Update version_branch.yml
This commit is contained in:
815
.github/workflows/version_branch.yml
vendored
815
.github/workflows/version_branch.yml
vendored
@@ -15,467 +15,468 @@
|
|||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
# GNU General Public License for more details.
|
# GNU General Public License for more details.
|
||||||
#
|
#
|
||||||
# You should have received a copy of the GNU General Public License
|
|
||||||
# along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
||||||
#
|
|
||||||
# FILE INFORMATION
|
# FILE INFORMATION
|
||||||
# DEFGROUP: GitHub.Workflow
|
# DEFGROUP: MokoStandards.Joomla
|
||||||
# INGROUP: MokoStandards.Release
|
# INGROUP: GitHub.Versioning.Branching
|
||||||
# REPO: https://github.com/mokoconsulting-tech/moko-cassiopeia
|
# REPO: https://github.com/mokoconsulting-tech/MokoStandards
|
||||||
# PATH: /.github/workflows/release_from_version.yml
|
# PATH: /.github/workflows/version_branch.yml
|
||||||
# VERSION: 01.00.00
|
# VERSION: 01.00.00
|
||||||
# BRIEF: Enterprise release pipeline for promoting dev branches, building Joomla artifacts, publishing prereleases, and optionally squashing to main.
|
# BRIEF: Create a dev/<version> branch and align versions across governed files
|
||||||
# NOTE: Designed for Joomla and Dolibarr projects following MokoStandards governance.
|
# NOTE: Enterprise gates: required artifacts, namespace defense, deterministic reporting, least-change commits
|
||||||
#
|
|
||||||
#
|
name: Create version branch and bump versions
|
||||||
name: Release from Version Branch Pipeline
|
|
||||||
|
|
||||||
on:
|
on:
|
||||||
workflow_dispatch:
|
workflow_dispatch:
|
||||||
inputs:
|
inputs:
|
||||||
promote_to_version:
|
new_version:
|
||||||
description: "Promote dev/<version> to version/<version>"
|
description: "New version in format NN.NN.NN (example 03.01.00)"
|
||||||
required: true
|
required: true
|
||||||
default: true
|
type: string
|
||||||
type: boolean
|
version_text:
|
||||||
delete_dev_branch:
|
description: "Optional version label text (example: LTS, RC1, hotfix)"
|
||||||
description: "Delete dev/<version> after promotion"
|
required: false
|
||||||
required: true
|
default: ""
|
||||||
default: true
|
type: string
|
||||||
type: boolean
|
report_only:
|
||||||
squash_to_main:
|
description: "Report only mode (no branch creation, no file writes, report output only)"
|
||||||
description: "Squash merge version/<version> into main"
|
required: false
|
||||||
required: true
|
default: "false"
|
||||||
default: false
|
type: choice
|
||||||
type: boolean
|
options:
|
||||||
delete_version_branch:
|
- "true"
|
||||||
description: "Delete version/<version> after squash merge to main"
|
- "false"
|
||||||
required: true
|
commit_changes:
|
||||||
default: false
|
description: "Commit and push changes (forced to true when report_only=false)"
|
||||||
type: boolean
|
required: false
|
||||||
|
default: "true"
|
||||||
|
type: choice
|
||||||
|
options:
|
||||||
|
- "true"
|
||||||
|
- "false"
|
||||||
|
|
||||||
concurrency:
|
concurrency:
|
||||||
group: release-from-dev-${{ github.ref_name }}
|
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.inputs.new_version }}
|
||||||
cancel-in-progress: false
|
cancel-in-progress: false
|
||||||
|
|
||||||
permissions:
|
permissions:
|
||||||
contents: read
|
contents: write
|
||||||
|
|
||||||
|
defaults:
|
||||||
|
run:
|
||||||
|
shell: bash
|
||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
guard:
|
version-bump:
|
||||||
name: 00 Guard and derive release metadata
|
name: Version branch and bump
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
|
|
||||||
outputs:
|
env:
|
||||||
version: ${{ steps.extract.outputs.version }}
|
NEW_VERSION: ${{ github.event.inputs.new_version }}
|
||||||
dev_branch: ${{ steps.extract.outputs.dev_branch }}
|
VERSION_TEXT: ${{ github.event.inputs.version_text }}
|
||||||
version_branch: ${{ steps.extract.outputs.version_branch }}
|
REPORT_ONLY: ${{ github.event.inputs.report_only }}
|
||||||
today_utc: ${{ steps.extract.outputs.today_utc }}
|
COMMIT_CHANGES: ${{ github.event.inputs.commit_changes }}
|
||||||
|
BASE_BRANCH: ${{ github.ref_name }}
|
||||||
|
BRANCH_PREFIX: dev/
|
||||||
|
ERROR_LOG: /tmp/version_branch_errors.log
|
||||||
|
CI_HELPERS: /tmp/moko_ci_helpers.sh
|
||||||
|
REPORT_PATH: ${{ runner.temp }}/version-bump-report.json
|
||||||
|
|
||||||
steps:
|
steps:
|
||||||
- name: Validate calling branch and extract version
|
- name: Checkout repository
|
||||||
id: extract
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
BRANCH="${GITHUB_REF_NAME}"
|
|
||||||
echo "Invoked from branch: $BRANCH"
|
|
||||||
echo "${BRANCH}" | grep -E '^(dev|version)/[0-9]+\.[0-9]+\.[0-9]+$'
|
|
||||||
|
|
||||||
VERSION="${BRANCH#dev/}"
|
|
||||||
VERSION="${VERSION#version/}"
|
|
||||||
DEV_BRANCH="dev/${VERSION}"
|
|
||||||
VERSION_BRANCH="version/${VERSION}"
|
|
||||||
|
|
||||||
# If invoked from an existing version/<version> branch, treat it as already promoted
|
|
||||||
if echo "${BRANCH}" | grep -qE '^version/'; then
|
|
||||||
VERSION_BRANCH="${BRANCH}"
|
|
||||||
fi
|
|
||||||
TODAY_UTC="$(date -u +%Y-%m-%d)"
|
|
||||||
|
|
||||||
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
|
|
||||||
echo "dev_branch=$DEV_BRANCH" >> "$GITHUB_OUTPUT"
|
|
||||||
echo "version_branch=$VERSION_BRANCH" >> "$GITHUB_OUTPUT"
|
|
||||||
echo "today_utc=$TODAY_UTC" >> "$GITHUB_OUTPUT"
|
|
||||||
|
|
||||||
promote_branch:
|
|
||||||
if: ${{ github.event.inputs.promote_to_version == 'true' && startsWith(github.ref_name, 'dev/') }}
|
|
||||||
name: 01 Promote dev to version branch
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
needs: guard
|
|
||||||
|
|
||||||
permissions:
|
|
||||||
contents: write
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- name: Checkout dev branch
|
|
||||||
uses: actions/checkout@v4
|
uses: actions/checkout@v4
|
||||||
with:
|
with:
|
||||||
ref: ${{ needs.guard.outputs.dev_branch }}
|
|
||||||
fetch-depth: 0
|
fetch-depth: 0
|
||||||
|
ref: ${{ github.ref_name }}
|
||||||
|
|
||||||
- name: Configure Git identity
|
- name: Init CI helpers
|
||||||
run: |
|
run: |
|
||||||
set -euo pipefail
|
set -Eeuo pipefail
|
||||||
git config user.name "github-actions[bot]"
|
: > "$ERROR_LOG"
|
||||||
git config user.email "github-actions[bot]@users.noreply.github.com"
|
|
||||||
git config --global --add safe.directory "$GITHUB_WORKSPACE"
|
|
||||||
|
|
||||||
- name: Enforce branch promotion preconditions
|
cat > "$CI_HELPERS" <<'SH'
|
||||||
|
set -Eeuo pipefail
|
||||||
|
|
||||||
|
moko_init() {
|
||||||
|
local step_name="${1:-step}"
|
||||||
|
export PS4='+ ['"${step_name}"':${BASH_SOURCE##*/}:${LINENO}] '
|
||||||
|
set -x
|
||||||
|
trap "moko_on_err '${step_name}' \"\$LINENO\" \"\$BASH_COMMAND\"" ERR
|
||||||
|
}
|
||||||
|
|
||||||
|
moko_on_err() {
|
||||||
|
local step_name="$1"
|
||||||
|
local line_no="$2"
|
||||||
|
local last_cmd="$3"
|
||||||
|
|
||||||
|
echo "[FATAL] ${step_name} failed at line ${line_no}" >&2
|
||||||
|
echo "[FATAL] Last command: ${last_cmd}" >&2
|
||||||
|
|
||||||
|
if [[ -n "${ERROR_LOG:-}" ]]; then
|
||||||
|
echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) | ${step_name} | line ${line_no} | ${last_cmd}" >> "$ERROR_LOG" || true
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
moko_bool() {
|
||||||
|
local v="${1:-false}"
|
||||||
|
[[ "${v}" == "true" ]]
|
||||||
|
}
|
||||||
|
|
||||||
|
moko_trim() {
|
||||||
|
local s="${1:-}"
|
||||||
|
s="${s#${s%%[![:space:]]*}}"
|
||||||
|
s="${s%${s##*[![:space:]]}}"
|
||||||
|
printf '%s' "$s"
|
||||||
|
}
|
||||||
|
SH
|
||||||
|
|
||||||
|
chmod 0755 "$CI_HELPERS"
|
||||||
|
|
||||||
|
- name: Validate inputs and policy locks
|
||||||
run: |
|
run: |
|
||||||
set -euo pipefail
|
source "$CI_HELPERS"
|
||||||
|
moko_init "Validate inputs and policy locks"
|
||||||
|
|
||||||
SRC="${{ needs.guard.outputs.dev_branch }}"
|
VERSION_TEXT="$(moko_trim "${VERSION_TEXT}")"
|
||||||
DST="${{ needs.guard.outputs.version_branch }}"
|
|
||||||
|
|
||||||
git fetch origin --prune
|
echo "[INFO] Inputs received:"
|
||||||
|
echo " NEW_VERSION=${NEW_VERSION}"
|
||||||
|
echo " VERSION_TEXT=${VERSION_TEXT}"
|
||||||
|
echo " REPORT_ONLY=${REPORT_ONLY}"
|
||||||
|
echo " COMMIT_CHANGES=${COMMIT_CHANGES}"
|
||||||
|
echo " BASE_BRANCH=${BASE_BRANCH}"
|
||||||
|
echo " BRANCH_PREFIX=${BRANCH_PREFIX}"
|
||||||
|
|
||||||
if ! git show-ref --verify --quiet "refs/remotes/origin/$SRC"; then
|
[[ -n "${NEW_VERSION}" ]] || { echo "[ERROR] new_version missing" >&2; exit 2; }
|
||||||
echo "ERROR: origin/$SRC not found."
|
[[ "${NEW_VERSION}" =~ ^[0-9]{2}[.][0-9]{2}[.][0-9]{2}$ ]] || { echo "[ERROR] Invalid version format: ${NEW_VERSION}" >&2; exit 2; }
|
||||||
exit 1
|
|
||||||
|
if [[ "${BRANCH_PREFIX}" != "dev/" ]]; then
|
||||||
|
echo "[FATAL] BRANCH_PREFIX is locked by policy. Expected 'dev/' but got '${BRANCH_PREFIX}'." >&2
|
||||||
|
exit 2
|
||||||
fi
|
fi
|
||||||
|
|
||||||
if git show-ref --verify --quiet "refs/remotes/origin/$DST"; then
|
if ! moko_bool "${REPORT_ONLY}" && [[ "${COMMIT_CHANGES}" != "true" ]]; then
|
||||||
echo "ERROR: origin/$DST already exists."
|
echo "[FATAL] commit_changes must be 'true' when report_only is 'false' to ensure the branch is auditable." >&2
|
||||||
exit 1
|
exit 2
|
||||||
fi
|
fi
|
||||||
|
|
||||||
- name: Promote dev branch to version branch
|
if [[ -n "${VERSION_TEXT}" ]]; then
|
||||||
run: |
|
if [[ ! "${VERSION_TEXT}" =~ ^[A-Za-z0-9._-]{1,32}$ ]]; then
|
||||||
set -euo pipefail
|
echo "[FATAL] version_text must match ^[A-Za-z0-9._-]{1,32}$ when set." >&2
|
||||||
|
exit 2
|
||||||
SRC="${{ needs.guard.outputs.dev_branch }}"
|
|
||||||
DST="${{ needs.guard.outputs.version_branch }}"
|
|
||||||
|
|
||||||
git checkout -B "$DST" "origin/$SRC"
|
|
||||||
git push origin "$DST"
|
|
||||||
|
|
||||||
if [ "${{ github.event.inputs.delete_dev_branch }}" = "true" ]; then
|
|
||||||
git push origin --delete "${SRC}"
|
|
||||||
else
|
|
||||||
echo "Dev branch retention enabled. Skipping deletion of ${SRC}."
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "Promotion complete: $SRC -> $DST"
|
|
||||||
|
|
||||||
normalize_dates:
|
|
||||||
name: 02 Normalize dates on version branch
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
needs:
|
|
||||||
- guard
|
|
||||||
- promote_branch
|
|
||||||
|
|
||||||
permissions:
|
|
||||||
contents: write
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- name: Checkout version branch
|
|
||||||
uses: actions/checkout@v4
|
|
||||||
with:
|
|
||||||
ref: ${{ needs.guard.outputs.version_branch }}
|
|
||||||
fetch-depth: 0
|
|
||||||
|
|
||||||
- name: Configure Git identity
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
git config user.name "github-actions[bot]"
|
|
||||||
git config user.email "github-actions[bot]@users.noreply.github.com"
|
|
||||||
git config --global --add safe.directory "$GITHUB_WORKSPACE"
|
|
||||||
|
|
||||||
- name: Validate repository release prerequisites
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
test -d src || (echo "ERROR: src directory missing." && exit 1)
|
|
||||||
test -f CHANGELOG.md || (echo "ERROR: CHANGELOG.md missing." && exit 1)
|
|
||||||
|
|
||||||
VERSION="${{ needs.guard.outputs.version }}"
|
|
||||||
if ! grep -qE "^## \\[$VERSION\\] " CHANGELOG.md; then
|
|
||||||
echo "ERROR: CHANGELOG.md does not contain a heading for version [$VERSION]."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
- name: Update dates using repo script when available, otherwise apply baseline updates
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
TODAY="${{ needs.guard.outputs.today_utc }}"
|
|
||||||
VERSION="${{ needs.guard.outputs.version }}"
|
|
||||||
|
|
||||||
echo "Release version: $VERSION"
|
|
||||||
echo "Release date (UTC): $TODAY"
|
|
||||||
|
|
||||||
if [ -f scripts/update_dates.sh ]; then
|
|
||||||
chmod +x scripts/update_dates.sh
|
|
||||||
scripts/update_dates.sh "$TODAY" "$VERSION"
|
|
||||||
else
|
|
||||||
echo "scripts/update_dates.sh not found. Applying baseline date normalization."
|
|
||||||
|
|
||||||
find . -type f -name "*.xml" \
|
|
||||||
-not -path "./.git/*" \
|
|
||||||
-print0 | while IFS= read -r -d '' f; do
|
|
||||||
sed -i "s#<creationDate>[^<]*</creationDate>#<creationDate>${TODAY}</creationDate>#g" "$f" || true
|
|
||||||
sed -i "s#<date>[^<]*</date>#<date>${TODAY}</date>#g" "$f" || true
|
|
||||||
sed -i "s#<buildDate>[^<]*</buildDate>#<buildDate>${TODAY}</buildDate>#g" "$f" || true
|
|
||||||
done
|
|
||||||
|
|
||||||
sed -i -E "s#^(## \\[${VERSION}\\]) [0-9]{4}-[0-9]{2}-[0-9]{2}#\\1 ${TODAY}#g" CHANGELOG.md || true
|
|
||||||
fi
|
|
||||||
|
|
||||||
- name: Commit and push date updates
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
if git diff --quiet; then
|
|
||||||
echo "No date changes detected. No commit required."
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
git add -A
|
|
||||||
git commit -m "chore(release): normalize dates for ${{ needs.guard.outputs.version }}"
|
|
||||||
git push origin "HEAD:${{ needs.guard.outputs.version_branch }}"
|
|
||||||
|
|
||||||
build_update_and_release:
|
|
||||||
name: 03 Build Joomla ZIP, update update.xml, prerelease
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
needs:
|
|
||||||
- guard
|
|
||||||
- normalize_dates
|
|
||||||
|
|
||||||
permissions:
|
|
||||||
contents: write
|
|
||||||
id-token: write
|
|
||||||
|
|
||||||
environment:
|
|
||||||
name: release
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- name: Checkout version branch
|
|
||||||
uses: actions/checkout@v4
|
|
||||||
with:
|
|
||||||
ref: ${{ needs.guard.outputs.version_branch }}
|
|
||||||
fetch-depth: 0
|
|
||||||
|
|
||||||
- name: Configure Git identity
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
git config user.name "github-actions[bot]"
|
|
||||||
git config user.email "github-actions[bot]@users.noreply.github.com"
|
|
||||||
git config --global --add safe.directory "$GITHUB_WORKSPACE"
|
|
||||||
|
|
||||||
- name: Build Joomla compliant ZIP from src
|
|
||||||
id: build
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
VERSION="${{ needs.guard.outputs.version }}"
|
|
||||||
REPO="${{ github.event.repository.name }}"
|
|
||||||
ZIP="${REPO}-${VERSION}.zip"
|
|
||||||
|
|
||||||
test -d src || (echo "ERROR: src directory missing." && exit 1)
|
|
||||||
|
|
||||||
mkdir -p dist
|
|
||||||
|
|
||||||
# Joomla compliant packaging: src contents at ZIP root (no nested src folder)
|
|
||||||
cd src
|
|
||||||
zip -r "../dist/$ZIP" .
|
|
||||||
cd ..
|
|
||||||
|
|
||||||
echo "zip_name=$ZIP" >> "$GITHUB_OUTPUT"
|
|
||||||
ls -la dist
|
|
||||||
|
|
||||||
- name: Compute SHA256 for ZIP
|
|
||||||
id: sha
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
ZIP="${{ steps.build.outputs.zip_name }}"
|
|
||||||
SHA="$(sha256sum "dist/$ZIP" | awk '{print $1}')"
|
|
||||||
echo "sha256=$SHA" >> "$GITHUB_OUTPUT"
|
|
||||||
printf "%s %s\n" "$SHA" "$ZIP" > dist/SHA256SUMS.txt
|
|
||||||
cat dist/SHA256SUMS.txt
|
|
||||||
|
|
||||||
- name: Update update.xml with download URL and sha256
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
VERSION="${{ needs.guard.outputs.version }}"
|
|
||||||
TODAY="${{ needs.guard.outputs.today_utc }}"
|
|
||||||
ZIP="${{ steps.build.outputs.zip_name }}"
|
|
||||||
SHA="${{ steps.sha.outputs.sha256 }}"
|
|
||||||
|
|
||||||
OWNER="${{ github.repository_owner }}"
|
|
||||||
REPO="${{ github.event.repository.name }}"
|
|
||||||
|
|
||||||
DOWNLOAD_URL="https://github.com/${OWNER}/${REPO}/releases/download/${VERSION}/${ZIP}"
|
|
||||||
|
|
||||||
echo "Version: $VERSION"
|
|
||||||
echo "Download URL: $DOWNLOAD_URL"
|
|
||||||
echo "SHA256: $SHA"
|
|
||||||
|
|
||||||
# If a template exists, instantiate it
|
|
||||||
# Preferred canonical template location: docs/templates/
|
|
||||||
if [ -f "docs/templates/template_update.xml" ]; then
|
|
||||||
cp -f "docs/templates/template_update.xml" "updates.xml"
|
|
||||||
elif [ -f "docs/templates/update_template.xml" ]; then
|
|
||||||
cp -f "docs/templates/update_template.xml" "updates.xml"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ ! -f "updates.xml" ]; then
|
|
||||||
# Backward compatibility: allow repos that still keep updates.xml
|
|
||||||
if [ -f "update.xml" ]; then
|
|
||||||
mv -f "update.xml" "updates.xml"
|
|
||||||
else
|
|
||||||
echo "ERROR: updates.xml not found and no template present in docs/templates."
|
|
||||||
exit 1
|
|
||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Replace common placeholders if present
|
git ls-remote --exit-code --heads origin "${BASE_BRANCH}" >/dev/null 2>&1 || {
|
||||||
sed -i "s#{{VERSION}}#${VERSION}#g" updates.xml || true
|
echo "[ERROR] Base branch does not exist on origin: ${BASE_BRANCH}" >&2
|
||||||
sed -i "s#{{DATE}}#${TODAY}#g" updates.xml || true
|
echo "[INFO] Remote branches:" >&2
|
||||||
sed -i "s#{{DOWNLOADURL}}#${DOWNLOAD_URL}#g" updates.xml || true
|
git ls-remote --heads origin | awk '{sub("refs/heads/","",$2); print $2}' >&2
|
||||||
sed -i "s#{{SHA256}}#${SHA}#g" updates.xml || true
|
exit 2
|
||||||
sed -i "s#{{ZIP}}#${ZIP}#g" updates.xml || true
|
}
|
||||||
|
|
||||||
# Also enforce canonical tag replacement inside common XML elements
|
echo "VERSION_TEXT=${VERSION_TEXT}" >> "$GITHUB_ENV"
|
||||||
sed -i "s#<downloadurl>[^<]*</downloadurl>#<downloadurl>${DOWNLOAD_URL}</downloadurl>#g" updates.xml || true
|
|
||||||
sed -i "s#<sha256>[^<]*</sha256>#<sha256>${SHA}</sha256>#g" updates.xml || true
|
|
||||||
sed -i "s#<sha256sum>[^<]*</sha256sum>#<sha256sum>${SHA}</sha256sum>#g" updates.xml || true
|
|
||||||
sed -i "s#<version>[^<]*</version>#<version>${VERSION}</version>#g" updates.xml || true
|
|
||||||
sed -i "s#<date>[^<]*</date>#<date>${TODAY}</date>#g" updates.xml || true
|
|
||||||
|
|
||||||
echo "updates.xml updated."
|
- name: Enterprise policy gate
|
||||||
|
|
||||||
- name: Commit update.xml changes (and any related date deltas) to version branch
|
|
||||||
run: |
|
run: |
|
||||||
set -euo pipefail
|
source "$CI_HELPERS"
|
||||||
|
moko_init "Enterprise policy gate"
|
||||||
|
|
||||||
if git diff --quiet; then
|
required=(
|
||||||
echo "No updates.xml changes detected. No commit required."
|
"LICENSE.md"
|
||||||
|
"CONTRIBUTING.md"
|
||||||
|
"CODE_OF_CONDUCT.md"
|
||||||
|
"SECURITY.md"
|
||||||
|
"GOVERNANCE.md"
|
||||||
|
"CHANGELOG.md"
|
||||||
|
)
|
||||||
|
|
||||||
|
missing=0
|
||||||
|
for f in "${required[@]}"; do
|
||||||
|
if [[ ! -f "${f}" ]]; then
|
||||||
|
echo "[ERROR] Missing required file: ${f}" >&2
|
||||||
|
missing=1
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
if [[ ! -s "${f}" ]]; then
|
||||||
|
echo "[ERROR] Required file is empty: ${f}" >&2
|
||||||
|
missing=1
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
if [[ "${missing}" -ne 0 ]]; then
|
||||||
|
echo "[FATAL] Policy gate failed. Add missing governance artifacts before versioning." >&2
|
||||||
|
exit 2
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "[INFO] Policy gate passed"
|
||||||
|
|
||||||
|
- name: Branch namespace collision defense
|
||||||
|
run: |
|
||||||
|
source "$CI_HELPERS"
|
||||||
|
moko_init "Branch namespace collision defense"
|
||||||
|
|
||||||
|
PREFIX_TOP="${BRANCH_PREFIX%%/*}"
|
||||||
|
if git ls-remote --exit-code --heads origin "${PREFIX_TOP}" >/dev/null 2>&1; then
|
||||||
|
echo "[FATAL] Branch namespace collision detected: '${PREFIX_TOP}' exists on origin." >&2
|
||||||
|
exit 2
|
||||||
|
fi
|
||||||
|
|
||||||
|
- name: Configure git identity
|
||||||
|
if: ${{ env.REPORT_ONLY != 'true' }}
|
||||||
|
run: |
|
||||||
|
source "$CI_HELPERS"
|
||||||
|
moko_init "Configure git identity"
|
||||||
|
|
||||||
|
git config user.name "github-actions[bot]"
|
||||||
|
git config user.email "github-actions[bot]@users.noreply.github.com"
|
||||||
|
|
||||||
|
- name: Create version branch (local)
|
||||||
|
if: ${{ env.REPORT_ONLY != 'true' }}
|
||||||
|
run: |
|
||||||
|
source "$CI_HELPERS"
|
||||||
|
moko_init "Create version branch (local)"
|
||||||
|
|
||||||
|
BRANCH_NAME="${BRANCH_PREFIX}${NEW_VERSION}"
|
||||||
|
echo "[INFO] Creating local branch: ${BRANCH_NAME} from origin/${BASE_BRANCH}"
|
||||||
|
|
||||||
|
git fetch --all --tags --prune
|
||||||
|
|
||||||
|
if git ls-remote --exit-code --heads origin "${BRANCH_NAME}" >/dev/null 2>&1; then
|
||||||
|
echo "[FATAL] Branch already exists on origin: ${BRANCH_NAME}" >&2
|
||||||
|
exit 2
|
||||||
|
fi
|
||||||
|
|
||||||
|
git checkout -B "${BRANCH_NAME}" "origin/${BASE_BRANCH}"
|
||||||
|
echo "BRANCH_NAME=${BRANCH_NAME}" >> "$GITHUB_ENV"
|
||||||
|
|
||||||
|
- name: Enforce release generated update feeds are absent (update.xml, updates.xml)
|
||||||
|
if: ${{ env.REPORT_ONLY != 'true' }}
|
||||||
|
run: |
|
||||||
|
source "$CI_HELPERS"
|
||||||
|
moko_init "Enforce update feed deletion"
|
||||||
|
|
||||||
|
git rm -f --ignore-unmatch update.xml updates.xml || true
|
||||||
|
rm -f update.xml updates.xml || true
|
||||||
|
|
||||||
|
if [[ -f update.xml || -f updates.xml ]]; then
|
||||||
|
echo "[FATAL] update feed files still present after deletion attempt." >&2
|
||||||
|
ls -la update.xml updates.xml 2>/dev/null || true
|
||||||
|
exit 2
|
||||||
|
fi
|
||||||
|
|
||||||
|
- name: Preflight discovery (governed version markers outside .github)
|
||||||
|
run: |
|
||||||
|
source "$CI_HELPERS"
|
||||||
|
moko_init "Preflight discovery"
|
||||||
|
|
||||||
|
COUNT=$(grep -RIn --exclude-dir=.git --exclude-dir=.github -i -E "VERSION[[:space:]]*:[[:space:]]*[0-9]{2}[.][0-9]{2}[.][0-9]{2}" . | wc -l || true)
|
||||||
|
COUNT2=$(grep -RIn --exclude-dir=.git --exclude-dir=.github "<version" . | wc -l || true)
|
||||||
|
|
||||||
|
echo "[INFO] VERSION: hits (repo wide): ${COUNT}"
|
||||||
|
echo "[INFO] <version> hits (repo wide): ${COUNT2}"
|
||||||
|
|
||||||
|
if [[ "${COUNT}" -eq 0 && "${COUNT2}" -eq 0 ]]; then
|
||||||
|
echo "[FATAL] No governed version markers found outside .github" >&2
|
||||||
|
exit 2
|
||||||
|
fi
|
||||||
|
|
||||||
|
- name: Bump versions and update manifest dates (targeted, excluding .github)
|
||||||
|
run: |
|
||||||
|
source "$CI_HELPERS"
|
||||||
|
moko_init "Version bump"
|
||||||
|
|
||||||
|
python3 - <<'PY'
|
||||||
|
import json
|
||||||
|
import os
|
||||||
|
import re
|
||||||
|
from pathlib import Path
|
||||||
|
from collections import defaultdict
|
||||||
|
from datetime import datetime, timezone
|
||||||
|
|
||||||
|
new_version = (os.environ.get("NEW_VERSION") or "").strip()
|
||||||
|
version_text = (os.environ.get("VERSION_TEXT") or "").strip()
|
||||||
|
report_only = (os.environ.get("REPORT_ONLY") or "").strip().lower() == "true"
|
||||||
|
report_path = (os.environ.get("REPORT_PATH") or "").strip() or None
|
||||||
|
|
||||||
|
stamp = datetime.now(timezone.utc).strftime("%Y-%m-%d")
|
||||||
|
root = Path(".").resolve()
|
||||||
|
|
||||||
|
# No literal tab characters. Use explicit escape sequences.
|
||||||
|
header_re = re.compile(r"(?im)(VERSION[ \t]*:[ \t]*)([0-9]{2}[.][0-9]{2}[.][0-9]{2})")
|
||||||
|
manifest_marker_re = re.compile(r"(?is)<extension\b")
|
||||||
|
xml_version_re = re.compile(r"(?is)(<version[ \t]*>)([^<]*?)(</version[ \t]*>)")
|
||||||
|
xml_date_res = [
|
||||||
|
re.compile(r"(?is)(<creationDate[ \t]*>)([^<]*?)(</creationDate[ \t]*>)"),
|
||||||
|
re.compile(r"(?is)(<date[ \t]*>)([^<]*?)(</date[ \t]*>)"),
|
||||||
|
re.compile(r"(?is)(<releaseDate[ \t]*>)([^<]*?)(</releaseDate[ \t]*>)"),
|
||||||
|
]
|
||||||
|
|
||||||
|
skip_ext = {
|
||||||
|
".json", ".png", ".jpg", ".jpeg", ".gif", ".svg", ".ico", ".pdf",
|
||||||
|
".zip", ".7z", ".tar", ".gz", ".woff", ".woff2", ".ttf", ".otf",
|
||||||
|
".mp3", ".mp4",
|
||||||
|
}
|
||||||
|
skip_dirs = {".git", ".github", "node_modules", "vendor", ".venv", "dist", "build"}
|
||||||
|
|
||||||
|
counters = defaultdict(int)
|
||||||
|
updated_files = []
|
||||||
|
updated_manifests = []
|
||||||
|
would_update_files = []
|
||||||
|
would_update_manifests = []
|
||||||
|
|
||||||
|
def should_skip(p: Path) -> bool:
|
||||||
|
if p.suffix.lower() in skip_ext:
|
||||||
|
counters["skipped_by_ext"] += 1
|
||||||
|
return True
|
||||||
|
parts = {x.lower() for x in p.parts}
|
||||||
|
if any(d in parts for d in skip_dirs):
|
||||||
|
counters["skipped_by_dir"] += 1
|
||||||
|
return True
|
||||||
|
return False
|
||||||
|
|
||||||
|
for p in root.rglob("*"):
|
||||||
|
if not p.is_file():
|
||||||
|
continue
|
||||||
|
if should_skip(p):
|
||||||
|
continue
|
||||||
|
|
||||||
|
if p.parent == root and p.name.lower() in {"update.xml", "updates.xml"}:
|
||||||
|
counters["skipped_release_artifacts"] += 1
|
||||||
|
continue
|
||||||
|
|
||||||
|
try:
|
||||||
|
original = p.read_text(encoding="utf-8", errors="replace")
|
||||||
|
except Exception:
|
||||||
|
counters["skipped_read_error"] += 1
|
||||||
|
continue
|
||||||
|
|
||||||
|
text = original
|
||||||
|
|
||||||
|
text, n1 = header_re.subn(lambda m: m.group(1) + new_version, text)
|
||||||
|
if n1:
|
||||||
|
counters["header_replacements"] += n1
|
||||||
|
|
||||||
|
is_manifest = (p.suffix.lower() == ".xml" and manifest_marker_re.search(original) is not None)
|
||||||
|
if is_manifest:
|
||||||
|
text, n2 = xml_version_re.subn(lambda m: m.group(1) + new_version + m.group(3), text)
|
||||||
|
if n2:
|
||||||
|
counters["xml_version_replacements"] += n2
|
||||||
|
|
||||||
|
for rx in xml_date_res:
|
||||||
|
text, n3 = rx.subn(lambda m: m.group(1) + stamp + m.group(3), text)
|
||||||
|
if n3:
|
||||||
|
counters["xml_date_replacements"] += n3
|
||||||
|
|
||||||
|
if text != original:
|
||||||
|
would_update_files.append(str(p))
|
||||||
|
if is_manifest:
|
||||||
|
would_update_manifests.append(str(p))
|
||||||
|
|
||||||
|
if not report_only:
|
||||||
|
p.write_text(text, encoding="utf-8")
|
||||||
|
updated_files.append(str(p))
|
||||||
|
if is_manifest:
|
||||||
|
updated_manifests.append(str(p))
|
||||||
|
|
||||||
|
report = {
|
||||||
|
"mode": "report_only" if report_only else "apply",
|
||||||
|
"new_version": new_version,
|
||||||
|
"version_text": version_text,
|
||||||
|
"stamp_utc": stamp,
|
||||||
|
"counters": dict(counters),
|
||||||
|
"updated_files": updated_files,
|
||||||
|
"updated_manifests": updated_manifests,
|
||||||
|
"would_update_files": would_update_files,
|
||||||
|
"would_update_manifests": would_update_manifests,
|
||||||
|
}
|
||||||
|
|
||||||
|
payload = json.dumps(report, indent=2)
|
||||||
|
|
||||||
|
if report_path:
|
||||||
|
Path(report_path).write_text(payload, encoding="utf-8")
|
||||||
|
else:
|
||||||
|
print(payload)
|
||||||
|
|
||||||
|
print("[INFO] Mode:", report["mode"])
|
||||||
|
print("[INFO] Would update files:", len(would_update_files))
|
||||||
|
print("[INFO] Would update manifests:", len(would_update_manifests))
|
||||||
|
print("[INFO] Updated files:", len(updated_files))
|
||||||
|
print("[INFO] Updated manifests:", len(updated_manifests))
|
||||||
|
PY
|
||||||
|
|
||||||
|
- name: Commit changes
|
||||||
|
if: ${{ env.REPORT_ONLY != 'true' }}
|
||||||
|
run: |
|
||||||
|
source "$CI_HELPERS"
|
||||||
|
moko_init "Commit changes"
|
||||||
|
|
||||||
|
if [[ -z "$(git status --porcelain=v1)" ]]; then
|
||||||
|
echo "[INFO] No changes detected. Skipping commit."
|
||||||
exit 0
|
exit 0
|
||||||
fi
|
fi
|
||||||
|
|
||||||
git add -A
|
git add -A
|
||||||
git commit -m "chore(release): update updates.xml for ${{ needs.guard.outputs.version }}"
|
|
||||||
git push origin "HEAD:${{ needs.guard.outputs.version_branch }}"
|
|
||||||
|
|
||||||
- name: Create and push annotated tag after final release commit
|
MSG="chore(release): bump version to ${NEW_VERSION}"
|
||||||
run: |
|
if [[ -n "${VERSION_TEXT}" ]]; then
|
||||||
set -euo pipefail
|
MSG="${MSG} (${VERSION_TEXT})"
|
||||||
|
|
||||||
VERSION="${{ needs.guard.outputs.version }}"
|
|
||||||
|
|
||||||
git fetch --tags
|
|
||||||
|
|
||||||
if git rev-parse -q --verify "refs/tags/$VERSION" >/dev/null; then
|
|
||||||
echo "ERROR: Tag $VERSION already exists."
|
|
||||||
exit 1
|
|
||||||
fi
|
fi
|
||||||
|
|
||||||
git tag -a "$VERSION" -m "Prerelease $VERSION"
|
git commit -m "${MSG}"
|
||||||
git push origin "refs/tags/$VERSION"
|
|
||||||
|
|
||||||
- name: Generate release notes from CHANGELOG.md
|
- name: Push branch
|
||||||
|
if: ${{ env.REPORT_ONLY != 'true' }}
|
||||||
run: |
|
run: |
|
||||||
set -euo pipefail
|
source "$CI_HELPERS"
|
||||||
|
moko_init "Push branch"
|
||||||
|
|
||||||
VERSION="${{ needs.guard.outputs.version }}"
|
if [[ -z "${BRANCH_NAME:-}" ]]; then
|
||||||
|
echo "[FATAL] BRANCH_NAME not set." >&2
|
||||||
awk "/^## \\[$VERSION\\]/{flag=1;next}/^## \\[/{flag=0}flag" CHANGELOG.md > RELEASE_NOTES.md || true
|
exit 2
|
||||||
|
|
||||||
if [ ! -s RELEASE_NOTES.md ]; then
|
|
||||||
echo "ERROR: Release notes extraction failed for $VERSION."
|
|
||||||
exit 1
|
|
||||||
fi
|
fi
|
||||||
|
|
||||||
printf "\n\nAssets:\n- %s\n- update.xml\n- SHA256SUMS.txt\n" "${{ steps.build.outputs.zip_name }}" >> RELEASE_NOTES.md
|
git push --set-upstream origin "${BRANCH_NAME}"
|
||||||
|
|
||||||
- name: Upload build artifacts
|
- name: Publish audit trail
|
||||||
uses: actions/upload-artifact@v4
|
if: always()
|
||||||
with:
|
|
||||||
name: release-assets
|
|
||||||
path: |
|
|
||||||
dist/*.zip
|
|
||||||
dist/SHA256SUMS.txt
|
|
||||||
updates.xml
|
|
||||||
RELEASE_NOTES.md
|
|
||||||
retention-days: 30
|
|
||||||
|
|
||||||
- name: Attest build provenance
|
|
||||||
uses: actions/attest-build-provenance@v2
|
|
||||||
with:
|
|
||||||
subject-path: |
|
|
||||||
dist/*.zip
|
|
||||||
dist/SHA256SUMS.txt
|
|
||||||
|
|
||||||
- name: Create GitHub prerelease and attach assets
|
|
||||||
uses: softprops/action-gh-release@v2
|
|
||||||
with:
|
|
||||||
tag_name: ${{ needs.guard.outputs.version }}
|
|
||||||
name: Prerelease ${{ needs.guard.outputs.version }}
|
|
||||||
prerelease: true
|
|
||||||
body_path: RELEASE_NOTES.md
|
|
||||||
files: |
|
|
||||||
dist/*.zip
|
|
||||||
updates.xml
|
|
||||||
dist/SHA256SUMS.txt
|
|
||||||
|
|
||||||
squash_to_main:
|
|
||||||
name: 04 Optional squash merge version branch to main
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
needs:
|
|
||||||
- guard
|
|
||||||
- build_update_and_release
|
|
||||||
|
|
||||||
if: ${{ github.event.inputs.squash_to_main == 'true' }}
|
|
||||||
|
|
||||||
permissions:
|
|
||||||
contents: write
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- name: Checkout main
|
|
||||||
uses: actions/checkout@v4
|
|
||||||
with:
|
|
||||||
ref: main
|
|
||||||
fetch-depth: 0
|
|
||||||
|
|
||||||
- name: Configure Git identity
|
|
||||||
run: |
|
run: |
|
||||||
set -euo pipefail
|
source "$CI_HELPERS"
|
||||||
git config user.name "github-actions[bot]"
|
moko_init "Publish audit trail"
|
||||||
git config user.email "github-actions[bot]@users.noreply.github.com"
|
|
||||||
git config --global --add safe.directory "${GITHUB_WORKSPACE}"
|
|
||||||
|
|
||||||
- name: Fetch version branch
|
echo "# Version branch run" >> "$GITHUB_STEP_SUMMARY"
|
||||||
run: |
|
echo "" >> "$GITHUB_STEP_SUMMARY"
|
||||||
set -euo pipefail
|
echo "- Repository: $GITHUB_REPOSITORY" >> "$GITHUB_STEP_SUMMARY"
|
||||||
git fetch origin --prune
|
echo "- Base branch: ${BASE_BRANCH}" >> "$GITHUB_STEP_SUMMARY"
|
||||||
|
echo "- Branch prefix: ${BRANCH_PREFIX}" >> "$GITHUB_STEP_SUMMARY"
|
||||||
|
echo "- New version: ${NEW_VERSION}" >> "$GITHUB_STEP_SUMMARY"
|
||||||
|
echo "- Version text: ${VERSION_TEXT}" >> "$GITHUB_STEP_SUMMARY"
|
||||||
|
echo "- Report only: ${REPORT_ONLY}" >> "$GITHUB_STEP_SUMMARY"
|
||||||
|
echo "- Commit changes: ${COMMIT_CHANGES}" >> "$GITHUB_STEP_SUMMARY"
|
||||||
|
echo "- New branch: ${BRANCH_NAME:-}" >> "$GITHUB_STEP_SUMMARY"
|
||||||
|
echo "" >> "$GITHUB_STEP_SUMMARY"
|
||||||
|
|
||||||
- name: Squash merge version branch into main
|
if [[ -f "${REPORT_PATH}" ]]; then
|
||||||
run: |
|
echo "## Version bump report" >> "$GITHUB_STEP_SUMMARY"
|
||||||
set -euo pipefail
|
echo "" >> "$GITHUB_STEP_SUMMARY"
|
||||||
|
echo "\`\`\`json" >> "$GITHUB_STEP_SUMMARY"
|
||||||
VERSION="${{ needs.guard.outputs.version }}"
|
head -c 12000 "${REPORT_PATH}" >> "$GITHUB_STEP_SUMMARY" || true
|
||||||
VBRANCH="origin/${{ needs.guard.outputs.version_branch }}"
|
echo "" >> "$GITHUB_STEP_SUMMARY"
|
||||||
|
echo "\`\`\`" >> "$GITHUB_STEP_SUMMARY"
|
||||||
# Governance control: if main is protected from direct pushes, this will fail by design.
|
|
||||||
# Enforce PR-based merge in that scenario.
|
|
||||||
|
|
||||||
git checkout main
|
|
||||||
git merge --squash "${VBRANCH}"
|
|
||||||
|
|
||||||
if git diff --cached --quiet; then
|
|
||||||
echo "No changes to merge from ${VBRANCH}."
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
git commit -m "chore(release): squash ${VERSION} into main"
|
|
||||||
git push origin "HEAD:main"
|
|
||||||
|
|
||||||
- name: Optional delete version branch after squash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
if [ "${{ github.event.inputs.delete_version_branch }}" = "true" ]; then
|
|
||||||
git push origin --delete "${{ needs.guard.outputs.version_branch }}"
|
|
||||||
else
|
else
|
||||||
echo "Version branch retention enabled. Skipping deletion."
|
echo "## Version bump report" >> "$GITHUB_STEP_SUMMARY"
|
||||||
|
echo "" >> "$GITHUB_STEP_SUMMARY"
|
||||||
|
echo "Report file not found at: ${REPORT_PATH}" >> "$GITHUB_STEP_SUMMARY"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "" >> "$GITHUB_STEP_SUMMARY"
|
||||||
|
echo "## Error summary" >> "$GITHUB_STEP_SUMMARY"
|
||||||
|
echo "" >> "$GITHUB_STEP_SUMMARY"
|
||||||
|
|
||||||
|
if [[ -f "$ERROR_LOG" && -s "$ERROR_LOG" ]]; then
|
||||||
|
echo "\`\`\`" >> "$GITHUB_STEP_SUMMARY"
|
||||||
|
tail -n 200 "$ERROR_LOG" >> "$GITHUB_STEP_SUMMARY" || true
|
||||||
|
echo "\`\`\`" >> "$GITHUB_STEP_SUMMARY"
|
||||||
|
else
|
||||||
|
echo "No errors recorded." >> "$GITHUB_STEP_SUMMARY"
|
||||||
fi
|
fi
|
||||||
|
|||||||
Reference in New Issue
Block a user