Update version_branch.yml
This commit is contained in:
384
.github/workflows/version_branch.yml
vendored
384
.github/workflows/version_branch.yml
vendored
@@ -132,160 +132,12 @@ jobs:
|
||||
|
||||
chmod 0755 "$CI_HELPERS"
|
||||
|
||||
- name: Validate inputs and policy locks
|
||||
$1
|
||||
|
||||
- name: Sanity check workflow and control characters
|
||||
run: |
|
||||
source "$CI_HELPERS"
|
||||
moko_init "Validate inputs and policy locks"
|
||||
|
||||
VERSION_TEXT="$(moko_trim "${VERSION_TEXT}")"
|
||||
|
||||
echo "[INFO] Inputs received:"
|
||||
echo " NEW_VERSION=${NEW_VERSION}"
|
||||
echo " VERSION_TEXT=${VERSION_TEXT}"
|
||||
echo " REPORT_ONLY=${REPORT_ONLY}"
|
||||
echo " COMMIT_CHANGES=${COMMIT_CHANGES}"
|
||||
echo " BASE_BRANCH=${BASE_BRANCH}"
|
||||
echo " BRANCH_PREFIX=${BRANCH_PREFIX}"
|
||||
|
||||
[[ -n "${NEW_VERSION}" ]] || { echo "[ERROR] new_version missing" >&2; exit 2; }
|
||||
[[ "${NEW_VERSION}" =~ ^[0-9]{2}[.][0-9]{2}[.][0-9]{2}$ ]] || { echo "[ERROR] Invalid version format: ${NEW_VERSION}" >&2; exit 2; }
|
||||
|
||||
if [[ "${BRANCH_PREFIX}" != "dev/" ]]; then
|
||||
echo "[FATAL] BRANCH_PREFIX is locked by policy. Expected 'dev/' but got '${BRANCH_PREFIX}'." >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
if ! moko_bool "${REPORT_ONLY}" && [[ "${COMMIT_CHANGES}" != "true" ]]; then
|
||||
echo "[FATAL] commit_changes must be 'true' when report_only is 'false' to ensure the branch is auditable." >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
if [[ -n "${VERSION_TEXT}" ]]; then
|
||||
if [[ ! "${VERSION_TEXT}" =~ ^[A-Za-z0-9._-]{1,32}$ ]]; then
|
||||
echo "[FATAL] version_text must match ^[A-Za-z0-9._-]{1,32}$ when set." >&2
|
||||
exit 2
|
||||
fi
|
||||
fi
|
||||
|
||||
git ls-remote --exit-code --heads origin "${BASE_BRANCH}" >/dev/null 2>&1 || {
|
||||
echo "[ERROR] Base branch does not exist on origin: ${BASE_BRANCH}" >&2
|
||||
echo "[INFO] Remote branches:" >&2
|
||||
git ls-remote --heads origin | awk '{sub("refs/heads/","",$2); print $2}' >&2
|
||||
exit 2
|
||||
}
|
||||
|
||||
echo "VERSION_TEXT=${VERSION_TEXT}" >> "$GITHUB_ENV"
|
||||
|
||||
- name: Enterprise policy gate
|
||||
run: |
|
||||
source "$CI_HELPERS"
|
||||
moko_init "Enterprise policy gate"
|
||||
|
||||
required=(
|
||||
"LICENSE.md"
|
||||
"CONTRIBUTING.md"
|
||||
"CODE_OF_CONDUCT.md"
|
||||
"SECURITY.md"
|
||||
"GOVERNANCE.md"
|
||||
"CHANGELOG.md"
|
||||
)
|
||||
|
||||
missing=0
|
||||
for f in "${required[@]}"; do
|
||||
if [[ ! -f "${f}" ]]; then
|
||||
echo "[ERROR] Missing required file: ${f}" >&2
|
||||
missing=1
|
||||
continue
|
||||
fi
|
||||
if [[ ! -s "${f}" ]]; then
|
||||
echo "[ERROR] Required file is empty: ${f}" >&2
|
||||
missing=1
|
||||
continue
|
||||
fi
|
||||
done
|
||||
|
||||
if [[ "${missing}" -ne 0 ]]; then
|
||||
echo "[FATAL] Policy gate failed. Add missing governance artifacts before versioning." >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
echo "[INFO] Policy gate passed"
|
||||
|
||||
- name: Branch namespace collision defense
|
||||
run: |
|
||||
source "$CI_HELPERS"
|
||||
moko_init "Branch namespace collision defense"
|
||||
|
||||
PREFIX_TOP="${BRANCH_PREFIX%%/*}"
|
||||
if git ls-remote --exit-code --heads origin "${PREFIX_TOP}" >/dev/null 2>&1; then
|
||||
echo "[FATAL] Branch namespace collision detected: '${PREFIX_TOP}' exists on origin." >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
- name: Configure git identity
|
||||
if: ${{ env.REPORT_ONLY != 'true' }}
|
||||
run: |
|
||||
source "$CI_HELPERS"
|
||||
moko_init "Configure git identity"
|
||||
|
||||
git config user.name "github-actions[bot]"
|
||||
git config user.email "github-actions[bot]@users.noreply.github.com"
|
||||
|
||||
- name: Create version branch (local)
|
||||
if: ${{ env.REPORT_ONLY != 'true' }}
|
||||
run: |
|
||||
source "$CI_HELPERS"
|
||||
moko_init "Create version branch (local)"
|
||||
|
||||
BRANCH_NAME="${BRANCH_PREFIX}${NEW_VERSION}"
|
||||
echo "[INFO] Creating local branch: ${BRANCH_NAME} from origin/${BASE_BRANCH}"
|
||||
|
||||
git fetch --all --tags --prune
|
||||
|
||||
if git ls-remote --exit-code --heads origin "${BRANCH_NAME}" >/dev/null 2>&1; then
|
||||
echo "[FATAL] Branch already exists on origin: ${BRANCH_NAME}" >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
git checkout -B "${BRANCH_NAME}" "origin/${BASE_BRANCH}"
|
||||
echo "BRANCH_NAME=${BRANCH_NAME}" >> "$GITHUB_ENV"
|
||||
|
||||
- name: Enforce release generated update feeds are absent (update.xml, updates.xml)
|
||||
if: ${{ env.REPORT_ONLY != 'true' }}
|
||||
run: |
|
||||
source "$CI_HELPERS"
|
||||
moko_init "Enforce update feed deletion"
|
||||
|
||||
git rm -f --ignore-unmatch update.xml updates.xml || true
|
||||
rm -f update.xml updates.xml || true
|
||||
|
||||
if [[ -f update.xml || -f updates.xml ]]; then
|
||||
echo "[FATAL] update feed files still present after deletion attempt." >&2
|
||||
ls -la update.xml updates.xml 2>/dev/null || true
|
||||
exit 2
|
||||
fi
|
||||
|
||||
- name: Preflight discovery (governed version markers outside .github)
|
||||
run: |
|
||||
source "$CI_HELPERS"
|
||||
moko_init "Preflight discovery"
|
||||
|
||||
COUNT=$(grep -RIn --exclude-dir=.git --exclude-dir=.github -i -E "VERSION[[:space:]]*:[[:space:]]*[0-9]{2}[.][0-9]{2}[.][0-9]{2}" . | wc -l || true)
|
||||
COUNT2=$(grep -RIn --exclude-dir=.git --exclude-dir=.github "<version" . | wc -l || true)
|
||||
|
||||
echo "[INFO] VERSION: hits (repo wide): ${COUNT}"
|
||||
echo "[INFO] <version> hits (repo wide): ${COUNT2}"
|
||||
|
||||
if [[ "${COUNT}" -eq 0 && "${COUNT2}" -eq 0 ]]; then
|
||||
echo "[FATAL] No governed version markers found outside .github" >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
- name: Bump versions and update manifest dates (targeted, excluding .github)
|
||||
run: |
|
||||
source "$CI_HELPERS"
|
||||
moko_init "Version bump"
|
||||
|
||||
moko_init "Sanity check"
|
||||
python3 - <<'PY'
|
||||
import json
|
||||
import os
|
||||
@@ -404,6 +256,234 @@ print("[INFO] Would update manifests:", len(would_update_manifests))
|
||||
print("[INFO] Updated files:", len(updated_files))
|
||||
print("[INFO] Updated manifests:", len(updated_manifests))
|
||||
PY
|
||||
$2
|
||||
run: |
|
||||
source "$CI_HELPERS"
|
||||
moko_init "Enterprise policy gate"
|
||||
|
||||
required=(
|
||||
"LICENSE.md"
|
||||
"CONTRIBUTING.md"
|
||||
"CODE_OF_CONDUCT.md"
|
||||
"SECURITY.md"
|
||||
"GOVERNANCE.md"
|
||||
"CHANGELOG.md"
|
||||
)
|
||||
|
||||
missing=0
|
||||
for f in "${required[@]}"; do
|
||||
if [[ ! -f "${f}" ]]; then
|
||||
echo "[ERROR] Missing required file: ${f}" >&2
|
||||
missing=1
|
||||
continue
|
||||
fi
|
||||
if [[ ! -s "${f}" ]]; then
|
||||
echo "[ERROR] Required file is empty: ${f}" >&2
|
||||
missing=1
|
||||
continue
|
||||
fi
|
||||
done
|
||||
|
||||
if [[ "${missing}" -ne 0 ]]; then
|
||||
echo "[FATAL] Policy gate failed. Add missing governance artifacts before versioning." >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
echo "[INFO] Policy gate passed"
|
||||
|
||||
- name: Branch namespace collision defense
|
||||
run: |
|
||||
source "$CI_HELPERS"
|
||||
moko_init "Branch namespace collision defense"
|
||||
|
||||
PREFIX_TOP="${BRANCH_PREFIX%%/*}"
|
||||
if git ls-remote --exit-code --heads origin "${PREFIX_TOP}" >/dev/null 2>&1; then
|
||||
echo "[FATAL] Branch namespace collision detected: '${PREFIX_TOP}' exists on origin." >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
- name: Configure git identity
|
||||
if: ${{ env.REPORT_ONLY != 'true' }}
|
||||
run: |
|
||||
source "$CI_HELPERS"
|
||||
moko_init "Configure git identity"
|
||||
|
||||
git config user.name "github-actions[bot]"
|
||||
git config user.email "github-actions[bot]@users.noreply.github.com"
|
||||
|
||||
- name: Create version branch (local)
|
||||
if: ${{ env.REPORT_ONLY != 'true' }}
|
||||
run: |
|
||||
source "$CI_HELPERS"
|
||||
moko_init "Create version branch (local)"
|
||||
|
||||
BRANCH_NAME="${BRANCH_PREFIX}${NEW_VERSION}"
|
||||
echo "[INFO] Creating local branch: ${BRANCH_NAME} from origin/${BASE_BRANCH}"
|
||||
|
||||
git fetch --all --tags --prune
|
||||
|
||||
if git ls-remote --exit-code --heads origin "${BRANCH_NAME}" >/dev/null 2>&1; then
|
||||
echo "[FATAL] Branch already exists on origin: ${BRANCH_NAME}" >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
git checkout -B "${BRANCH_NAME}" "origin/${BASE_BRANCH}"
|
||||
echo "BRANCH_NAME=${BRANCH_NAME}" >> "$GITHUB_ENV"
|
||||
|
||||
- name: Enforce release generated update feeds are absent (update.xml, updates.xml)
|
||||
if: ${{ env.REPORT_ONLY != 'true' }}
|
||||
run: |
|
||||
source "$CI_HELPERS"
|
||||
moko_init "Enforce update feed deletion"
|
||||
|
||||
git rm -f --ignore-unmatch update.xml updates.xml || true
|
||||
rm -f update.xml updates.xml || true
|
||||
|
||||
if [[ -f update.xml || -f updates.xml ]]; then
|
||||
echo "[FATAL] update feed files still present after deletion attempt." >&2
|
||||
ls -la update.xml updates.xml 2>/dev/null || true
|
||||
exit 2
|
||||
fi
|
||||
|
||||
- name: Preflight discovery (governed version markers outside .github)
|
||||
run: |
|
||||
source "$CI_HELPERS"
|
||||
moko_init "Preflight discovery"
|
||||
|
||||
COUNT=$(grep -RIn --exclude-dir=.git --exclude-dir=.github -i -E "VERSION[[:space:]]*:[[:space:]]*[0-9]{2}[.][0-9]{2}[.][0-9]{2}" . | wc -l || true)
|
||||
COUNT2=$(grep -RIn --exclude-dir=.git --exclude-dir=.github "<version" . | wc -l || true)
|
||||
|
||||
echo "[INFO] VERSION: hits (repo wide): ${COUNT}"
|
||||
echo "[INFO] <version> hits (repo wide): ${COUNT2}"
|
||||
|
||||
if [[ "${COUNT}" -eq 0 && "${COUNT2}" -eq 0 ]]; then
|
||||
echo "[FATAL] No governed version markers found outside .github" >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
- name: Bump versions and update manifest dates (targeted, excluding .github)
|
||||
run: |
|
||||
source "$CI_HELPERS"
|
||||
moko_init "Version bump"
|
||||
|
||||
python3 - <<'PY'
|
||||
import json
|
||||
import os
|
||||
import re
|
||||
from pathlib import Path
|
||||
from collections import defaultdict
|
||||
from datetime import datetime, timezone
|
||||
|
||||
new_version = (os.environ.get("NEW_VERSION") or "").strip()
|
||||
version_text = (os.environ.get("VERSION_TEXT") or "").strip()
|
||||
report_only = (os.environ.get("REPORT_ONLY") or "").strip().lower() == "true"
|
||||
report_path = (os.environ.get("REPORT_PATH") or "").strip() or None
|
||||
|
||||
stamp = datetime.now(timezone.utc).strftime("%Y-%m-%d")
|
||||
root = Path(".").resolve()
|
||||
|
||||
# No literal tab characters. Use escape sequences.
|
||||
header_re = re.compile(r"(?im)(VERSION[ ]*:[ ]*)([0-9]{2}[.][0-9]{2}[.][0-9]{2})")
|
||||
manifest_marker_re = re.compile(r"(?is)<extension")
|
||||
xml_version_re = re.compile(r"(?is)(<version[ ]*>)([^<]*?)(</version[ ]*>)")
|
||||
xml_date_res = [
|
||||
re.compile(r"(?is)(<creationDate[ ]*>)([^<]*?)(</creationDate[ ]*>)"),
|
||||
re.compile(r"(?is)(<date[ ]*>)([^<]*?)(</date[ ]*>)"),
|
||||
re.compile(r"(?is)(<releaseDate[ ]*>)([^<]*?)(</releaseDate[ ]*>)"),
|
||||
]
|
||||
|
||||
skip_ext = {
|
||||
".json", ".png", ".jpg", ".jpeg", ".gif", ".svg", ".ico", ".pdf",
|
||||
".zip", ".7z", ".tar", ".gz", ".woff", ".woff2", ".ttf", ".otf",
|
||||
".mp3", ".mp4",
|
||||
}
|
||||
skip_dirs = {".git", ".github", "node_modules", "vendor", ".venv", "dist", "build"}
|
||||
|
||||
counters = defaultdict(int)
|
||||
updated_files = []
|
||||
updated_manifests = []
|
||||
would_update_files = []
|
||||
would_update_manifests = []
|
||||
|
||||
def should_skip(p: Path) -> bool:
|
||||
if p.suffix.lower() in skip_ext:
|
||||
counters["skipped_by_ext"] += 1
|
||||
return True
|
||||
parts = {x.lower() for x in p.parts}
|
||||
if any(d in parts for d in skip_dirs):
|
||||
counters["skipped_by_dir"] += 1
|
||||
return True
|
||||
return False
|
||||
|
||||
for p in root.rglob("*"):
|
||||
if not p.is_file():
|
||||
continue
|
||||
if should_skip(p):
|
||||
continue
|
||||
|
||||
if p.parent == root and p.name.lower() in {"update.xml", "updates.xml"}:
|
||||
counters["skipped_release_artifacts"] += 1
|
||||
continue
|
||||
|
||||
try:
|
||||
original = p.read_text(encoding="utf-8", errors="replace")
|
||||
except Exception:
|
||||
counters["skipped_read_error"] += 1
|
||||
continue
|
||||
|
||||
text = original
|
||||
|
||||
text, n1 = header_re.subn(lambda m: m.group(1) + new_version, text)
|
||||
if n1:
|
||||
counters["header_replacements"] += n1
|
||||
|
||||
is_manifest = (p.suffix.lower() == ".xml" and manifest_marker_re.search(original) is not None)
|
||||
if is_manifest:
|
||||
text, n2 = xml_version_re.subn(lambda m: m.group(1) + new_version + m.group(3), text)
|
||||
if n2:
|
||||
counters["xml_version_replacements"] += n2
|
||||
|
||||
for rx in xml_date_res:
|
||||
text, n3 = rx.subn(lambda m: m.group(1) + stamp + m.group(3), text)
|
||||
if n3:
|
||||
counters["xml_date_replacements"] += n3
|
||||
|
||||
if text != original:
|
||||
would_update_files.append(str(p))
|
||||
if is_manifest:
|
||||
would_update_manifests.append(str(p))
|
||||
|
||||
if not report_only:
|
||||
p.write_text(text, encoding="utf-8")
|
||||
updated_files.append(str(p))
|
||||
if is_manifest:
|
||||
updated_manifests.append(str(p))
|
||||
|
||||
report = {
|
||||
"mode": "report_only" if report_only else "apply",
|
||||
"new_version": new_version,
|
||||
"version_text": version_text,
|
||||
"stamp_utc": stamp,
|
||||
"counters": dict(counters),
|
||||
"updated_files": updated_files,
|
||||
"updated_manifests": updated_manifests,
|
||||
"would_update_files": would_update_files,
|
||||
"would_update_manifests": would_update_manifests,
|
||||
}
|
||||
|
||||
payload = json.dumps(report, indent=2)
|
||||
|
||||
if report_path:
|
||||
Path(report_path).write_text(payload, encoding="utf-8")
|
||||
else:
|
||||
print(payload)
|
||||
|
||||
print("[INFO] Mode:", report["mode"])
|
||||
print("[INFO] Would update files:", len(would_update_files))
|
||||
print("[INFO] Would update manifests:", len(would_update_manifests))
|
||||
print("[INFO] Updated files:", len(updated_files))
|
||||
print("[INFO] Updated manifests:", len(updated_manifests))
|
||||
PY
|
||||
|
||||
- name: Commit changes
|
||||
if: ${{ env.REPORT_ONLY != 'true' }}
|
||||
|
||||
Reference in New Issue
Block a user