Add channel-aware release tooling and updater recovery
This commit is contained in:
351
scripts/publish-gitea-release.sh
Executable file
351
scripts/publish-gitea-release.sh
Executable file
@@ -0,0 +1,351 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
if [[ $# -ne 4 ]]
|
||||
then
|
||||
printf 'Usage: %s VERSION CHANNEL OUTPUT_DIR RELEASE_NOTES\n' "$0" >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
VERSION="$1"
|
||||
CHANNEL="$2"
|
||||
OUTPUT_DIRECTORY="$(realpath -- "$3")"
|
||||
RELEASE_NOTES="$(realpath -- "$4")"
|
||||
TAG="${RELEASE_TAG:-v${VERSION}}"
|
||||
COMMIT="${RELEASE_COMMIT:?RELEASE_COMMIT is required}"
|
||||
PRERELEASE="${RELEASE_PRERELEASE:?RELEASE_PRERELEASE is required}"
|
||||
API_URL="${GITHUB_API_URL:?GITHUB_API_URL is required}"
|
||||
REPOSITORY="${GITHUB_REPOSITORY:?GITHUB_REPOSITORY is required}"
|
||||
SERVER_URL="${GITHUB_SERVER_URL:?GITHUB_SERVER_URL is required}"
|
||||
TOKEN="${RELEASE_TOKEN:?RELEASE_TOKEN is required}"
|
||||
RELEASE_BRANCH="${RELEASE_BRANCH:-main}"
|
||||
PYTHON_BIN="${PTLINUX_PYTHON:-python3}"
|
||||
SCRIPT_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
|
||||
ARCHIVE_PREFIX="$(jq -er '.archive_prefix' "${SCRIPT_ROOT}/../release/config.json")"
|
||||
ARCHIVE="${OUTPUT_DIRECTORY}/${ARCHIVE_PREFIX}-${VERSION}.tar.gz"
|
||||
CHECKSUM="${ARCHIVE}.sha256"
|
||||
MANIFEST="${OUTPUT_DIRECTORY}/manifest.json"
|
||||
MANIFEST_SIGNATURE="${OUTPUT_DIRECTORY}/manifest.json.sig"
|
||||
RELEASE_NOTES_ASSET="${OUTPUT_DIRECTORY}/release-notes.md"
|
||||
API_ROOT="${API_URL%/}/repos/${REPOSITORY}"
|
||||
RESPONSE_DIRECTORY="$(mktemp -d)"
|
||||
|
||||
cleanup()
|
||||
{
|
||||
rm -rf -- "$RESPONSE_DIRECTORY"
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
RELEASE_MODEL="$(
|
||||
"$PYTHON_BIN" "${SCRIPT_ROOT}/../ptlinux/update_resolver.py" inspect-tag "$TAG"
|
||||
)"
|
||||
if [[ "$(jq -r '.version' <<< "$RELEASE_MODEL")" != "$VERSION" \
|
||||
|| "$(jq -r '.channel' <<< "$RELEASE_MODEL")" != "$CHANNEL" \
|
||||
|| "$(jq -r '.prerelease' <<< "$RELEASE_MODEL")" != "$PRERELEASE" ]]
|
||||
then
|
||||
printf 'Release tag, version, channel, and prerelease flag are inconsistent.\n' >&2
|
||||
exit 1
|
||||
fi
|
||||
if [[ ! "$COMMIT" =~ ^[0-9a-f]{40,64}$ ]]
|
||||
then
|
||||
printf 'Release commit is not a lowercase Git object ID: %s\n' "$COMMIT" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
for REQUIRED_ARTIFACT in \
|
||||
"$ARCHIVE" \
|
||||
"$CHECKSUM" \
|
||||
"$MANIFEST" \
|
||||
"$MANIFEST_SIGNATURE" \
|
||||
"$RELEASE_NOTES_ASSET"
|
||||
do
|
||||
if [[ ! -s "$REQUIRED_ARTIFACT" ]]
|
||||
then
|
||||
printf 'Required release artifact is missing or empty: %s\n' "$REQUIRED_ARTIFACT" >&2
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
api_request()
|
||||
{
|
||||
local METHOD="$1"
|
||||
local URL="$2"
|
||||
local OUTPUT="$3"
|
||||
shift 3
|
||||
curl \
|
||||
--silent \
|
||||
--show-error \
|
||||
--connect-timeout 20 \
|
||||
--max-time 180 \
|
||||
--request "$METHOD" \
|
||||
--header "Authorization: token ${TOKEN}" \
|
||||
--header 'Accept: application/json' \
|
||||
--output "$OUTPUT" \
|
||||
--write-out '%{http_code}' \
|
||||
"$@" \
|
||||
"$URL"
|
||||
}
|
||||
|
||||
fetch_all_releases()
|
||||
{
|
||||
local OUTPUT="$1"
|
||||
local PAGE=1
|
||||
local PAGE_COUNT
|
||||
local PAGE_FILE
|
||||
local STATUS
|
||||
local COMBINED
|
||||
printf '%s\n' '[]' > "$OUTPUT"
|
||||
while (( PAGE <= 100 ))
|
||||
do
|
||||
PAGE_FILE="${RESPONSE_DIRECTORY}/releases-page-${PAGE}.json"
|
||||
STATUS="$(
|
||||
api_request GET "${API_ROOT}/releases?limit=100&page=${PAGE}" "$PAGE_FILE"
|
||||
)"
|
||||
if [[ "$STATUS" != "200" ]]
|
||||
then
|
||||
printf 'Could not fetch release history page %s: HTTP %s\n' \
|
||||
"$PAGE" "$STATUS" >&2
|
||||
exit 1
|
||||
fi
|
||||
if ! PAGE_COUNT="$(jq -er 'if type == "array" then length else error("not an array") end' "$PAGE_FILE")"
|
||||
then
|
||||
printf 'Gitea release history page %s is not an array.\n' "$PAGE" >&2
|
||||
exit 1
|
||||
fi
|
||||
COMBINED="${RESPONSE_DIRECTORY}/releases-combined-${PAGE}.json"
|
||||
jq -s '.[0] + .[1]' "$OUTPUT" "$PAGE_FILE" > "$COMBINED"
|
||||
mv -- "$COMBINED" "$OUTPUT"
|
||||
if (( PAGE_COUNT < 100 ))
|
||||
then
|
||||
return
|
||||
fi
|
||||
((PAGE += 1))
|
||||
done
|
||||
printf '%s\n' 'Gitea release history exceeded the 10,000-release safety limit.' >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
EXISTING_RESPONSE="${RESPONSE_DIRECTORY}/existing.json"
|
||||
EXISTING_STATUS="$(api_request GET "${API_ROOT}/releases/tags/${TAG}" "$EXISTING_RESPONSE")"
|
||||
case "$EXISTING_STATUS" in
|
||||
404)
|
||||
;;
|
||||
200)
|
||||
printf 'Release %s already exists. Published releases are immutable.\n' "$TAG" >&2
|
||||
exit 1
|
||||
;;
|
||||
*)
|
||||
printf 'Could not check existing release %s: HTTP %s\n' "$TAG" "$EXISTING_STATUS" >&2
|
||||
jq -r '.message // empty' "$EXISTING_RESPONSE" >&2 || true
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
RELEASE_PAYLOAD="${RESPONSE_DIRECTORY}/release-payload.json"
|
||||
jq -n \
|
||||
--rawfile body "$RELEASE_NOTES" \
|
||||
--arg name "PristonTale EU Launcher ${VERSION}" \
|
||||
--arg tag_name "$TAG" \
|
||||
--arg target_commitish "$COMMIT" \
|
||||
--argjson prerelease "$PRERELEASE" \
|
||||
'{body:$body,draft:false,name:$name,prerelease:$prerelease,tag_name:$tag_name,target_commitish:$target_commitish}' \
|
||||
> "$RELEASE_PAYLOAD"
|
||||
|
||||
CREATE_RESPONSE="${RESPONSE_DIRECTORY}/created.json"
|
||||
CREATE_STATUS="$(
|
||||
api_request POST "${API_ROOT}/releases" "$CREATE_RESPONSE" \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data-binary "@${RELEASE_PAYLOAD}"
|
||||
)"
|
||||
if [[ "$CREATE_STATUS" != "201" ]]
|
||||
then
|
||||
printf 'Gitea release creation failed: HTTP %s\n' "$CREATE_STATUS" >&2
|
||||
jq -r '.message // empty' "$CREATE_RESPONSE" >&2 || true
|
||||
exit 1
|
||||
fi
|
||||
RELEASE_ID="$(jq -er '.id | select(type == "number" and . > 0)' "$CREATE_RESPONSE")"
|
||||
|
||||
upload_asset()
|
||||
{
|
||||
local FILE="$1"
|
||||
local NAME
|
||||
local RESPONSE
|
||||
local STATUS
|
||||
NAME="$(basename -- "$FILE")"
|
||||
RESPONSE="${RESPONSE_DIRECTORY}/asset-${NAME}.json"
|
||||
STATUS="$(
|
||||
api_request POST "${API_ROOT}/releases/${RELEASE_ID}/assets?name=${NAME}" "$RESPONSE" \
|
||||
--form "attachment=@${FILE};type=application/octet-stream"
|
||||
)"
|
||||
if [[ "$STATUS" != "201" ]]
|
||||
then
|
||||
printf 'Gitea asset upload failed for %s: HTTP %s\n' "$NAME" "$STATUS" >&2
|
||||
jq -r '.message // empty' "$RESPONSE" >&2 || true
|
||||
exit 1
|
||||
fi
|
||||
if [[ "$(jq -r '.name // empty' "$RESPONSE")" != "$NAME" ]]
|
||||
then
|
||||
printf 'Gitea returned the wrong attachment name for %s.\n' "$NAME" >&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
upload_asset "$ARCHIVE"
|
||||
upload_asset "$CHECKSUM"
|
||||
upload_asset "$MANIFEST"
|
||||
upload_asset "$MANIFEST_SIGNATURE"
|
||||
upload_asset "$RELEASE_NOTES_ASSET"
|
||||
|
||||
VERIFY_RESPONSE="${RESPONSE_DIRECTORY}/verified.json"
|
||||
VERIFY_STATUS="$(api_request GET "${API_ROOT}/releases/tags/${TAG}" "$VERIFY_RESPONSE")"
|
||||
if [[ "$VERIFY_STATUS" != "200" ]]
|
||||
then
|
||||
printf 'Could not re-query published release %s: HTTP %s\n' "$TAG" "$VERIFY_STATUS" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [[ "$(jq -r '.prerelease' "$VERIFY_RESPONSE")" != "$PRERELEASE" ]]
|
||||
then
|
||||
printf 'Published release prerelease flag does not match channel %s.\n' "$CHANNEL" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [[ "$(jq -r '.tag_name // empty' "$VERIFY_RESPONSE")" != "$TAG" \
|
||||
|| "$(jq -r '.draft' "$VERIFY_RESPONSE")" != "false" \
|
||||
|| "$(jq -r '.target_commitish // empty' "$VERIFY_RESPONSE")" != "$COMMIT" ]]
|
||||
then
|
||||
printf 'Published release identity or target commit does not match %s.\n' "$TAG" >&2
|
||||
exit 1
|
||||
fi
|
||||
for REQUIRED_ARTIFACT in \
|
||||
"$ARCHIVE" \
|
||||
"$CHECKSUM" \
|
||||
"$MANIFEST" \
|
||||
"$MANIFEST_SIGNATURE" \
|
||||
"$RELEASE_NOTES_ASSET"
|
||||
do
|
||||
ASSET_NAME="$(basename -- "$REQUIRED_ARTIFACT")"
|
||||
EXPECTED_SIZE="$(stat -c '%s' -- "$REQUIRED_ARTIFACT")"
|
||||
ACTUAL_SIZE="$(
|
||||
jq -er --arg name "$ASSET_NAME" \
|
||||
'.assets[] | select(.name == $name) | .size' "$VERIFY_RESPONSE"
|
||||
)"
|
||||
if [[ "$ACTUAL_SIZE" != "$EXPECTED_SIZE" ]]
|
||||
then
|
||||
printf 'Published asset size mismatch for %s: expected %s, got %s.\n' \
|
||||
"$ASSET_NAME" "$EXPECTED_SIZE" "$ACTUAL_SIZE" >&2
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
RELEASES_RESPONSE="${RESPONSE_DIRECTORY}/releases.json"
|
||||
fetch_all_releases "$RELEASES_RESPONSE"
|
||||
PUBLISHED_AT="$(jq -er '.published_at' "$VERIFY_RESPONSE")"
|
||||
HISTORY="${OUTPUT_DIRECTORY}/history.json"
|
||||
HISTORY_SIGNATURE="${OUTPUT_DIRECTORY}/history.json.sig"
|
||||
"$PYTHON_BIN" "${SCRIPT_ROOT}/generate_history.py" \
|
||||
"$RELEASES_RESPONSE" "$HISTORY" --generated-at "$PUBLISHED_AT"
|
||||
if ! jq -e \
|
||||
--arg tag "$TAG" \
|
||||
--arg channel "$CHANNEL" \
|
||||
'.releases[] | select(.tag == $tag and .channel == $channel and .status == "active")' \
|
||||
"$HISTORY" >/dev/null
|
||||
then
|
||||
printf 'Published release %s is absent or inactive in generated history.\n' "$TAG" >&2
|
||||
exit 1
|
||||
fi
|
||||
SIGNING_ARGUMENTS=(
|
||||
"$HISTORY"
|
||||
"$HISTORY_SIGNATURE"
|
||||
"${PTLINUX_SIGNING_KEY:?PTLINUX_SIGNING_KEY is required}"
|
||||
)
|
||||
if [[ -n "${PTLINUX_UPDATE_PUBLIC_KEY:-}" ]]
|
||||
then
|
||||
SIGNING_ARGUMENTS+=(--public-key "$PTLINUX_UPDATE_PUBLIC_KEY")
|
||||
fi
|
||||
"$PYTHON_BIN" "${SCRIPT_ROOT}/sign_metadata.py" "${SIGNING_ARGUMENTS[@]}"
|
||||
|
||||
CHANNEL_CONTENT="$(base64 -w 0 -- "$MANIFEST")"
|
||||
CHANNEL_SIGNATURE_CONTENT="$(base64 -w 0 -- "$MANIFEST_SIGNATURE")"
|
||||
HISTORY_CONTENT="$(base64 -w 0 -- "$HISTORY")"
|
||||
HISTORY_SIGNATURE_CONTENT="$(base64 -w 0 -- "$HISTORY_SIGNATURE")"
|
||||
CHANNEL_PATH="updates/${CHANNEL}.json"
|
||||
CHANNEL_SIGNATURE_PATH="updates/${CHANNEL}.json.sig"
|
||||
|
||||
file_operation()
|
||||
{
|
||||
local PATH_VALUE="$1"
|
||||
local CONTENT_VALUE="$2"
|
||||
local RESPONSE="${RESPONSE_DIRECTORY}/content-$(basename -- "$PATH_VALUE").json"
|
||||
local STATUS
|
||||
STATUS="$(api_request GET "${API_ROOT}/contents/${PATH_VALUE}?ref=${RELEASE_BRANCH}" "$RESPONSE")"
|
||||
case "$STATUS" in
|
||||
200)
|
||||
jq -cn \
|
||||
--arg content "$CONTENT_VALUE" \
|
||||
--arg path "$PATH_VALUE" \
|
||||
--arg sha "$(jq -er '.sha' "$RESPONSE")" \
|
||||
'{content:$content,operation:"update",path:$path,sha:$sha}'
|
||||
;;
|
||||
404)
|
||||
jq -cn \
|
||||
--arg content "$CONTENT_VALUE" \
|
||||
--arg path "$PATH_VALUE" \
|
||||
'{content:$content,operation:"create",path:$path}'
|
||||
;;
|
||||
*)
|
||||
printf 'Could not inspect repository metadata path %s: HTTP %s\n' \
|
||||
"$PATH_VALUE" "$STATUS" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
CHANNEL_OPERATION="$(file_operation "$CHANNEL_PATH" "$CHANNEL_CONTENT")"
|
||||
CHANNEL_SIGNATURE_OPERATION="$(
|
||||
file_operation "$CHANNEL_SIGNATURE_PATH" "$CHANNEL_SIGNATURE_CONTENT"
|
||||
)"
|
||||
HISTORY_OPERATION="$(file_operation updates/history.json "$HISTORY_CONTENT")"
|
||||
HISTORY_SIGNATURE_OPERATION="$(
|
||||
file_operation updates/history.json.sig "$HISTORY_SIGNATURE_CONTENT"
|
||||
)"
|
||||
CHANNEL_PAYLOAD="${RESPONSE_DIRECTORY}/channel-payload.json"
|
||||
jq -n \
|
||||
--arg branch "$RELEASE_BRANCH" \
|
||||
--arg message "Update ${CHANNEL} channel to ${VERSION}" \
|
||||
--argjson channel "$CHANNEL_OPERATION" \
|
||||
--argjson channel_signature "$CHANNEL_SIGNATURE_OPERATION" \
|
||||
--argjson history "$HISTORY_OPERATION" \
|
||||
--argjson history_signature "$HISTORY_SIGNATURE_OPERATION" \
|
||||
'{branch:$branch,message:$message,files:[$channel,$channel_signature,$history,$history_signature]}' \
|
||||
> "$CHANNEL_PAYLOAD"
|
||||
|
||||
CHANNEL_RESPONSE="${RESPONSE_DIRECTORY}/channel-response.json"
|
||||
CHANNEL_STATUS="$(
|
||||
api_request POST "${API_ROOT}/contents" "$CHANNEL_RESPONSE" \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data-binary "@${CHANNEL_PAYLOAD}"
|
||||
)"
|
||||
if [[ "$CHANNEL_STATUS" != "201" ]]
|
||||
then
|
||||
printf 'Atomic channel/history metadata update failed: HTTP %s\n' "$CHANNEL_STATUS" >&2
|
||||
jq -r '.message // empty' "$CHANNEL_RESPONSE" >&2 || true
|
||||
exit 1
|
||||
fi
|
||||
|
||||
ARCHIVE_SHA256="$(cut -d ' ' -f 1 -- "$CHECKSUM")"
|
||||
SUMMARY_FILE="${GITHUB_STEP_SUMMARY:-/dev/null}"
|
||||
{
|
||||
printf '## Published release\n\n'
|
||||
printf '| Field | Value |\n|---|---|\n'
|
||||
printf '| Release | PristonTale EU Launcher %s |\n' "$VERSION"
|
||||
printf '| Channel | `%s` |\n' "$CHANNEL"
|
||||
printf '| Tag | `%s` |\n' "$TAG"
|
||||
printf '| Commit | `%s` |\n' "$COMMIT"
|
||||
printf '| Archive | `%s` |\n' "$(basename -- "$ARCHIVE")"
|
||||
printf '| SHA-256 | `%s` |\n' "$ARCHIVE_SHA256"
|
||||
printf '| Manifest | `manifest.json` |\n'
|
||||
printf '| Status | Published |\n'
|
||||
} >> "$SUMMARY_FILE"
|
||||
|
||||
printf 'Published %s release %s (%s) with verified assets and channel metadata.\n' \
|
||||
"$CHANNEL" "$TAG" "${SERVER_URL%/}/${REPOSITORY}/releases/tag/${TAG}"
|
||||
Reference in New Issue
Block a user