From 7f6ee44bfbff30da9503cdf72b47d28fdac5a90a Mon Sep 17 00:00:00 2001 From: Jonathan Miller <230051081+jmiller-moko@users.noreply.github.com> Date: Tue, 23 Dec 2025 16:06:32 -0600 Subject: [PATCH] Update version_branch.yml --- .github/workflows/version_branch.yml | 384 ++++++++++++++++----------- 1 file changed, 232 insertions(+), 152 deletions(-) diff --git a/.github/workflows/version_branch.yml b/.github/workflows/version_branch.yml index ab5481f..d3c5a98 100644 --- a/.github/workflows/version_branch.yml +++ b/.github/workflows/version_branch.yml @@ -132,160 +132,12 @@ jobs: chmod 0755 "$CI_HELPERS" - - name: Validate inputs and policy locks + $1 + + - name: Sanity check workflow and control characters run: | source "$CI_HELPERS" - moko_init "Validate inputs and policy locks" - - VERSION_TEXT="$(moko_trim "${VERSION_TEXT}")" - - echo "[INFO] Inputs received:" - echo " NEW_VERSION=${NEW_VERSION}" - echo " VERSION_TEXT=${VERSION_TEXT}" - echo " REPORT_ONLY=${REPORT_ONLY}" - echo " COMMIT_CHANGES=${COMMIT_CHANGES}" - echo " BASE_BRANCH=${BASE_BRANCH}" - echo " BRANCH_PREFIX=${BRANCH_PREFIX}" - - [[ -n "${NEW_VERSION}" ]] || { echo "[ERROR] new_version missing" >&2; exit 2; } - [[ "${NEW_VERSION}" =~ ^[0-9]{2}[.][0-9]{2}[.][0-9]{2}$ ]] || { echo "[ERROR] Invalid version format: ${NEW_VERSION}" >&2; exit 2; } - - if [[ "${BRANCH_PREFIX}" != "dev/" ]]; then - echo "[FATAL] BRANCH_PREFIX is locked by policy. Expected 'dev/' but got '${BRANCH_PREFIX}'." >&2 - exit 2 - fi - - if ! moko_bool "${REPORT_ONLY}" && [[ "${COMMIT_CHANGES}" != "true" ]]; then - echo "[FATAL] commit_changes must be 'true' when report_only is 'false' to ensure the branch is auditable." >&2 - exit 2 - fi - - if [[ -n "${VERSION_TEXT}" ]]; then - if [[ ! "${VERSION_TEXT}" =~ ^[A-Za-z0-9._-]{1,32}$ ]]; then - echo "[FATAL] version_text must match ^[A-Za-z0-9._-]{1,32}$ when set." >&2 - exit 2 - fi - fi - - git ls-remote --exit-code --heads origin "${BASE_BRANCH}" >/dev/null 2>&1 || { - echo "[ERROR] Base branch does not exist on origin: ${BASE_BRANCH}" >&2 - echo "[INFO] Remote branches:" >&2 - git ls-remote --heads origin | awk '{sub("refs/heads/","",$2); print $2}' >&2 - exit 2 - } - - echo "VERSION_TEXT=${VERSION_TEXT}" >> "$GITHUB_ENV" - - - name: Enterprise policy gate - run: | - source "$CI_HELPERS" - moko_init "Enterprise policy gate" - - required=( - "LICENSE.md" - "CONTRIBUTING.md" - "CODE_OF_CONDUCT.md" - "SECURITY.md" - "GOVERNANCE.md" - "CHANGELOG.md" - ) - - missing=0 - for f in "${required[@]}"; do - if [[ ! -f "${f}" ]]; then - echo "[ERROR] Missing required file: ${f}" >&2 - missing=1 - continue - fi - if [[ ! -s "${f}" ]]; then - echo "[ERROR] Required file is empty: ${f}" >&2 - missing=1 - continue - fi - done - - if [[ "${missing}" -ne 0 ]]; then - echo "[FATAL] Policy gate failed. Add missing governance artifacts before versioning." >&2 - exit 2 - fi - - echo "[INFO] Policy gate passed" - - - name: Branch namespace collision defense - run: | - source "$CI_HELPERS" - moko_init "Branch namespace collision defense" - - PREFIX_TOP="${BRANCH_PREFIX%%/*}" - if git ls-remote --exit-code --heads origin "${PREFIX_TOP}" >/dev/null 2>&1; then - echo "[FATAL] Branch namespace collision detected: '${PREFIX_TOP}' exists on origin." >&2 - exit 2 - fi - - - name: Configure git identity - if: ${{ env.REPORT_ONLY != 'true' }} - run: | - source "$CI_HELPERS" - moko_init "Configure git identity" - - git config user.name "github-actions[bot]" - git config user.email "github-actions[bot]@users.noreply.github.com" - - - name: Create version branch (local) - if: ${{ env.REPORT_ONLY != 'true' }} - run: | - source "$CI_HELPERS" - moko_init "Create version branch (local)" - - BRANCH_NAME="${BRANCH_PREFIX}${NEW_VERSION}" - echo "[INFO] Creating local branch: ${BRANCH_NAME} from origin/${BASE_BRANCH}" - - git fetch --all --tags --prune - - if git ls-remote --exit-code --heads origin "${BRANCH_NAME}" >/dev/null 2>&1; then - echo "[FATAL] Branch already exists on origin: ${BRANCH_NAME}" >&2 - exit 2 - fi - - git checkout -B "${BRANCH_NAME}" "origin/${BASE_BRANCH}" - echo "BRANCH_NAME=${BRANCH_NAME}" >> "$GITHUB_ENV" - - - name: Enforce release generated update feeds are absent (update.xml, updates.xml) - if: ${{ env.REPORT_ONLY != 'true' }} - run: | - source "$CI_HELPERS" - moko_init "Enforce update feed deletion" - - git rm -f --ignore-unmatch update.xml updates.xml || true - rm -f update.xml updates.xml || true - - if [[ -f update.xml || -f updates.xml ]]; then - echo "[FATAL] update feed files still present after deletion attempt." >&2 - ls -la update.xml updates.xml 2>/dev/null || true - exit 2 - fi - - - name: Preflight discovery (governed version markers outside .github) - run: | - source "$CI_HELPERS" - moko_init "Preflight discovery" - - COUNT=$(grep -RIn --exclude-dir=.git --exclude-dir=.github -i -E "VERSION[[:space:]]*:[[:space:]]*[0-9]{2}[.][0-9]{2}[.][0-9]{2}" . | wc -l || true) - COUNT2=$(grep -RIn --exclude-dir=.git --exclude-dir=.github " hits (repo wide): ${COUNT2}" - - if [[ "${COUNT}" -eq 0 && "${COUNT2}" -eq 0 ]]; then - echo "[FATAL] No governed version markers found outside .github" >&2 - exit 2 - fi - - - name: Bump versions and update manifest dates (targeted, excluding .github) - run: | - source "$CI_HELPERS" - moko_init "Version bump" - + moko_init "Sanity check" python3 - <<'PY' import json import os @@ -404,6 +256,234 @@ print("[INFO] Would update manifests:", len(would_update_manifests)) print("[INFO] Updated files:", len(updated_files)) print("[INFO] Updated manifests:", len(updated_manifests)) PY +$2 + run: | + source "$CI_HELPERS" + moko_init "Enterprise policy gate" + + required=( + "LICENSE.md" + "CONTRIBUTING.md" + "CODE_OF_CONDUCT.md" + "SECURITY.md" + "GOVERNANCE.md" + "CHANGELOG.md" + ) + + missing=0 + for f in "${required[@]}"; do + if [[ ! -f "${f}" ]]; then + echo "[ERROR] Missing required file: ${f}" >&2 + missing=1 + continue + fi + if [[ ! -s "${f}" ]]; then + echo "[ERROR] Required file is empty: ${f}" >&2 + missing=1 + continue + fi + done + + if [[ "${missing}" -ne 0 ]]; then + echo "[FATAL] Policy gate failed. Add missing governance artifacts before versioning." >&2 + exit 2 + fi + + echo "[INFO] Policy gate passed" + + - name: Branch namespace collision defense + run: | + source "$CI_HELPERS" + moko_init "Branch namespace collision defense" + + PREFIX_TOP="${BRANCH_PREFIX%%/*}" + if git ls-remote --exit-code --heads origin "${PREFIX_TOP}" >/dev/null 2>&1; then + echo "[FATAL] Branch namespace collision detected: '${PREFIX_TOP}' exists on origin." >&2 + exit 2 + fi + + - name: Configure git identity + if: ${{ env.REPORT_ONLY != 'true' }} + run: | + source "$CI_HELPERS" + moko_init "Configure git identity" + + git config user.name "github-actions[bot]" + git config user.email "github-actions[bot]@users.noreply.github.com" + + - name: Create version branch (local) + if: ${{ env.REPORT_ONLY != 'true' }} + run: | + source "$CI_HELPERS" + moko_init "Create version branch (local)" + + BRANCH_NAME="${BRANCH_PREFIX}${NEW_VERSION}" + echo "[INFO] Creating local branch: ${BRANCH_NAME} from origin/${BASE_BRANCH}" + + git fetch --all --tags --prune + + if git ls-remote --exit-code --heads origin "${BRANCH_NAME}" >/dev/null 2>&1; then + echo "[FATAL] Branch already exists on origin: ${BRANCH_NAME}" >&2 + exit 2 + fi + + git checkout -B "${BRANCH_NAME}" "origin/${BASE_BRANCH}" + echo "BRANCH_NAME=${BRANCH_NAME}" >> "$GITHUB_ENV" + + - name: Enforce release generated update feeds are absent (update.xml, updates.xml) + if: ${{ env.REPORT_ONLY != 'true' }} + run: | + source "$CI_HELPERS" + moko_init "Enforce update feed deletion" + + git rm -f --ignore-unmatch update.xml updates.xml || true + rm -f update.xml updates.xml || true + + if [[ -f update.xml || -f updates.xml ]]; then + echo "[FATAL] update feed files still present after deletion attempt." >&2 + ls -la update.xml updates.xml 2>/dev/null || true + exit 2 + fi + + - name: Preflight discovery (governed version markers outside .github) + run: | + source "$CI_HELPERS" + moko_init "Preflight discovery" + + COUNT=$(grep -RIn --exclude-dir=.git --exclude-dir=.github -i -E "VERSION[[:space:]]*:[[:space:]]*[0-9]{2}[.][0-9]{2}[.][0-9]{2}" . | wc -l || true) + COUNT2=$(grep -RIn --exclude-dir=.git --exclude-dir=.github " hits (repo wide): ${COUNT2}" + + if [[ "${COUNT}" -eq 0 && "${COUNT2}" -eq 0 ]]; then + echo "[FATAL] No governed version markers found outside .github" >&2 + exit 2 + fi + + - name: Bump versions and update manifest dates (targeted, excluding .github) + run: | + source "$CI_HELPERS" + moko_init "Version bump" + + python3 - <<'PY' + import json + import os + import re + from pathlib import Path + from collections import defaultdict + from datetime import datetime, timezone + + new_version = (os.environ.get("NEW_VERSION") or "").strip() + version_text = (os.environ.get("VERSION_TEXT") or "").strip() + report_only = (os.environ.get("REPORT_ONLY") or "").strip().lower() == "true" + report_path = (os.environ.get("REPORT_PATH") or "").strip() or None + + stamp = datetime.now(timezone.utc).strftime("%Y-%m-%d") + root = Path(".").resolve() + + # No literal tab characters. Use escape sequences. + header_re = re.compile(r"(?im)(VERSION[ ]*:[ ]*)([0-9]{2}[.][0-9]{2}[.][0-9]{2})") + manifest_marker_re = re.compile(r"(?is))([^<]*?)()") + xml_date_res = [ + re.compile(r"(?is)()([^<]*?)()"), + re.compile(r"(?is)()([^<]*?)()"), + re.compile(r"(?is)()([^<]*?)()"), + ] + + skip_ext = { + ".json", ".png", ".jpg", ".jpeg", ".gif", ".svg", ".ico", ".pdf", + ".zip", ".7z", ".tar", ".gz", ".woff", ".woff2", ".ttf", ".otf", + ".mp3", ".mp4", + } + skip_dirs = {".git", ".github", "node_modules", "vendor", ".venv", "dist", "build"} + + counters = defaultdict(int) + updated_files = [] + updated_manifests = [] + would_update_files = [] + would_update_manifests = [] + + def should_skip(p: Path) -> bool: + if p.suffix.lower() in skip_ext: + counters["skipped_by_ext"] += 1 + return True + parts = {x.lower() for x in p.parts} + if any(d in parts for d in skip_dirs): + counters["skipped_by_dir"] += 1 + return True + return False + + for p in root.rglob("*"): + if not p.is_file(): + continue + if should_skip(p): + continue + + if p.parent == root and p.name.lower() in {"update.xml", "updates.xml"}: + counters["skipped_release_artifacts"] += 1 + continue + + try: + original = p.read_text(encoding="utf-8", errors="replace") + except Exception: + counters["skipped_read_error"] += 1 + continue + + text = original + + text, n1 = header_re.subn(lambda m: m.group(1) + new_version, text) + if n1: + counters["header_replacements"] += n1 + + is_manifest = (p.suffix.lower() == ".xml" and manifest_marker_re.search(original) is not None) + if is_manifest: + text, n2 = xml_version_re.subn(lambda m: m.group(1) + new_version + m.group(3), text) + if n2: + counters["xml_version_replacements"] += n2 + + for rx in xml_date_res: + text, n3 = rx.subn(lambda m: m.group(1) + stamp + m.group(3), text) + if n3: + counters["xml_date_replacements"] += n3 + + if text != original: + would_update_files.append(str(p)) + if is_manifest: + would_update_manifests.append(str(p)) + + if not report_only: + p.write_text(text, encoding="utf-8") + updated_files.append(str(p)) + if is_manifest: + updated_manifests.append(str(p)) + + report = { + "mode": "report_only" if report_only else "apply", + "new_version": new_version, + "version_text": version_text, + "stamp_utc": stamp, + "counters": dict(counters), + "updated_files": updated_files, + "updated_manifests": updated_manifests, + "would_update_files": would_update_files, + "would_update_manifests": would_update_manifests, + } + + payload = json.dumps(report, indent=2) + + if report_path: + Path(report_path).write_text(payload, encoding="utf-8") + else: + print(payload) + + print("[INFO] Mode:", report["mode"]) + print("[INFO] Would update files:", len(would_update_files)) + print("[INFO] Would update manifests:", len(would_update_manifests)) + print("[INFO] Updated files:", len(updated_files)) + print("[INFO] Updated manifests:", len(updated_manifests)) + PY - name: Commit changes if: ${{ env.REPORT_ONLY != 'true' }}