|
| 1 | +#!/usr/bin/env bash |
| 2 | +# SPDX-License-Identifier: Apache-2.0 |
| 3 | + |
| 4 | +# tag-release.sh: start the lockstep SDK release for a stable core pin. |
| 5 | +# |
| 6 | +# Usage: tag-release.sh [--dry-run] [--force] [--sha <commit>] [--since <commit>] |
| 7 | +# |
| 8 | +# Reads the pin, OPENSHELL_CORE_REF in mise.toml, at <commit> (default: |
| 9 | +# $GITHUB_SHA, else HEAD). A pre-release pin creates nothing. Without --force, |
| 10 | +# nothing is created either when the pin at <commit> equals the pin at --since |
| 11 | +# (default: the parent of <commit>) or there is no pin there, so ordinary |
| 12 | +# pushes to main and the push that adds mise.toml are no-ops. |
| 13 | +# The release workflow passes the commit before the push as --since, which |
| 14 | +# covers pushes of several commits. Then, each step only when missing: |
| 15 | +# - tag vX.Y.Z (lightweight) at <commit>; a tag at another commit fails |
| 16 | +# - a draft GitHub release with the merged PR's body plus |
| 17 | +# "Matches OpenShell core vX.Y.Z" |
| 18 | +# Prints "tag=vX.Y.Z" when the release still has to be built and published, |
| 19 | +# and nothing when there is nothing to release or the release is published |
| 20 | +# already. The workflow appends the output to $GITHUB_OUTPUT. |
| 21 | +set -euo pipefail |
| 22 | + |
| 23 | +sdk_repo=${SDK_REPO:-ai-openshell/sdk-python} |
| 24 | +dry=0 |
| 25 | +force=0 |
| 26 | +sha=${GITHUB_SHA:-} |
| 27 | +since= |
| 28 | + |
| 29 | +usage() { echo "usage: $0 [--dry-run] [--force] [--sha <commit>] [--since <commit>]" >&2; exit 2; } |
| 30 | +while [ $# -gt 0 ]; do |
| 31 | + case $1 in |
| 32 | + --dry-run) dry=1; shift ;; |
| 33 | + --force) force=1; shift ;; |
| 34 | + --sha) sha=${2:?--sha needs a commit}; shift 2 ;; |
| 35 | + --since) since=${2:?--since needs a commit}; shift 2 ;; |
| 36 | + *) usage ;; |
| 37 | + esac |
| 38 | +done |
| 39 | +[ -n "$sha" ] || sha=$(git rev-parse HEAD) |
| 40 | +sha=$(git rev-parse "$sha^{commit}") |
| 41 | +short=$(git rev-parse --short "$sha") |
| 42 | + |
| 43 | +pin_at() { git show "$1:mise.toml" 2>/dev/null | sed -n 's/^OPENSHELL_CORE_REF = "\(.*\)"$/\1/p'; } |
| 44 | + |
| 45 | +pin=$(pin_at "$sha") |
| 46 | +if ! [[ "$pin" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then |
| 47 | + echo "Pin $pin is not a stable release; no SDK release." >&2 |
| 48 | + exit 0 |
| 49 | +fi |
| 50 | + |
| 51 | +if [ "$force" -eq 0 ]; then |
| 52 | + # A new branch push reports an all-zero "before"; fall back to the parent. |
| 53 | + if [ -z "$since" ] || ! git rev-parse --verify --quiet "$since^{commit}" >/dev/null; then |
| 54 | + since="$sha^" |
| 55 | + fi |
| 56 | + old=$(pin_at "$since" || true) |
| 57 | + if [ "$old" = "$pin" ]; then |
| 58 | + echo "The pin is $pin both at $short and at $(git rev-parse --short "$since"); no SDK release." >&2 |
| 59 | + exit 0 |
| 60 | + fi |
| 61 | + # No pin before means the push added mise.toml (the import), not a bump. |
| 62 | + if [ -z "$old" ]; then |
| 63 | + echo "No pin at $(git rev-parse --short "$since"); no SDK release." >&2 |
| 64 | + exit 0 |
| 65 | + fi |
| 66 | +fi |
| 67 | + |
| 68 | +# get_or_empty <api path> <jq>: the value, empty on 404, and fail on any other |
| 69 | +# error. gh prints the error body on stdout for a 404, so stdout is only used |
| 70 | +# after a successful call. |
| 71 | +get_or_empty() { |
| 72 | + local out err |
| 73 | + if out=$(gh api "$1" --jq "$2" 2>"${tmp}/err"); then |
| 74 | + printf '%s' "$out" |
| 75 | + else |
| 76 | + err=$(cat "${tmp}/err") |
| 77 | + grep -q 'HTTP 404' <<<"$err" || { echo "ERROR: gh api $1 failed: $err" >&2; return 1; } |
| 78 | + fi |
| 79 | +} |
| 80 | +tmp=$(mktemp -d) |
| 81 | +trap 'rm -rf "$tmp"' EXIT |
| 82 | + |
| 83 | +existing=$(get_or_empty "repos/$sdk_repo/git/ref/tags/$pin" '.object.sha') |
| 84 | +if [ -n "$existing" ] && [ "$existing" != "$sha" ]; then |
| 85 | + echo "ERROR: tag $pin exists at $existing, not at $sha. SDK tags never move; fix this by hand." >&2 |
| 86 | + exit 1 |
| 87 | +fi |
| 88 | +# The tag lookup doesn't return drafts, so search the release list. |
| 89 | +release=$(gh api --paginate "repos/$sdk_repo/releases" \ |
| 90 | + --jq ".[] | select(.tag_name == \"$pin\") | if .draft then \"draft\" else \"published\" end" | head -1) |
| 91 | +if [ "$release" = published ]; then |
| 92 | + echo "Release $pin is published already; nothing to do." >&2 |
| 93 | + exit 0 |
| 94 | +fi |
| 95 | + |
| 96 | +# Release notes: the body of the PR that merged this commit, then the match line. |
| 97 | +notes="$tmp/notes.md" |
| 98 | +pr_body=$(get_or_empty "repos/$sdk_repo/commits/$sha/pulls" '.[0].body // empty') |
| 99 | +{ |
| 100 | + [ -z "$pr_body" ] || printf '%s\n\n' "$pr_body" |
| 101 | + echo "Matches OpenShell core $pin." |
| 102 | +} >"$notes" |
| 103 | + |
| 104 | +if [ "$dry" -eq 1 ]; then |
| 105 | + if [ -n "$existing" ]; then |
| 106 | + echo "dry-run: tag $pin exists at $sha" >&2 |
| 107 | + else |
| 108 | + echo "dry-run: would create tag $pin at $sha" >&2 |
| 109 | + fi |
| 110 | + if [ "$release" = draft ]; then |
| 111 | + echo "dry-run: draft release $pin exists" >&2 |
| 112 | + else |
| 113 | + echo "dry-run: would create draft release $pin with notes:" >&2 |
| 114 | + sed 's/^/ | /' "$notes" >&2 |
| 115 | + fi |
| 116 | + echo "tag=$pin" |
| 117 | + exit 0 |
| 118 | +fi |
| 119 | + |
| 120 | +if [ -z "$existing" ]; then |
| 121 | + gh api -X POST "repos/$sdk_repo/git/refs" -f ref="refs/tags/$pin" -f sha="$sha" --silent |
| 122 | + echo "Created tag $pin at $sha." >&2 |
| 123 | +fi |
| 124 | +if [ -z "$release" ]; then |
| 125 | + gh release create "$pin" -R "$sdk_repo" --draft --verify-tag --title "$pin" --notes-file "$notes" >&2 |
| 126 | +fi |
| 127 | +echo "tag=$pin" |
0 commit comments