;;
|
||||
esac
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
#!/usr/bin/env bash
|
||||
# Test clusev-release.sh `stage`: bump config version, commit, tag vX.Y.Z-betaN, push to a (local)
|
||||
# Gitea-stand-in remote; beta auto-increment; refusals (dirty / unpushed / downgrade); push-fail rollback.
|
||||
set -euo pipefail
|
||||
here="$(cd "$(dirname "$0")" && pwd)"
|
||||
work="$(mktemp -d)"; trap 'rm -rf "$work"' EXIT
|
||||
export GIT_AUTHOR_NAME=t GIT_AUTHOR_EMAIL=t@t GIT_COMMITTER_NAME=t GIT_COMMITTER_EMAIL=t@t
|
||||
|
||||
# bare "Gitea" remote + a working clone with a config/clusev.php on branch main
|
||||
git init -q --bare "$work/remote.git"
|
||||
git clone -q "$work/remote.git" "$work/proj"
|
||||
git -C "$work/proj" checkout -q -b main
|
||||
mkdir -p "$work/proj/config"
|
||||
printf "<?php\nreturn [\n 'version' => '0.9.58',\n];\n" > "$work/proj/config/clusev.php"
|
||||
git -C "$work/proj" add -A && git -C "$work/proj" commit -qm init && git -C "$work/proj" push -q -u origin main
|
||||
|
||||
printf 'GIT_ACCESS_TOKEN=dummy\n' > "$work/.env.gitea"
|
||||
run() { CLUSEV_DIR="$work/proj" CLUSEV_RELEASE_BRANCH=main CLUSEV_GITEA_ENV="$work/.env.gitea" bash "$here/clusev-release.sh" "$@"; }
|
||||
|
||||
# happy path: minor -> 0.10.0-beta1, config bumped, tag pushed to the remote
|
||||
tag="$(run stage 0.10.0)"
|
||||
test "$tag" = "v0.10.0-beta1" || { echo "FAIL: expected v0.10.0-beta1, got '$tag'"; exit 1; }
|
||||
grep -q "'version' => '0.10.0-beta1'" "$work/proj/config/clusev.php" || { echo "FAIL: config not bumped"; exit 1; }
|
||||
git -C "$work/remote.git" tag | grep -qx 'v0.10.0-beta1' || { echo "FAIL: tag not pushed to remote"; exit 1; }
|
||||
|
||||
# second run, same target -> beta2
|
||||
tag2="$(run stage 0.10.0)"
|
||||
test "$tag2" = "v0.10.0-beta2" || { echo "FAIL: expected beta2, got '$tag2'"; exit 1; }
|
||||
|
||||
# downgrade rejected (target below the current base 0.10.0)
|
||||
if run stage 0.9.0 2>/dev/null; then echo "FAIL: downgrade not rejected"; exit 1; fi
|
||||
|
||||
# dirty tree rejected
|
||||
echo dirt > "$work/proj/dirt.txt"
|
||||
if run stage 0.11.0 2>/dev/null; then echo "FAIL: dirty tree not rejected"; exit 1; fi
|
||||
rm -f "$work/proj/dirt.txt"
|
||||
|
||||
# unpushed commit rejected
|
||||
echo x >> "$work/proj/config/clusev.php"; git -C "$work/proj" commit -qam wip
|
||||
if run stage 0.11.0 2>/dev/null; then echo "FAIL: unpushed commit not rejected"; exit 1; fi
|
||||
git -C "$work/proj" reset -q --hard origin/main
|
||||
|
||||
# push-fail rollback: point origin at an unreachable https remote, attempt, assert rollback
|
||||
git -C "$work/proj" remote set-url origin https://127.0.0.1:1/x.git
|
||||
before="$(git -C "$work/proj" rev-parse HEAD)"
|
||||
if run stage 0.11.0 2>/dev/null; then echo "FAIL: push to dead remote should fail"; exit 1; fi
|
||||
git -C "$work/proj" remote set-url origin "$work/remote.git"
|
||||
git -C "$work/proj" tag | grep -qx 'v0.11.0-beta1' && { echo "FAIL: tag not rolled back"; exit 1; }
|
||||
test "$(git -C "$work/proj" rev-parse HEAD)" = "$before" || { echo "FAIL: HEAD not rolled back"; exit 1; }
|
||||
|
||||
echo "PASS"
|
||||
Loading…
Reference in New Issue