release candidates: every push to main runs the full CI, the acceptance matrix and the Linux / Windows installer builds in parallel (ci.yml) and records the green result per commit as the draft rc-<sha> (green.json last); a version-only bump commit (proven file by file with the version writers) reuses its parent's CI and matrix and rebuilds only the installers; a v* tag only promotes the candidate (release.yml), fails fast on a red or missing commit; acceptance runs carry a CLI key; tools/release.ts does the whole release on the Mac (bump, CHANGELOG cut, fast gate, push, tag, Mac build + notarize in parallel with Forgejo, cached macOS acceptance, add, verify, publish with one upload of the Mac files, /Applications update, npm commands) and --rehearsal; DMG notarization runs while the app and updater bundle are checked; rehearsal channel on the VDS; docs
This commit is contained in:
parent
89d94d6993
commit
c3b1e8c370
14 changed files with 1438 additions and 526 deletions
|
|
@ -21,6 +21,7 @@ import { FakeAsc, FakePlay } from '../tests/helpers/fake-stores';
|
|||
import { makeAab } from '../tests/build-fixtures';
|
||||
import { ALPHA3 } from '../cli/lib/money';
|
||||
import { CURRENCY } from '../cli/lib/ppp';
|
||||
import { cliKey } from './cli-key';
|
||||
|
||||
const ROOT = resolve(import.meta.dir, '..');
|
||||
const PKG = JSON.parse(readFileSync(join(ROOT, 'package.json'), 'utf8')) as { version: string };
|
||||
|
|
@ -492,7 +493,7 @@ async function run(argv: string[]): Promise<void> {
|
|||
const failed = results.filter(r => !r.ok);
|
||||
const out = resolve(arg('--out') ?? join(ROOT, `acceptance-${platform}-${rt.name.replace(/\s+/g, '')}.json`));
|
||||
mkdirSync(dirname(out), { recursive: true });
|
||||
writeFileSync(out, JSON.stringify({ platform, runtime: rt.name, label: rt.label, version: PKG.version, quick, at: new Date().toISOString(), results }, null, 2));
|
||||
writeFileSync(out, JSON.stringify({ platform, runtime: rt.name, label: rt.label, version: PKG.version, cliKey: cliKey(ROOT), quick, at: new Date().toISOString(), results }, null, 2));
|
||||
console.log(`acceptance: ${results.length - failed.length}/${results.length} cells passed in ${Math.round((Date.now() - t0) / 1000)} s -> ${out}`);
|
||||
if (failed.length) {
|
||||
console.log(`acceptance: failed cells keep their folder and output.txt under ${work}`);
|
||||
|
|
@ -504,7 +505,17 @@ async function run(argv: string[]): Promise<void> {
|
|||
|
||||
// ------------------------------------------------------------------------------------------------- report
|
||||
|
||||
interface RunFile { platform: string; runtime: string; label: string; version: string; quick: boolean; at: string; results: Result[] }
|
||||
interface RunFile { platform: string; runtime: string; label: string; version: string; cliKey?: string; quick: boolean; at: string; results: Result[] }
|
||||
|
||||
/** Why a run does not count for this checkout (pure): a quick run, or another version whose CLI code differs. A run
|
||||
* of another version counts when its CLI key (tools/cli-key.ts) is this checkout's: the commits differ only in
|
||||
* version copies and prose (a release's version bump), so the CLI under test is the same code. */
|
||||
export function staleReason(r: Pick<RunFile, 'version' | 'quick' | 'cliKey'>, version: string, key: string): string | null {
|
||||
if (r.quick) return 'a quick run';
|
||||
if (r.version === version) return null;
|
||||
if (r.cliKey && r.cliKey === key) return null;
|
||||
return `version ${r.version}, not ${version}${r.cliKey ? ' (other CLI code)' : ''}`;
|
||||
}
|
||||
|
||||
export function renderReport(runs: RunFile[]): string {
|
||||
const cols = runs.map(r => `${r.platform} · ${r.runtime}`);
|
||||
|
|
@ -548,9 +559,11 @@ function report(argv: string[]): void {
|
|||
runs.sort((a, b) => rank(a) - rank(b));
|
||||
writeFileSync(md, renderReport(runs));
|
||||
const bad = runs.flatMap(r => r.results.filter(x => !x.ok));
|
||||
const stale = runs.filter(r => r.version !== PKG.version || r.quick);
|
||||
const key = cliKey(ROOT);
|
||||
const stale = runs.map(r => ({ r, why: staleReason(r, PKG.version, key) })).filter(x => x.why);
|
||||
console.log(`acceptance report: ${runs.length} runs, ${bad.length} red cells -> ${md}`);
|
||||
for (const r of stale) console.log(` ${r.platform} · ${r.runtime}: ${r.quick ? 'a quick run' : `version ${r.version}, not ${PKG.version}`}`);
|
||||
for (const { r, why } of stale) console.log(` ${r.platform} · ${r.runtime}: ${why}`);
|
||||
for (const r of runs) if (r.version !== PKG.version && !staleReason(r, PKG.version, key)) console.log(` ${r.platform} · ${r.runtime}: run on ${r.version}, same CLI code (key ${key.slice(0, 12)}): counts for ${PKG.version}`);
|
||||
const missing = expect && runs.length < expect ? `${expect - runs.length} of ${expect} runs missing` : '';
|
||||
if (missing) console.log(` ${missing}`);
|
||||
if (argv.includes('--strict') && (bad.length || stale.length || missing)) process.exit(1);
|
||||
|
|
|
|||
48
tools/cli-key.ts
Normal file
48
tools/cli-key.ts
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
#!/usr/bin/env bun
|
||||
// The CLI key: one hash of everything that decides how the packed npm CLI behaves in the acceptance matrix
|
||||
// (tools/acceptance.ts), with the version copies normalized. Two commits with the same key run the same CLI code; a
|
||||
// version bump (tools/desktop-version.ts --set) does not change it. Acceptance results carry the key, so the results
|
||||
// of a commit count for a version-only child (tools/release-candidate.ts) and the Mac reuses its cached macOS results
|
||||
// (tools/release.ts) until the CLI code really changes.
|
||||
// bun tools/cli-key.ts print the key of the working tree (tracked files only)
|
||||
// In the key: the npm package's files (package.json "files") without the prose that ships with it (CHANGELOG.md,
|
||||
// README.md, docs/*.md: the CLI never reads storebound's own docs), package.json, bun.lock and what the acceptance
|
||||
// run itself uses (tools/acceptance.ts, tools/build-node.ts, tests/helpers, tests/build-fixtures.ts, tests/fixtures).
|
||||
import { spawnSync } from 'node:child_process';
|
||||
import { createHash } from 'node:crypto';
|
||||
import { existsSync, readFileSync } from 'node:fs';
|
||||
import { join, resolve } from 'node:path';
|
||||
import { COPIES } from './desktop-version';
|
||||
|
||||
const ROOT = resolve(import.meta.dir, '..');
|
||||
const PROSE = /^(CHANGELOG\.md|README\.md|docs\/[^/]+\.md)$/;
|
||||
const EXTRA = ['package.json', 'bun.lock', 'tools/acceptance.ts', 'tools/build-node.ts', 'tools/cli-key.ts', 'tools/desktop-version.ts', 'tests/helpers', 'tests/build-fixtures.ts', 'tests/fixtures'];
|
||||
const NORMAL = '0.0.0-cli-key';
|
||||
|
||||
/** The paths of the key (git pathspecs). Pure. */
|
||||
export function keyPaths(pkgFiles: string[]): string[] {
|
||||
return [...new Set([...pkgFiles.filter(f => f !== 'dist/storebound.mjs'), ...EXTRA])].sort();
|
||||
}
|
||||
|
||||
/** One file's content in the key: the version copies with the version normalized. Pure. */
|
||||
export function keyContent(file: string, text: Buffer): Buffer {
|
||||
const copy = COPIES.find(c => c.file === file);
|
||||
return copy ? Buffer.from(copy.write(text.toString('utf8'), NORMAL)) : text;
|
||||
}
|
||||
|
||||
/** sha256 over (path, content) of every tracked file of the key, sorted. Pure given the reader. */
|
||||
export function cliKeyOf(files: string[], read: (f: string) => Buffer): string {
|
||||
const h = createHash('sha256');
|
||||
for (const f of [...files].filter(f => !PROSE.test(f)).sort()) { h.update(`${f}\0`); h.update(keyContent(f, read(f))); h.update('\0'); }
|
||||
return h.digest('hex').slice(0, 32);
|
||||
}
|
||||
|
||||
export function cliKey(root = ROOT): string {
|
||||
const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8')) as { files: string[] };
|
||||
const ls = spawnSync('git', ['ls-files', '-z', '--', ...keyPaths(pkg.files)], { cwd: root, encoding: 'utf8', maxBuffer: 64 << 20 });
|
||||
if (ls.status !== 0) throw new Error(`git ls-files: ${ls.stderr}`);
|
||||
const files = ls.stdout.split('\0').filter(f => f && existsSync(join(root, f)));
|
||||
return cliKeyOf(files, f => readFileSync(join(root, f)));
|
||||
}
|
||||
|
||||
if (import.meta.main) console.log(cliKey());
|
||||
|
|
@ -16,9 +16,12 @@
|
|||
// folder: privacy scan, minisign signature here (the key never goes to a runner), latest.json, SHA256SUMS and
|
||||
// evidence-<linux|windows>-<version>.json (the run and commit they came from; a commit other than the one of the
|
||||
// folder's other evidence is refused: every artifact of a version comes from one commit).
|
||||
// bun tools/desktop-release.ts publish --out <dir> --host <user@host> [--channel stable|beta] [--yes]
|
||||
// bun tools/desktop-release.ts publish --out <dir> --host <user@host> [--channel stable|beta|rehearsal]
|
||||
// [--forgejo-tag v<version>] [--yes]
|
||||
// Checks the folder again, uploads it to the server's incoming folder (rsync) and runs the root-owned publish
|
||||
// script there (tmp -> mv, latest.json last). Without --yes it only prints the plan (dry run).
|
||||
// script there (tmp -> mv, latest.json last). Without --yes it only prints the plan (dry run). --forgejo-tag: the
|
||||
// server fetches the files the Forgejo release already has, and attaches the Mac's DMG and updater bundle to it
|
||||
// from its copy (one upload over the owner's line instead of three; tools/release.ts uses this).
|
||||
// The folder's version must be package.json's: the npm CLI and the app are released together, the app first,
|
||||
// then `npm publish` of the same version.
|
||||
// bun tools/desktop-release.ts upload-forgejo --out <dir> [--tag v<version>] [--yes]
|
||||
|
|
@ -40,7 +43,7 @@ import { type Download, type DownloadKey, type Manifest, manifestProblems } from
|
|||
import { verify as verifySig } from '../cli/lib/minisign';
|
||||
import { buildOne, OUT_DIR as SIDECAR_DIR } from './build-sidecars';
|
||||
import { versions } from './desktop-version';
|
||||
import { upsert as forgejoUpsert } from './forgejo-release';
|
||||
import { listReleases, upsert as forgejoUpsert } from './forgejo-release';
|
||||
import { isMacArtifact, scanSignedMac } from './mac-signature-scan';
|
||||
import { allTerms, DEFAULT_TERMS, type Report, scan, TERMS_ENV } from './privacy-scan';
|
||||
|
||||
|
|
@ -165,6 +168,19 @@ function run(cmd: string[], opts: SpawnSyncOptions & { quiet?: boolean; allowFai
|
|||
return res;
|
||||
}
|
||||
|
||||
/** A command in the background (notarytool waiting for Apple, the boot check) while this process checks other
|
||||
* artifacts. Output is collected; the caller decides what a failure means. */
|
||||
function runAsync(cmd: string[], opts: { cwd?: string; env?: Record<string, string | undefined>; timeoutMs?: number; inherit?: boolean } = {}): Promise<{ code: number; out: string; err: string; ms: number }> {
|
||||
const start = Date.now();
|
||||
const p = Bun.spawn(cmd, { cwd: opts.cwd, env: (opts.env ?? process.env) as Record<string, string>, stdin: 'ignore', stdout: opts.inherit ? 'inherit' : 'pipe', stderr: opts.inherit ? 'inherit' : 'pipe' });
|
||||
const timer = opts.timeoutMs ? setTimeout(() => p.kill(), opts.timeoutMs) : null;
|
||||
const text = (s: ReadableStream<Uint8Array> | number | undefined | null) => (s && typeof s !== 'number' ? new Response(s).text() : Promise.resolve(''));
|
||||
return Promise.all([text(p.stdout as ReadableStream<Uint8Array>), text(p.stderr as ReadableStream<Uint8Array>), p.exited]).then(([out, err, code]) => {
|
||||
if (timer) clearTimeout(timer);
|
||||
return { code, out, err, ms: Date.now() - start };
|
||||
});
|
||||
}
|
||||
|
||||
const sha256 = (file: string) => createHash('sha256').update(readFileSync(file)).digest('hex');
|
||||
const mb = (n: number) => `${(n / 1e6).toFixed(1)} MB`;
|
||||
const confPubkey = (): string => JSON.parse(readFileSync(join(TAURI_DIR, 'tauri.conf.json'), 'utf8')).plugins.updater.pubkey;
|
||||
|
|
@ -442,27 +458,25 @@ async function mac(argv: string[]): Promise<void> {
|
|||
{ cwd: APP_DIR, env: unsignedEnv as Record<string, string>, stdio: ['ignore', 'inherit', 'inherit'] });
|
||||
if (tb.status !== 0) fail(`tauri build failed (exit ${tb.status})`);
|
||||
const preSignGuard = archGuard(join(targetDir, 'universal-apple-darwin/release/bundle/macos', APP_NAME), 'unsigned app (before signing)');
|
||||
say(`tauri bundle --target universal-apple-darwin --bundles app (${signed ? `sign${notarized ? ', notarize, staple' : ''}` : 'ad-hoc sign'})`);
|
||||
const tbs = spawnSync('bunx', ['tauri', 'bundle', '--target', 'universal-apple-darwin', '--bundles', 'app', '--ci', '--config', overrideFile],
|
||||
{ cwd: APP_DIR, env: env as Record<string, string>, stdio: ['ignore', 'inherit', 'inherit'] });
|
||||
if (tbs.status !== 0) fail(`tauri bundle (signing) failed (exit ${tbs.status})`);
|
||||
// the frontend tauri just embedded (apps/desktop/dist): it must draw under the release CSP and the frozen
|
||||
// in parallel: tauri bundle signs, notarizes (Apple's queue: minutes) and staples the app, while the boot check
|
||||
// runs the frontend tauri just embedded (apps/desktop/dist): it must draw under the release CSP and the frozen
|
||||
// Object.prototype with old saved states (tools/desktop-boot-check.ts); a blank window never ships again
|
||||
say('boot check of the built window (empty, D1 with folders gone, D3 saved state; missing bundle panel)');
|
||||
const boot = spawnSync('bun', [join(ROOT, 'tools/desktop-boot-check.ts')], { cwd: ROOT, encoding: 'utf8', timeout: 600_000 });
|
||||
process.stdout.write(boot.stdout ?? '');
|
||||
if (boot.status !== 0) fail(`the built window does not boot cleanly (tools/desktop-boot-check.ts): ${(boot.stderr ?? '').trim().split('\n').slice(-3).join(' / ')}`);
|
||||
const bootCheck = (boot.stdout ?? '').trim().split('\n').at(-1) ?? 'ok';
|
||||
say(`tauri bundle --target universal-apple-darwin --bundles app (${signed ? `sign${notarized ? ', notarize, staple' : ''}` : 'ad-hoc sign'}), boot check of the built window at the same time`);
|
||||
const bootP = runAsync(['bun', join(ROOT, 'tools/desktop-boot-check.ts')], { cwd: ROOT, timeoutMs: 600_000 });
|
||||
const tbs = await runAsync(['bunx', 'tauri', 'bundle', '--target', 'universal-apple-darwin', '--bundles', 'app', '--ci', '--config', overrideFile], { cwd: APP_DIR, env, inherit: true, timeoutMs: 3_600_000 });
|
||||
say(`tauri bundle done in ${(tbs.ms / 1000).toFixed(0)} s`);
|
||||
const boot = await bootP;
|
||||
process.stdout.write(boot.out);
|
||||
if (tbs.code !== 0) fail(`tauri bundle (signing) failed (exit ${tbs.code})`);
|
||||
if (boot.code !== 0) fail(`the built window does not boot cleanly (tools/desktop-boot-check.ts): ${boot.err.trim().split('\n').slice(-3).join(' / ')}`);
|
||||
say(`boot check passed in ${(boot.ms / 1000).toFixed(0)} s`);
|
||||
const bootCheck = boot.out.trim().split('\n').at(-1) ?? 'ok';
|
||||
const bundleDir = join(targetDir, 'universal-apple-darwin/release/bundle/macos');
|
||||
const app = join(bundleDir, APP_NAME);
|
||||
if (!existsSync(app)) fail(`no ${APP_NAME} in ${bundleDir}`);
|
||||
const dsyms = readdirSync(bundleDir).filter(n => n.endsWith('.dSYM'));
|
||||
if (dsyms.length) fail(`debug symbols next to the app: ${dsyms.join(', ')}`);
|
||||
|
||||
const arch: Record<string, ArchGuard> = { preSign: preSignGuard, app: archGuard(app, 'signed app') };
|
||||
const checks: Record<string, Gate> = { app: gatekeeper(app, signed, notarized, 'built app') };
|
||||
const tests: Record<string, SelfTest[]> = { app: selfTest(app, 'built app') };
|
||||
|
||||
// updater bundle: the app as Tauri's updater expects it (tar.gz, no macOS metadata, root-owned entries)
|
||||
const updaterName = artifactName(version, 'updater', signed);
|
||||
const updater = join(out, updaterName);
|
||||
|
|
@ -479,18 +493,38 @@ async function mac(argv: string[]): Promise<void> {
|
|||
say(`DMG ${dmgName}`);
|
||||
run(['hdiutil', 'create', '-volname', PRODUCT, '-srcfolder', stage, '-fs', 'HFS+', '-format', 'UDZO', '-imagekey', 'zlib-level=9', '-ov', dmg]);
|
||||
rmSync(stage, { recursive: true, force: true });
|
||||
// the DMG goes to Apple now; while Apple checks it, this process checks the app and the updater bundle (they
|
||||
// carry the app's own stapled ticket and do not depend on the DMG's)
|
||||
let dmgNotary: Promise<{ code: number; out: string; err: string; ms: number }> | null = null;
|
||||
if (signed) {
|
||||
run(['codesign', '--force', '--sign', identity!, '--timestamp', dmg]);
|
||||
if (notarized) {
|
||||
say('notarytool submit (DMG), waiting for Apple');
|
||||
const n = run(['xcrun', 'notarytool', 'submit', dmg, '--key', notary!.APPLE_API_KEY_PATH!, '--key-id', notary!.APPLE_API_KEY!, '--issuer', notary!.APPLE_API_ISSUER!, '--wait', '--output-format', 'json'], { allowFail: true, timeout: 3_600_000 });
|
||||
const status = (() => { try { return (JSON.parse(n.out) as { status?: string }).status; } catch { return undefined; } })();
|
||||
if (status !== 'Accepted') fail(`notarization of the DMG: ${status ?? (n.err.trim() || n.out.trim() || `notarytool exited ${n.code} without an answer (killed or timed out): run again; xcrun notarytool history shows the submission`)}`);
|
||||
run(['xcrun', 'stapler', 'staple', dmg]);
|
||||
run(['xcrun', 'stapler', 'validate', dmg]);
|
||||
say('notarytool submit (DMG): checking the app and the updater bundle while Apple checks the DMG');
|
||||
dmgNotary = runAsync(['xcrun', 'notarytool', 'submit', dmg, '--key', notary!.APPLE_API_KEY_PATH!, '--key-id', notary!.APPLE_API_KEY!, '--issuer', notary!.APPLE_API_ISSUER!, '--wait', '--output-format', 'json'], { timeoutMs: 3_600_000 });
|
||||
}
|
||||
}
|
||||
|
||||
const arch: Record<string, ArchGuard> = { preSign: preSignGuard, app: archGuard(app, 'signed app') };
|
||||
const checks: Record<string, Gate> = { app: gatekeeper(app, signed, notarized, 'built app') };
|
||||
const tests: Record<string, SelfTest[]> = { app: selfTest(app, 'built app') };
|
||||
const unpacked = mkdtempSync(join(tmpdir(), 'sb-upd-'));
|
||||
run(['tar', '-xzf', updater, '-C', unpacked]);
|
||||
arch.updaterApp = archGuard(join(unpacked, APP_NAME), 'app in the updater bundle');
|
||||
checks.updaterApp = gatekeeper(join(unpacked, APP_NAME), signed, notarized, 'app in the updater bundle');
|
||||
tests.updater = selfTest(join(unpacked, APP_NAME), 'updater bundle');
|
||||
rmSync(unpacked, { recursive: true, force: true });
|
||||
const privacyApp = privacyGate([app, updater]);
|
||||
const updaterSig = signFile(updater);
|
||||
|
||||
if (dmgNotary) {
|
||||
const n = await dmgNotary;
|
||||
const status = (() => { try { return (JSON.parse(n.out) as { status?: string }).status; } catch { return undefined; } })();
|
||||
if (status !== 'Accepted') fail(`notarization of the DMG: ${status ?? (n.err.trim() || n.out.trim() || `notarytool exited ${n.code} without an answer (killed or timed out): run again; xcrun notarytool history shows the submission`)}`);
|
||||
say(`DMG notarized in ${(n.ms / 1000).toFixed(0)} s`);
|
||||
run(['xcrun', 'stapler', 'staple', dmg]);
|
||||
run(['xcrun', 'stapler', 'validate', dmg]);
|
||||
}
|
||||
|
||||
// the exact artifacts: mount the DMG and unpack the updater bundle, then self-test what is inside
|
||||
const mnt = mkdtempSync(join(tmpdir(), 'sb-mnt-'));
|
||||
run(['hdiutil', 'attach', '-readonly', '-nobrowse', '-noautoopen', '-mountpoint', mnt, dmg]);
|
||||
|
|
@ -512,18 +546,12 @@ async function mac(argv: string[]): Promise<void> {
|
|||
dmgStapler = 'ticket stapled, validated';
|
||||
}
|
||||
say(`DMG: spctl -t open ${dmgSpctl}; ${dmgStapler}`);
|
||||
const unpacked = mkdtempSync(join(tmpdir(), 'sb-upd-'));
|
||||
run(['tar', '-xzf', updater, '-C', unpacked]);
|
||||
arch.updaterApp = archGuard(join(unpacked, APP_NAME), 'app in the updater bundle');
|
||||
checks.updaterApp = gatekeeper(join(unpacked, APP_NAME), signed, notarized, 'app in the updater bundle');
|
||||
tests.updater = selfTest(join(unpacked, APP_NAME), 'updater bundle');
|
||||
rmSync(unpacked, { recursive: true, force: true });
|
||||
|
||||
// privacy: the app folder, the DMG (mounted) and the updater bundle (unpacked)
|
||||
const privacy = privacyGate([app, dmg, updater]);
|
||||
// privacy: the app folder and the updater bundle (unpacked) above, the DMG (mounted) now
|
||||
const privacyDmg = privacyGate([dmg]);
|
||||
const privacy = { files: privacyApp.files + privacyDmg.files, bytes: privacyApp.bytes + privacyDmg.bytes, hits: 0 };
|
||||
|
||||
// signatures with the updater key, latest.json, SHA256SUMS
|
||||
const updaterSig = signFile(updater);
|
||||
// signatures with the updater key (the updater bundle's above), latest.json, SHA256SUMS
|
||||
const dmgSig = signFile(dmg);
|
||||
const notes = a.get('notes') ?? `storebound desktop ${version}`;
|
||||
const now = new Date().toISOString().replace(/\.\d{3}Z$/, 'Z');
|
||||
|
|
@ -684,27 +712,78 @@ export function publishSteps(o: { host: string; v: string; channel: string; out:
|
|||
];
|
||||
}
|
||||
|
||||
function publish(argv: string[]): void {
|
||||
/** The channels of storebound.dev/desktop: stable (latest.json), beta, and rehearsal (tools/release.ts --rehearsal:
|
||||
* a throwaway prerelease that no app reads). */
|
||||
export const CHANNELS = ['stable', 'beta', 'rehearsal'] as const;
|
||||
export const channelUrl = (channel: string): string => (channel === 'stable' ? `${BASE_URL}/latest.json` : `${BASE_URL}/${channel}/latest.json`);
|
||||
|
||||
/**
|
||||
* Files the server can fetch from the Forgejo release instead of the owner's uplink (pure): every file of the folder
|
||||
* whose SHA-256 is in the release's SHA256SUMS under some asset name (the Windows installer is renamed -unsigned
|
||||
* here). Each is downloaded on the server into the incoming folder before rsync, which then only compares checksums.
|
||||
*/
|
||||
export function seedPlan(local: { file: string; sha256: string }[], releaseSums: string, assets: { name: string; url: string }[]): { file: string; url: string; sha256: string }[] {
|
||||
const byHash = new Map<string, string>();
|
||||
for (const l of releaseSums.split('\n')) { const m = /^([0-9a-f]{64})\s+\*?(\S+)$/.exec(l.trim()); if (m) byHash.set(m[1]!, m[2]!); }
|
||||
const out: { file: string; url: string; sha256: string }[] = [];
|
||||
for (const f of local) {
|
||||
const name = byHash.get(f.sha256);
|
||||
const asset = name ? assets.find(x => x.name === name) : undefined;
|
||||
if (asset) out.push({ file: f.file, url: asset.url, sha256: f.sha256 });
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
async function publish(argv: string[]): Promise<void> {
|
||||
const a = args(argv);
|
||||
const out = resolve(a.get('out') ?? fail('--out <version folder> is required'));
|
||||
const host = a.get('host') ?? process.env.STOREBOUND_PUBLISH_HOST ?? fail('--host <user@host> (or STOREBOUND_PUBLISH_HOST) is required');
|
||||
if (!/^[A-Za-z0-9._-]+@[A-Za-z0-9.-]+$/.test(host)) fail(`--host: user@host, got ${host}`);
|
||||
const channel = a.get('channel') ?? 'stable';
|
||||
if (!['stable', 'beta'].includes(channel)) fail('--channel stable or beta');
|
||||
if (!(CHANNELS as readonly string[]).includes(channel)) fail(`--channel ${CHANNELS.join(', ')}`);
|
||||
const { manifest, files } = verifyFolder(out);
|
||||
const v = manifest.version;
|
||||
const together = releaseTogetherProblems(v, versions().version);
|
||||
if (together.length) fail(together.join('; '));
|
||||
const unsigned = Object.values(manifest.downloads ?? {}).filter(d => !d!.codeSigned && /\.(dmg|exe)$/.test(d!.file)).map(d => d!.file);
|
||||
const steps = publishSteps({ host, v, channel, out, files });
|
||||
console.log(`\npublish storebound desktop ${v} to the ${channel} channel (${channel === 'stable' ? `${BASE_URL}/latest.json` : `${BASE_URL}/beta/latest.json`}):`);
|
||||
const forgejoTag = a.get('forgejo-tag');
|
||||
if (forgejoTag && forgejoTag !== `v${v}`) fail(`--forgejo-tag ${forgejoTag} is not v${v}`);
|
||||
// with --forgejo-tag: the server takes the Linux / Windows files from the Forgejo release (its own network), and
|
||||
// after the rsync attaches the Mac's files to that release from its copy, so every byte crosses the owner's
|
||||
// uplink once (the DMG and the updater bundle), not three times
|
||||
const rel = forgejoTag ? (await listReleases()).find(r => r.tag_name === forgejoTag) : undefined;
|
||||
if (forgejoTag && !rel) fail(`no Forgejo release ${forgejoTag} yet (release.yml promotes the candidate on the tag push)`);
|
||||
const relSums = rel?.assets.find(x => x.name === 'SHA256SUMS');
|
||||
const sumsText0 = relSums ? spawnSync('curl', ['-fsSL', relSums.browser_download_url], { encoding: 'utf8' }).stdout ?? '' : '';
|
||||
const seed = rel ? seedPlan(files.map(f => ({ file: f, sha256: sha256(join(out, f)) })), sumsText0, rel.assets.map(x => ({ name: x.name, url: x.browser_download_url }))) : [];
|
||||
const macFiles = forgejoTag ? forgejoMacFiles(files, v) : [];
|
||||
console.log(`\npublish storebound desktop ${v} to the ${channel} channel (${channelUrl(channel)}):`);
|
||||
for (const f of files) console.log(` ${f}`);
|
||||
if (unsigned.length) console.log(` note: unsigned preview builds (${unsigned.join(', ')}); the downloads page says so.`);
|
||||
console.log('\nsteps:');
|
||||
for (const s of steps) console.log(` ${s[0]} ${s.slice(1).map(x => (x.includes(' ') ? `"${x}"` : x.replace(out, '<out>'))).join(' ')}`);
|
||||
if (seed.length) console.log(` the server fetches from Forgejo ${forgejoTag}: ${seed.map(x => x.file).join(', ')}`);
|
||||
if (macFiles.length) console.log(` then attaches to Forgejo ${forgejoTag} from its copy: ${macFiles.join(', ')}`);
|
||||
if (!a.has('yes')) { console.log('\ndry run: nothing uploaded. Every installed app on this channel offers the update once latest.json is live; run again with --yes to publish.'); return; }
|
||||
for (const s of steps) { say(`${s[0]} ...`); run(s, { stdio: ['ignore', 'inherit', 'inherit'] }); }
|
||||
const live = spawnSync('curl', ['-fsS', channel === 'stable' ? `${BASE_URL}/latest.json` : `${BASE_URL}/beta/latest.json`], { encoding: 'utf8' });
|
||||
const [mkdir, rsync, finish] = steps as [string[], string[], string[]];
|
||||
run(mkdir);
|
||||
if (seed.length) {
|
||||
const dir = `${REMOTE_INCOMING}/${v}`;
|
||||
const lines = seed.map(x => { if (!/^[A-Za-z0-9._-]+$/.test(x.file) || !/^https:\/\/[A-Za-z0-9./_%-]+$/.test(x.url)) fail(`seed: unexpected ${x.file} ${x.url}`); return `curl -fsSL --max-time 900 -o '${dir}/${x.file}' '${x.url}' && echo '${x.sha256} ${dir}/${x.file}' | sha256sum -c --quiet`; });
|
||||
say(`server: fetch ${seed.length} files from the Forgejo release`);
|
||||
// in parallel on the server; any failed download or hash fails the step
|
||||
run(['ssh', host, `pids=''; ${lines.map(l => `(${l}) & pids="$pids $!"`).join('; ')}; for p in $pids; do wait $p || exit 1; done`], { stdio: ['ignore', 'inherit', 'inherit'] });
|
||||
}
|
||||
say(`rsync (only what the server does not have yet) ...`);
|
||||
run(rsync, { stdio: ['ignore', 'inherit', 'inherit'] });
|
||||
if (macFiles.length) {
|
||||
say(`Forgejo ${forgejoTag}: attach ${macFiles.join(', ')} from the server's copy`);
|
||||
await forgejoUpsert({ tag: forgejoTag!, files: macFiles.map(f => join(out, f)), create: false, yes: true, remote: { host, dir: `${REMOTE_INCOMING}/${v}` } });
|
||||
}
|
||||
say('publish script ...');
|
||||
run(finish, { stdio: ['ignore', 'inherit', 'inherit'] });
|
||||
const live = spawnSync('curl', ['-fsS', channelUrl(channel)], { encoding: 'utf8' });
|
||||
if (live.status !== 0 || (JSON.parse(live.stdout) as Manifest).version !== v) fail('latest.json on storebound.dev is not the new version yet');
|
||||
say(`live: ${BASE_URL}/ serves ${v}`);
|
||||
say(`next, the same release: npm publish of storebound ${v} (CONTRIBUTING.md). \`npx storebound desktop\` of ${v} installs or updates to this app.`);
|
||||
|
|
@ -741,7 +820,7 @@ if (import.meta.main) {
|
|||
if (cmd === 'mac') await mac(argv.slice(1));
|
||||
else if (cmd === 'add') add(argv);
|
||||
else if (cmd === 'verify') verifyFolder(resolve(args(argv).get('out') ?? fail('--out <version folder>')));
|
||||
else if (cmd === 'publish') publish(argv.slice(1));
|
||||
else if (cmd === 'publish') await publish(argv.slice(1));
|
||||
else if (cmd === 'upload-forgejo') await uploadForgejo(argv.slice(1));
|
||||
else if (cmd === 'exec') {
|
||||
// `exec -- <command...>`: runs a build command with the path-free environment (the Forgejo workflow uses it)
|
||||
|
|
|
|||
|
|
@ -103,27 +103,34 @@ export function mergeSums(existing: string, add: { file: string; sha256: string
|
|||
|
||||
export interface Release { id: number; tag_name: string; name: string; draft: boolean; prerelease: boolean; body: string; assets: { id: number; name: string; size: number; browser_download_url: string }[] }
|
||||
|
||||
/** Release entries `prune --keep <tag>` deletes: every other entry, the kept one must exist and be published. */
|
||||
/** Release entries `prune --keep <tag>` deletes: every other entry, the kept one must exist and be published.
|
||||
* Release candidates (rc-<sha> drafts of ci.yml, tools/release-candidate.ts) are not entries: they have their own
|
||||
* pruning (`release-candidate.ts prune`), and a newer commit's candidate must survive a release. */
|
||||
export function pruneList(releases: Release[], keep: string): { remove: Release[]; problem?: string } {
|
||||
const kept = releases.find(r => r.tag_name === keep);
|
||||
if (!kept) return { remove: [], problem: `no release for ${keep}: nothing is deleted` };
|
||||
if (kept.draft) return { remove: [], problem: `the release of ${keep} is a draft: nothing is deleted` };
|
||||
return { remove: releases.filter(r => r.id !== kept.id) };
|
||||
return { remove: releases.filter(r => r.id !== kept.id && !isCandidateTag(r.tag_name)) };
|
||||
}
|
||||
|
||||
/** Tag names of dry runs: only these may be deleted with their tag. */
|
||||
export const isTestTag = (tag: string): boolean => /^test-[0-9a-f]{7,40}$/.test(tag);
|
||||
/** Tag names of dry runs and release rehearsals (tools/release.ts --rehearsal): only these may be deleted with
|
||||
* their tag. */
|
||||
export const isTestTag = (tag: string): boolean => /^test-[0-9a-f]{7,40}$/.test(tag) || /^v0\.0\.0-rehearsal\.\d+$/.test(tag);
|
||||
|
||||
/** The draft that holds the release candidate of a commit (ci.yml's record job). */
|
||||
export const candidateTag = (sha: string): string => `rc-${sha}`;
|
||||
export const isCandidateTag = (tag: string): boolean => /^rc-[0-9a-f]{40}$/.test(tag);
|
||||
|
||||
// ---------------------------------------------------------------------------------------------------------------------
|
||||
// API
|
||||
|
||||
const BASE = (process.env.FORGEJO_URL ?? 'https://git.crt.fyi').replace(/\/+$/, '');
|
||||
const REPO = process.env.FORGEJO_REPOSITORY ?? process.env.GITHUB_REPOSITORY ?? 'CRT/storebound';
|
||||
export const BASE = (process.env.FORGEJO_URL ?? 'https://git.crt.fyi').replace(/\/+$/, '');
|
||||
export const REPO = process.env.FORGEJO_REPOSITORY ?? process.env.GITHUB_REPOSITORY ?? 'CRT/storebound';
|
||||
const API = `${BASE}/api/v1/repos/${REPO}`;
|
||||
function fail(msg: string): never { console.error(`forgejo-release: ${msg}`); process.exit(1); }
|
||||
|
||||
let authHeader: string | null = null;
|
||||
function auth(): string {
|
||||
export function auth(): string {
|
||||
if (authHeader) return authHeader;
|
||||
const token = process.env.FORGEJO_TOKEN;
|
||||
if (token) return (authHeader = `token ${token}`);
|
||||
|
|
@ -135,7 +142,7 @@ function auth(): string {
|
|||
return (authHeader = `Basic ${Buffer.from(`${user}:${pass}`).toString('base64')}`);
|
||||
}
|
||||
|
||||
async function api<T>(method: string, path: string, body?: unknown, raw = false): Promise<T> {
|
||||
export async function api<T>(method: string, path: string, body?: unknown, raw = false): Promise<T> {
|
||||
const url = path.startsWith('http') ? path : `${API}${path}`;
|
||||
for (let attempt = 1; ; attempt++) {
|
||||
const res = await fetch(url, {
|
||||
|
|
@ -152,6 +159,18 @@ async function api<T>(method: string, path: string, body?: unknown, raw = false)
|
|||
}
|
||||
}
|
||||
|
||||
/** Download one asset (drafts need the token) to a file; through the origin like uploads when it is set. */
|
||||
export async function downloadAsset(url: string, dest: string): Promise<void> {
|
||||
const ip = origin();
|
||||
const dir = mkdtempSync(join(tmpdir(), 'forgejo-dl-'));
|
||||
try {
|
||||
writeFileSync(join(dir, 'h'), `Authorization: ${auth()}\n`, { mode: 0o600 });
|
||||
const host = new URL(BASE).host;
|
||||
const r = spawnSync('curl', ['-sS', '-L', '--fail', '--max-time', '1800', ...(ip ? ['--resolve', `${host}:443:${ip.includes(':') ? `[${ip}]` : ip}`] : []), '-H', `@${join(dir, 'h')}`, '-o', dest, url], { encoding: 'utf8' });
|
||||
if (r.status !== 0) fail(`download ${basename(dest)}: curl exit ${r.status}: ${r.stderr.slice(0, 300)}`);
|
||||
} finally { rmSync(dir, { recursive: true, force: true }); }
|
||||
}
|
||||
|
||||
export async function listReleases(): Promise<Release[]> {
|
||||
const all: Release[] = [];
|
||||
for (let page = 1; page < 50; page++) {
|
||||
|
|
@ -165,7 +184,7 @@ export async function listReleases(): Promise<Release[]> {
|
|||
/** Cloudflare's request body limit: bigger uploads need the origin. */
|
||||
export const PROXY_BODY_LIMIT = 100e6;
|
||||
|
||||
function origin(): string | null {
|
||||
export function origin(): string | null {
|
||||
const f = join(homedir(), '.storebound-keys', 'forgejo-origin');
|
||||
const v = (process.env.FORGEJO_ORIGIN ?? (existsSync(f) ? readFileSync(f, 'utf8') : '')).trim();
|
||||
if (!v) return null;
|
||||
|
|
@ -173,10 +192,25 @@ function origin(): string | null {
|
|||
return v;
|
||||
}
|
||||
|
||||
/** A host that already holds the files (the VDS after the publish rsync): its curl uploads them to Forgejo, so the
|
||||
* owner's slow uplink carries each file once (tools/release.ts). The auth header goes over ssh's stdin into a 0600
|
||||
* temp file there, removed right after; never into argv or a log. */
|
||||
export interface RemoteFiles { host: string; dir: string }
|
||||
|
||||
/** One asset upload (multipart). With an origin: curl --resolve to it (header from a 0600 file, never argv). */
|
||||
async function uploadAsset(releaseId: number, name: string, file: string | null, data: string | null): Promise<void> {
|
||||
async function uploadAsset(releaseId: number, name: string, file: string | null, data: string | null, remote?: RemoteFiles): Promise<void> {
|
||||
const url = `${API}/releases/${releaseId}/assets?name=${encodeURIComponent(name)}`;
|
||||
const ip = origin();
|
||||
if (remote && file) {
|
||||
const host = new URL(BASE).host;
|
||||
const resolveArg = ip ? `--resolve ${host}:443:${ip.includes(':') ? `[${ip}]` : ip}` : '';
|
||||
const src = `${remote.dir}/${basename(file)}`;
|
||||
if (!/^[A-Za-z0-9._\/-]+$/.test(src) || !/^[A-Za-z0-9._-]+$/.test(name)) fail(`remote upload: unexpected characters in ${src}`);
|
||||
const script = `set -e; h=$(mktemp); trap 'rm -f "$h"' EXIT; chmod 600 "$h"; cat > "$h"; curl -sS --fail-with-body --max-time 1800 ${resolveArg} -H @"$h" -F 'attachment=@${src};filename=${name}' '${url}' >/dev/null`;
|
||||
const r = spawnSync('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=20', remote.host, script], { input: `Authorization: ${auth()}\n`, encoding: 'utf8', timeout: 1_900_000 });
|
||||
if (r.status !== 0) fail(`upload ${name} (from ${remote.host}): exit ${r.status}: ${(r.stdout + r.stderr).slice(0, 300)}`);
|
||||
return;
|
||||
}
|
||||
const size = file ? statSync(file).size : Buffer.byteLength(data ?? '');
|
||||
if (!ip) {
|
||||
if (size > PROXY_BODY_LIMIT) fail(`${name} is ${(size / 1e6).toFixed(0)} MB: over Cloudflare's 100 MB limit; set FORGEJO_ORIGIN (the server's IP) or ~/.storebound-keys/forgejo-origin`);
|
||||
|
|
@ -199,7 +233,7 @@ async function uploadAsset(releaseId: number, name: string, file: string | null,
|
|||
|
||||
const sha256 = (file: string) => createHash('sha256').update(readFileSync(file)).digest('hex');
|
||||
|
||||
export interface UpsertOptions { tag: string; title?: string; notes?: string; target?: string; draft?: boolean; create?: boolean; files: string[]; yes: boolean }
|
||||
export interface UpsertOptions { tag: string; title?: string; notes?: string; target?: string; draft?: boolean; prerelease?: boolean; create?: boolean; files: string[]; yes: boolean; remote?: RemoteFiles; quiet?: boolean }
|
||||
|
||||
/** Create or update the release of a tag and attach files (same name = replaced), SHA256SUMS merged. */
|
||||
export async function upsert(o: UpsertOptions): Promise<Release | null> {
|
||||
|
|
@ -216,13 +250,13 @@ export async function upsert(o: UpsertOptions): Promise<Release | null> {
|
|||
const big = files.filter(f => statSync(f).size > PROXY_BODY_LIMIT);
|
||||
if (big.length && !origin()) fail(`${big.map(f => basename(f)).join(', ')} over 100 MB: Cloudflare refuses them; set FORGEJO_ORIGIN (the server's IP) or ~/.storebound-keys/forgejo-origin`);
|
||||
if (!rel && o.create === false) fail(`no release for ${o.tag} yet: push the tag first, the release workflow creates it`);
|
||||
const fields = { name: o.title, body: o.notes, draft: o.draft ?? false, prerelease: false };
|
||||
const fields = { name: o.title, body: o.notes, draft: o.draft ?? false, prerelease: o.prerelease };
|
||||
if (rel) rel = await api<Release>('PATCH', `/releases/${rel.id}`, Object.fromEntries(Object.entries(fields).filter(([, v]) => v !== undefined)));
|
||||
else rel = await api<Release>('POST', '/releases', { tag_name: o.tag, target_commitish: o.target, ...fields, name: o.title ?? o.tag });
|
||||
else rel = await api<Release>('POST', '/releases', { tag_name: o.tag, target_commitish: o.target, ...fields, prerelease: o.prerelease ?? false, name: o.title ?? o.tag });
|
||||
const upload = async (name: string, file: string | null, data: string | null) => {
|
||||
const old = rel!.assets.find(a => a.name === name);
|
||||
if (old) await api('DELETE', `/releases/${rel!.id}/assets/${old.id}`);
|
||||
await uploadAsset(rel!.id, name, file, data);
|
||||
await uploadAsset(rel!.id, name, file, data, o.remote);
|
||||
console.log(` uploaded ${name}`);
|
||||
};
|
||||
for (const f of files) await upload(basename(f), f, null);
|
||||
|
|
@ -251,13 +285,14 @@ async function prune(keep: string, yes: boolean): Promise<void> {
|
|||
}
|
||||
|
||||
async function deleteTag(tag: string): Promise<void> {
|
||||
if (isCandidateTag(tag)) return; // a candidate draft never made a tag
|
||||
if (!isTestTag(tag)) fail(`refusing to delete tag ${tag}: only test-* tags of dry runs`);
|
||||
const res = await fetch(`${API}/tags/${encodeURIComponent(tag)}`, { method: 'DELETE', headers: { Authorization: auth() } });
|
||||
if (res.status !== 204 && res.status !== 404) fail(`DELETE tag ${tag}: ${res.status}`);
|
||||
}
|
||||
|
||||
async function deleteTest(tag: string, yes: boolean): Promise<void> {
|
||||
if (!isTestTag(tag)) fail(`delete is for dry-run drafts (test-<sha>), not ${tag}`);
|
||||
export async function deleteTest(tag: string, yes: boolean): Promise<void> {
|
||||
if (!isTestTag(tag) && !isCandidateTag(tag)) fail(`delete is for dry-run drafts (test-<sha>), rehearsals (v0.0.0-rehearsal.<n>) and candidates (rc-<sha>), not ${tag}`);
|
||||
const rel = (await listReleases()).find(r => r.tag_name === tag);
|
||||
console.log(rel ? `delete draft release ${tag} (${rel.assets.length} assets) and the tag if any` : `no release ${tag}; delete the tag if any`);
|
||||
if (!yes) { console.log('dry run: nothing deleted (--yes to delete)'); return; }
|
||||
|
|
|
|||
285
tools/release-candidate.ts
Normal file
285
tools/release-candidate.ts
Normal file
|
|
@ -0,0 +1,285 @@
|
|||
#!/usr/bin/env bun
|
||||
// Release candidates: every push to main is one. ci.yml runs the full CI, the acceptance matrix (Linux + Windows x
|
||||
// Node 20 / Node 22 / Bun) and the Linux / Windows installer builds with their self-tests and privacy scans; its
|
||||
// record job stores the result per commit as a DRAFT release `rc-<full sha>` on git.crt.fyi: the installers,
|
||||
// SHA256SUMS, the six acceptance run files, the matrix and green.json (uploaded last: a candidate without green.json
|
||||
// is incomplete). A `v*` tag then only promotes (release.yml): no rebuild, no retest.
|
||||
//
|
||||
// bun tools/release-candidate.ts gate --sha <sha> [--wait <min>]
|
||||
// ci.yml's first job. When the commit differs from its parent only in version copies (tools/desktop-version.ts:
|
||||
// each changed copy must be exactly the parent's text with the new version written in), CHANGELOG.md and
|
||||
// docs/acceptance/*.json, and the parent is a green candidate, the full CI and the acceptance matrix of the parent
|
||||
// count for this commit (reuse=true; the parent's run is waited for while it is still running). Only the
|
||||
// installers, whose embedded version changes, are built again. Otherwise reuse=false: everything runs.
|
||||
// bun tools/release-candidate.ts record --sha <sha> --run <url> --dir <dir> [--reused-from <sha>] [--yes]
|
||||
// The record job: <dir> holds the installers and acceptance/*.json (with --reused-from, the parent's acceptance
|
||||
// files are fetched from its candidate). Writes green.json and uploads everything to the draft rc-<sha>.
|
||||
// bun tools/release-candidate.ts status --sha <sha> [--json]
|
||||
// green (with the record), red (with the failed run's link), pending or none.
|
||||
// bun tools/release-candidate.ts wait --sha <sha> [--timeout <min>]
|
||||
// Waits for green (heartbeat every 30 s); exits 1 at once when the commit is red or has no ci run.
|
||||
// bun tools/release-candidate.ts fetch --sha <sha> --dir <dir> [--only <regex>]
|
||||
// Downloads a green candidate's files (checked against its SHA256SUMS).
|
||||
// bun tools/release-candidate.ts promote --tag v<version> --sha <sha> [--wait <min>] [--yes]
|
||||
// release.yml: waits for the tagged commit's green candidate (fails fast when it is red or missing, with the
|
||||
// link), checks its version against the tag, and makes the release of the tag from the candidate's files
|
||||
// (tools/forgejo-release.ts upsert; a prerelease for versions with a "-", which is never pruned and never
|
||||
// prunes). Then the older release entries are deleted (stable versions only).
|
||||
// bun tools/release-candidate.ts prune [--keep <n>] [--yes]
|
||||
// Deletes candidate drafts except the newest n (default 12).
|
||||
//
|
||||
// Token: FORGEJO_TOKEN (ci.yml / release.yml: the RELEASE_TOKEN secret) or the git credential helper (on the Mac).
|
||||
import { spawnSync } from 'node:child_process';
|
||||
import { createHash } from 'node:crypto';
|
||||
import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
|
||||
import { basename, join, resolve } from 'node:path';
|
||||
import { cliKey } from './cli-key';
|
||||
import { COPIES, SEMVER } from './desktop-version';
|
||||
import { api, BASE, candidateTag, deleteTest, downloadAsset, isCandidateTag, listReleases, type Release, REPO, shortNotes, SUMS, upsert } from './forgejo-release';
|
||||
|
||||
const ROOT = resolve(import.meta.dir, '..');
|
||||
export const GREEN = 'green.json';
|
||||
const HEARTBEAT_MS = 30_000;
|
||||
|
||||
export interface GreenRecord {
|
||||
schema: 1;
|
||||
sha: string;
|
||||
version: string;
|
||||
cliKey: string;
|
||||
run: string;
|
||||
at: string;
|
||||
/** the parent whose full CI and acceptance matrix count for this version-only commit */
|
||||
reusedFrom?: { sha: string; run: string };
|
||||
files: Record<string, string>;
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------------------------------------------------
|
||||
// Pure parts (tests/release-candidate.test.ts)
|
||||
|
||||
export interface Change { file: string; status: 'A' | 'M' | 'D' | string; before: string | null; after: string | null }
|
||||
|
||||
/** Files a version-only commit may touch besides the version copies: the changelog and the macOS acceptance results. */
|
||||
const FREE = [/^CHANGELOG\.md$/, /^docs\/acceptance\.md$/, /^docs\/acceptance\/[A-Za-z0-9_-]+\.json$/];
|
||||
|
||||
/**
|
||||
* Why a commit is not a version-only change of its parent (empty = it is). Strict: every changed file is on the
|
||||
* allow-list, and every version copy is byte for byte the parent's text with the new version written in by the very
|
||||
* writer tools/desktop-version.ts uses (so no other line of package.json, Cargo.toml, ... can change).
|
||||
*/
|
||||
export function versionOnlyProblems(changes: Change[]): { from: string | null; to: string | null; problems: string[] } {
|
||||
const problems: string[] = [];
|
||||
const pkg = changes.find(c => c.file === 'package.json');
|
||||
const read = (t: string | null) => (t ? COPIES[0]!.read(t) : null);
|
||||
const from = read(pkg?.before ?? null);
|
||||
const to = read(pkg?.after ?? null);
|
||||
if (!pkg || !from || !to || from === to) problems.push('package.json: the version does not change');
|
||||
else if (!SEMVER.test(to)) problems.push(`package.json: ${to} is not a version`);
|
||||
for (const c of changes) {
|
||||
if (FREE.some(re => re.test(c.file))) continue;
|
||||
const copy = COPIES.find(x => x.file === c.file);
|
||||
if (!copy) { problems.push(`${c.file}: not a version copy (${c.status})`); continue; }
|
||||
if (c.status !== 'M' || c.before === null || c.after === null) { problems.push(`${c.file}: ${c.status}, not modified in place`); continue; }
|
||||
if (!to || copy.read(c.before) !== from || copy.write(c.before, to) !== c.after) problems.push(`${c.file}: changes more than the version`);
|
||||
}
|
||||
return { from, to, problems };
|
||||
}
|
||||
|
||||
export type Status =
|
||||
| { state: 'green'; record: GreenRecord; release: Release }
|
||||
| { state: 'red'; run: string; failed: string[] }
|
||||
| { state: 'pending'; run: string; running: string[] }
|
||||
| { state: 'none' };
|
||||
|
||||
export interface Task { id: number; name: string; run_number: number; workflow_id: string; head_sha: string; status: string }
|
||||
|
||||
/** The state of a commit from its ci.yml jobs (the newest run of that commit) and whether its record exists. Pure. */
|
||||
export function taskState(tasks: Task[], sha: string, runUrl: (n: number) => string): Exclude<Status, { state: 'green' }> {
|
||||
const mine = tasks.filter(t => t.head_sha === sha && t.workflow_id === 'ci.yml');
|
||||
if (!mine.length) return { state: 'none' };
|
||||
const latest = Math.max(...mine.map(t => t.run_number));
|
||||
const jobs = mine.filter(t => t.run_number === latest);
|
||||
const failed = jobs.filter(t => ['failure', 'cancelled'].includes(t.status)).map(t => t.name);
|
||||
if (failed.length) return { state: 'red', run: runUrl(latest), failed };
|
||||
const running = jobs.filter(t => !['success', 'skipped'].includes(t.status)).map(t => `${t.name} (${t.status})`);
|
||||
// every job done and green but no green.json yet: the record job is still uploading, or ran in an older run
|
||||
return { state: 'pending', run: runUrl(latest), running };
|
||||
}
|
||||
|
||||
/** The version of a tag (v0.8.5 -> 0.8.5), else null. */
|
||||
export const tagVersion = (tag: string): string | null => (/^v(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/.exec(tag)?.[1] ?? null);
|
||||
/** Versions with a pre-release part (0.0.0-rehearsal.1) are prereleases: never the stable release, never pruning. */
|
||||
export const isPrerelease = (version: string): boolean => version.includes('-');
|
||||
|
||||
// ---------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
function fail(msg: string): never { console.error(`release-candidate: ${msg}`); process.exit(1); }
|
||||
const t0 = Date.now();
|
||||
const say = (m: string) => console.log(`[${String(Math.round((Date.now() - t0) / 1000)).padStart(4)}s] ${m}`);
|
||||
const sha256 = (f: string) => createHash('sha256').update(readFileSync(f)).digest('hex');
|
||||
const runUrl = (n: number) => `${BASE}/${REPO}/actions/runs/${n}`;
|
||||
|
||||
function git(args: string[], allowFail = false): string {
|
||||
const r = spawnSync('git', args, { cwd: ROOT, encoding: 'utf8', maxBuffer: 64 << 20 });
|
||||
if (r.status !== 0 && !allowFail) fail(`git ${args.join(' ')}: ${r.stderr.trim()}`);
|
||||
return r.status === 0 ? r.stdout : '';
|
||||
}
|
||||
|
||||
export function changesBetween(base: string, head: string): Change[] {
|
||||
const out = git(['diff', '--name-status', '--no-renames', base, head]).trim();
|
||||
if (!out) return [];
|
||||
return out.split('\n').map(l => {
|
||||
const [status, file] = l.split('\t') as [string, string];
|
||||
const show = (rev: string) => { const r = spawnSync('git', ['show', `${rev}:${file}`], { cwd: ROOT, encoding: 'utf8', maxBuffer: 64 << 20 }); return r.status === 0 ? r.stdout : null; };
|
||||
return { file, status, before: status === 'A' ? null : show(base), after: status === 'D' ? null : show(head) };
|
||||
});
|
||||
}
|
||||
|
||||
async function tasks(): Promise<Task[]> {
|
||||
const all: Task[] = [];
|
||||
for (let page = 1; page <= 3; page++) {
|
||||
const r = await api<{ workflow_runs?: Task[] }>('GET', `/actions/tasks?limit=50&page=${page}`);
|
||||
all.push(...(r.workflow_runs ?? []));
|
||||
if ((r.workflow_runs ?? []).length < 50) break;
|
||||
}
|
||||
return all;
|
||||
}
|
||||
|
||||
async function record(release: Release): Promise<GreenRecord | null> {
|
||||
const a = release.assets.find(x => x.name === GREEN);
|
||||
if (!a) return null;
|
||||
return JSON.parse(await api<string>('GET', a.browser_download_url, undefined, true)) as GreenRecord;
|
||||
}
|
||||
|
||||
export async function status(sha: string): Promise<Status> {
|
||||
const rel = (await listReleases()).find(r => r.tag_name === candidateTag(sha));
|
||||
const rec = rel ? await record(rel) : null;
|
||||
if (rel && rec) return { state: 'green', record: rec, release: rel };
|
||||
return taskState(await tasks(), sha, runUrl);
|
||||
}
|
||||
|
||||
/** Waits for a commit's candidate: green returns, red and none (after `graceMin`) fail at once. */
|
||||
export async function waitGreen(sha: string, timeoutMin: number, graceMin = 3): Promise<Extract<Status, { state: 'green' }>> {
|
||||
const end = Date.now() + timeoutMin * 60_000;
|
||||
let last = 0;
|
||||
for (;;) {
|
||||
const s = await status(sha);
|
||||
if (s.state === 'green') { say(`candidate ${sha.slice(0, 10)} is green (run ${s.record.run}${s.record.reusedFrom ? `, CI and acceptance of ${s.record.reusedFrom.sha.slice(0, 10)}` : ''})`); return s; }
|
||||
if (s.state === 'red') fail(`commit ${sha.slice(0, 10)} is red: ${s.failed.join(', ')} failed in ${s.run}. Fix it and push; nothing is released from a red commit.`);
|
||||
if (s.state === 'none' && Date.now() - t0 > graceMin * 60_000) fail(`commit ${sha.slice(0, 10)} has no ci run on ${BASE}/${REPO}/actions: push it to main (ci.yml makes the candidate)`);
|
||||
if (Date.now() > end) fail(`timeout after ${timeoutMin} min waiting for the candidate of ${sha.slice(0, 10)}${s.state === 'pending' ? `: ${s.run} still has ${s.running.join(', ') || 'the record upload'}` : ''}`);
|
||||
if (Date.now() - last >= HEARTBEAT_MS) { last = Date.now(); say(`waiting for candidate ${sha.slice(0, 10)}: ${s.state === 'pending' ? `${s.run}: ${s.running.join(', ') || 'record upload'}` : 'no run yet'}`); }
|
||||
await Bun.sleep(10_000);
|
||||
}
|
||||
}
|
||||
|
||||
/** Download a green candidate's files (green.json excluded), each checked against its SHA256SUMS. */
|
||||
export async function fetchCandidate(s: Extract<Status, { state: 'green' }>, dir: string, only?: RegExp): Promise<string[]> {
|
||||
mkdirSync(dir, { recursive: true });
|
||||
const got: string[] = [];
|
||||
const assets = s.release.assets.filter(a => a.name !== GREEN && a.name !== SUMS && (!only || only.test(a.name)));
|
||||
await Promise.all(assets.map(async a => {
|
||||
const dest = join(dir, a.name);
|
||||
if (existsSync(dest) && s.record.files[a.name] && sha256(dest) === s.record.files[a.name]) { got.push(dest); return; }
|
||||
await downloadAsset(a.browser_download_url, dest);
|
||||
const want = s.record.files[a.name];
|
||||
if (want && sha256(dest) !== want) fail(`${a.name}: SHA-256 differs from the candidate's record`);
|
||||
got.push(dest);
|
||||
}));
|
||||
return got.sort();
|
||||
}
|
||||
|
||||
function output(values: Record<string, string>): void {
|
||||
for (const [k, v] of Object.entries(values)) console.log(`${k}=${v}`);
|
||||
const f = process.env.GITHUB_OUTPUT;
|
||||
if (f) appendFileSync(f, Object.entries(values).map(([k, v]) => `${k}=${v}\n`).join(''));
|
||||
}
|
||||
|
||||
async function gate(sha: string, waitMin: number): Promise<void> {
|
||||
const parent = git(['rev-parse', `${sha}^`], true).trim();
|
||||
if (!parent) { output({ reuse: 'false', from: '' }); say('no parent in this checkout (fetch-depth 2): everything runs'); return; }
|
||||
const { from, to, problems } = versionOnlyProblems(changesBetween(parent, sha));
|
||||
if (problems.length) { say(`not a version-only commit: ${problems.slice(0, 5).join('; ')}${problems.length > 5 ? ' ...' : ''}: everything runs`); output({ reuse: 'false', from: '' }); return; }
|
||||
say(`version-only commit: ${from} -> ${to} (every copy exactly re-written, plus changelog / acceptance files); the parent ${parent.slice(0, 10)}'s CI and acceptance matrix count if it is green`);
|
||||
const first = await status(parent);
|
||||
if (first.state === 'none') { say(`the parent has no ci run (pushed together with this commit?): everything runs`); output({ reuse: 'false', from: '' }); return; }
|
||||
const s = await waitGreen(parent, waitMin);
|
||||
if (s.record.cliKey !== cliKey(ROOT)) { say(`the parent's CLI key ${s.record.cliKey} is not this commit's: everything runs`); output({ reuse: 'false', from: '' }); return; }
|
||||
output({ reuse: 'true', from: parent });
|
||||
}
|
||||
|
||||
async function recordCmd(sha: string, run: string, dir: string, reusedFrom: string | undefined, yes: boolean): Promise<void> {
|
||||
const version = COPIES[0]!.read(readFileSync(join(ROOT, 'package.json'), 'utf8'))!;
|
||||
const acc = join(dir, 'acceptance');
|
||||
let reused: GreenRecord['reusedFrom'];
|
||||
if (reusedFrom) {
|
||||
const p = await status(reusedFrom);
|
||||
if (p.state !== 'green') fail(`--reused-from ${reusedFrom.slice(0, 10)} is ${p.state}, not green`);
|
||||
await fetchCandidate(p, acc, /^acceptance-.*\.json$/);
|
||||
reused = { sha: reusedFrom, run: p.record.run };
|
||||
}
|
||||
const files = readdirSync(dir, { recursive: true }).map(String).filter(f => statSync(join(dir, f)).isFile() && basename(f) !== SUMS && basename(f) !== GREEN);
|
||||
const flat = files.map(f => ({ path: join(dir, f), name: f.startsWith('acceptance/') && !basename(f).startsWith('acceptance-') ? `acceptance-${basename(f)}` : basename(f) }));
|
||||
const names = new Set<string>();
|
||||
for (const f of flat) { if (names.has(f.name)) fail(`two files named ${f.name}`); names.add(f.name); }
|
||||
for (const f of flat) if (!f.name.startsWith('acceptance-') && !f.name.includes(`_${version}_`)) fail(`${f.name} is not version ${version}`);
|
||||
const rec: GreenRecord = { schema: 1, sha, version, cliKey: cliKey(ROOT), run, at: new Date().toISOString(), reusedFrom: reused, files: Object.fromEntries(flat.map(f => [f.name, sha256(f.path)])) };
|
||||
// assets keep flat names: copy acceptance files under their asset name
|
||||
const stage = join(dir, '.stage');
|
||||
rmSync(stage, { recursive: true, force: true });
|
||||
mkdirSync(stage);
|
||||
const paths = flat.map(f => { const p = join(stage, f.name); writeFileSync(p, readFileSync(f.path)); return p; });
|
||||
const tag = candidateTag(sha);
|
||||
await upsert({ tag, target: sha, title: `candidate ${sha.slice(0, 10)} (${version})`, notes: `Release candidate of ${sha} (${version}): ${run}${reused ? `; CI and acceptance matrix of ${reused.sha} (version-only parent): ${reused.run}` : ''}. Promoted by a v${version} tag (release.yml); deleted by \`release-candidate.ts prune\`.`, draft: true, files: paths, yes });
|
||||
if (!yes) return;
|
||||
// green.json last: a candidate is complete only with it
|
||||
writeFileSync(join(stage, GREEN), `${JSON.stringify(rec, null, 2)}\n`);
|
||||
await upsert({ tag, draft: true, files: [join(stage, GREEN)], yes: true });
|
||||
say(`candidate ${tag} recorded: ${flat.length} files${reused ? `, CI + acceptance reused from ${reused.sha.slice(0, 10)}` : ''}`);
|
||||
}
|
||||
|
||||
async function promote(tag: string, sha: string, waitMin: number, yes: boolean): Promise<void> {
|
||||
const version = tagVersion(tag) ?? fail(`${tag} is not v<version>`);
|
||||
const s = await waitGreen(sha, waitMin);
|
||||
if (s.record.version !== version) fail(`the candidate of ${sha.slice(0, 10)} is version ${s.record.version}, the tag says ${version}`);
|
||||
const pre = isPrerelease(version);
|
||||
const dir = join(ROOT, '.promote');
|
||||
rmSync(dir, { recursive: true, force: true });
|
||||
const files = await fetchCandidate(s, dir, /^(?!acceptance-).+/);
|
||||
say(`fetched ${files.length} files of the candidate (${files.map(f => basename(f)).join(', ')})`);
|
||||
const notes = shortNotes(readFileSync(join(ROOT, 'CHANGELOG.md'), 'utf8'), version, { tag });
|
||||
const pick = (re: RegExp) => files.filter(f => re.test(basename(f)));
|
||||
const ship = [...pick(/\.(AppImage|deb|exe)$/), ...pick(/_acceptance\.md$/)];
|
||||
if (!pick(/\.AppImage$/).length || !pick(/\.deb$/).length || !pick(/\.exe$/).length) fail('the candidate lacks the AppImage, the deb or the Windows installer');
|
||||
await upsert({ tag, target: sha, title: pre ? `storebound ${version} (prerelease)` : `storebound ${version}`, notes, prerelease: pre, files: ship, yes });
|
||||
if (!yes) { say('dry run: nothing released (--yes)'); return; }
|
||||
say(`released ${tag} from candidate ${sha.slice(0, 10)}: ${BASE}/${REPO}/releases/tag/${tag}`);
|
||||
}
|
||||
|
||||
async function prune(keep: number, yes: boolean): Promise<void> {
|
||||
const rcs = (await listReleases()).filter(r => isCandidateTag(r.tag_name)).sort((a, b) => b.id - a.id);
|
||||
const drop = rcs.slice(keep);
|
||||
say(`${rcs.length} candidates; deleting ${drop.length} older than the newest ${keep}`);
|
||||
for (const r of drop) await deleteTest(r.tag_name, yes);
|
||||
}
|
||||
|
||||
function args(argv: string[]) {
|
||||
const get = (n: string) => { const i = argv.indexOf(`--${n}`); return i >= 0 ? argv[i + 1] : undefined; };
|
||||
return { get, has: (n: string) => argv.includes(`--${n}`) };
|
||||
}
|
||||
|
||||
if (import.meta.main) {
|
||||
const [cmd, ...argv] = process.argv.slice(2);
|
||||
const a = args(argv);
|
||||
const sha = () => { const s = a.get('sha') ?? fail('--sha <full commit sha>'); if (!/^[0-9a-f]{40}$/.test(s)) fail('--sha: a full 40-character sha'); return s; };
|
||||
if (cmd === 'gate') await gate(sha(), Number(a.get('wait') ?? 40));
|
||||
else if (cmd === 'record') await recordCmd(sha(), a.get('run') ?? fail('--run <url>'), resolve(a.get('dir') ?? fail('--dir <dir>')), a.get('reused-from') || undefined, a.has('yes'));
|
||||
else if (cmd === 'status') {
|
||||
const s = await status(sha());
|
||||
if (a.has('json')) console.log(JSON.stringify(s.state === 'green' ? { state: s.state, record: s.record } : s));
|
||||
else console.log(s.state === 'green' ? `green: ${s.record.run}` : s.state === 'none' ? 'none' : `${s.state}: ${s.run} ${'failed' in s ? s.failed.join(', ') : s.running.join(', ')}`);
|
||||
} else if (cmd === 'wait') await waitGreen(sha(), Number(a.get('timeout') ?? 40));
|
||||
else if (cmd === 'fetch') { const s = await waitGreen(sha(), 1); const only = a.get('only'); for (const f of await fetchCandidate(s, resolve(a.get('dir') ?? fail('--dir')), only ? new RegExp(only) : undefined)) console.log(f); }
|
||||
else if (cmd === 'promote') await promote(a.get('tag') ?? fail('--tag v<version>'), sha(), Number(a.get('wait') ?? 40), a.has('yes'));
|
||||
else if (cmd === 'prune') await prune(Number(a.get('keep') ?? 12), a.has('yes'));
|
||||
else { console.log(readFileSync(import.meta.path, 'utf8').split('\n').filter(l => l.startsWith('//')).map(l => l.slice(3)).join('\n')); process.exit(cmd ? 2 : 0); }
|
||||
}
|
||||
361
tools/release.ts
Normal file
361
tools/release.ts
Normal file
|
|
@ -0,0 +1,361 @@
|
|||
#!/usr/bin/env bun
|
||||
// One command for a whole storebound release on the owner's Mac (docs/desktop-release.md, "The release in one
|
||||
// command"). Everything but `npm publish` (the owner's step; the commands are printed at the end):
|
||||
//
|
||||
// bun tools/release.ts <version> [--yes] e.g. bun tools/release.ts 0.8.5 --yes
|
||||
// bun tools/release.ts --rehearsal [<n>] [--yes] the same end to end as version 0.0.0-rehearsal.<n> on the branch
|
||||
// rehearsal/<n>: a prerelease on git.crt.fyi and the rehearsal
|
||||
// channel of storebound.dev (no app reads it), never npm and never
|
||||
// /Applications; everything it made is deleted at the end
|
||||
// bun tools/release.ts mac-acceptance the macOS acceptance runs for this checkout's CLI key (cached)
|
||||
//
|
||||
// Without --yes: the checks and the plan only. With --yes, in order:
|
||||
// 1. preflight: a clean checkout of origin/main whose candidate is green or still running (tools/release-candidate.ts),
|
||||
// the updater key, the publish host; the macOS acceptance matrix starts in the background unless its results for
|
||||
// this CLI key are cached (~/.storebound-releases/acceptance-cache/<key>/; a version bump keeps the key);
|
||||
// 2. the version in package.json and every copy, the CHANGELOG's Unreleased section cut as "## <version> · <date>";
|
||||
// 3. the fast gate (bun run ci:quick), the commit (as CRT), push to main, push the tag v<version>;
|
||||
// 4. at once, in parallel: the Mac build (tools/desktop-release.ts mac: universal app, sign, notarize app and DMG,
|
||||
// every check), Forgejo's ci run of the bump commit (version-only: the installers only, the parent's CI and
|
||||
// matrix count) and the promotion of the tag (release.yml); this waits for the candidate (heartbeat, timeout)
|
||||
// and downloads its Linux / Windows installers while the Mac builds;
|
||||
// 5. add (updater signatures of the Linux / Windows files), the full acceptance matrix (9 runs), verify;
|
||||
// 6. publish: the VDS fetches the Linux / Windows files from Forgejo itself, rsync sends only the Mac's files,
|
||||
// the VDS attaches them to the Forgejo release from its copy, then storebound.dev's latest.json;
|
||||
// 7. /Applications/storebound.app: the running app is quit (gracefully, then its exact PID), the new one copied
|
||||
// from the DMG, reopened in the background;
|
||||
// 8. prints `npm publish` and `npm deprecate`, and the time of every phase (also in
|
||||
// ~/.storebound-releases/timings/).
|
||||
// Every wait has a timeout and a heartbeat; child processes are killed by PID when this exits.
|
||||
import { type ChildProcess, spawn, spawnSync } from 'node:child_process';
|
||||
import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
|
||||
import { homedir, tmpdir } from 'node:os';
|
||||
import { join, resolve } from 'node:path';
|
||||
import { cliKey } from './cli-key';
|
||||
import { remoteSessionReason } from './desktop-release';
|
||||
import { COPIES, SEMVER, setVersion } from './desktop-version';
|
||||
import { candidateTag, deleteTest, listReleases, upsert } from './forgejo-release';
|
||||
import { fetchCandidate, status, waitGreen } from './release-candidate';
|
||||
|
||||
const ROOT = resolve(import.meta.dir, '..');
|
||||
const HOME = homedir();
|
||||
const RELEASES = join(HOME, '.storebound-releases');
|
||||
const KEYS = process.env.STOREBOUND_KEYS_DIR ?? join(HOME, '.storebound-keys');
|
||||
const ACC_CACHE = join(RELEASES, 'acceptance-cache');
|
||||
const APP_ID = 'dev.storebound.desktop';
|
||||
const HEARTBEAT_MS = 30_000;
|
||||
|
||||
// ---------------------------------------------------------------------------------------------------------------------
|
||||
// Pure parts (tests/release.test.ts)
|
||||
|
||||
/** The CHANGELOG with its Unreleased section turned into the version's section and a new empty Unreleased on top. */
|
||||
export function cutChangelog(text: string, version: string, date: string): string {
|
||||
const lines = text.split('\n');
|
||||
const i = lines.findIndex(l => /^## Unreleased\s*$/.test(l));
|
||||
if (i < 0) throw new Error('CHANGELOG.md has no "## Unreleased" section');
|
||||
const next = lines.findIndex((l, j) => j > i && l.startsWith('## '));
|
||||
const body = lines.slice(i + 1, next < 0 ? lines.length : next).join('\n').trim();
|
||||
if (!body) throw new Error('the Unreleased section of CHANGELOG.md is empty: write the release summary first');
|
||||
if (lines.some(l => l.startsWith('## ') && l.slice(3).trim().split(/\s/)[0] === version)) throw new Error(`CHANGELOG.md already has a section for ${version}`);
|
||||
return [...lines.slice(0, i), '## Unreleased', '', `## ${version} · ${date}`, ...lines.slice(i + 1)].join('\n');
|
||||
}
|
||||
|
||||
/** a > b for x.y.z versions (pre-release parts lower than the plain version). */
|
||||
export function newer(a: string, b: string): boolean {
|
||||
const p = (v: string) => { const [core, pre] = v.split('-', 2); return { n: core!.split('.').map(Number), pre: pre ?? null }; };
|
||||
const x = p(a); const y = p(b);
|
||||
for (let i = 0; i < 3; i++) if (x.n[i] !== y.n[i]) return x.n[i]! > y.n[i]!;
|
||||
if (x.pre === y.pre) return false;
|
||||
if (x.pre === null) return true;
|
||||
if (y.pre === null) return false;
|
||||
return x.pre > y.pre;
|
||||
}
|
||||
|
||||
export interface Phase { name: string; start: number; end?: number }
|
||||
|
||||
/** The timing table: each phase's start offset and duration, the critical path is the total. */
|
||||
export function timingTable(phases: Phase[], t0: number): string {
|
||||
const f = (ms: number) => { const s = Math.round(ms / 1000); return `${Math.floor(s / 60)}:${String(s % 60).padStart(2, '0')}`; };
|
||||
const rows = phases.map(p => ` ${p.name.padEnd(46)} start +${f(p.start - t0).padStart(5)} took ${p.end ? f(p.end - p.start).padStart(5) : ' open'}`);
|
||||
const end = Math.max(...phases.map(p => p.end ?? p.start));
|
||||
return [...rows, ` ${'total (tag push to everything published)'.padEnd(46)} ${''.padStart(13)} ${f(end - t0).padStart(10)}`].join('\n');
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
const t0 = Date.now();
|
||||
const phases: Phase[] = [];
|
||||
const children = new Set<ChildProcess>();
|
||||
const say = (m: string) => console.log(`[${new Date().toISOString().slice(11, 19)} +${String(Math.round((Date.now() - t0) / 1000)).padStart(4)}s] ${m}`);
|
||||
function fail(msg: string): never {
|
||||
console.error(`\nrelease: ${msg}`);
|
||||
if (phases.length) console.error(`\n${timingTable(phases, t0)}`);
|
||||
process.exit(1);
|
||||
}
|
||||
process.on('exit', () => { for (const c of children) if (c.exitCode === null && c.pid) { try { process.kill(c.pid, 'SIGTERM'); } catch { /* gone */ } } });
|
||||
process.on('SIGINT', () => fail('interrupted'));
|
||||
|
||||
function phase<T>(name: string, fn: () => Promise<T>): Promise<T> {
|
||||
const p: Phase = { name, start: Date.now() };
|
||||
phases.push(p);
|
||||
say(`>> ${name}`);
|
||||
return fn().then(r => { p.end = Date.now(); say(`<< ${name} (${Math.round((p.end - p.start) / 1000)} s)`); return r; });
|
||||
}
|
||||
|
||||
function sh(cmd: string[], opts: { cwd?: string; allowFail?: boolean; env?: Record<string, string | undefined>; input?: string } = {}): string {
|
||||
const r = spawnSync(cmd[0]!, cmd.slice(1), { cwd: opts.cwd ?? ROOT, encoding: 'utf8', maxBuffer: 256 << 20, env: (opts.env ?? process.env) as NodeJS.ProcessEnv, input: opts.input });
|
||||
if (r.status !== 0 && !opts.allowFail) fail(`${cmd.slice(0, 3).join(' ')} failed (exit ${r.status}): ${(r.stderr || r.stdout).trim().split('\n').slice(-8).join('\n')}`);
|
||||
return r.status === 0 ? r.stdout : '';
|
||||
}
|
||||
|
||||
/** A child process with its output in a log file; resolves with the exit code. Heartbeat: the log's last line. */
|
||||
function bg(name: string, cmd: string[], log: string, opts: { env?: Record<string, string | undefined>; timeoutMs: number }): Promise<number> {
|
||||
mkdirSync(resolve(log, '..'), { recursive: true });
|
||||
const fd = Bun.file(log).writer();
|
||||
const c = spawn(cmd[0]!, cmd.slice(1), { cwd: ROOT, env: (opts.env ?? process.env) as NodeJS.ProcessEnv, stdio: ['ignore', 'pipe', 'pipe'] });
|
||||
children.add(c);
|
||||
let lastLine = '';
|
||||
const onData = (d: Buffer) => { fd.write(d); const t = d.toString().trim().split('\n').at(-1); if (t) lastLine = t; };
|
||||
c.stdout!.on('data', onData); c.stderr!.on('data', onData);
|
||||
const beat = setInterval(() => say(` ${name} (pid ${c.pid}): ${lastLine.slice(0, 150)}`), HEARTBEAT_MS);
|
||||
const timer = setTimeout(() => { say(`${name}: timeout after ${opts.timeoutMs / 60_000} min, killing pid ${c.pid}`); c.kill('SIGTERM'); }, opts.timeoutMs);
|
||||
return new Promise(res => c.on('close', code => { clearInterval(beat); clearTimeout(timer); children.delete(c); void fd.end(); res(code ?? 1); }));
|
||||
}
|
||||
|
||||
function publishHost(): string {
|
||||
const f = join(KEYS, 'publish-host');
|
||||
const h = process.env.STOREBOUND_PUBLISH_HOST ?? (existsSync(f) ? readFileSync(f, 'utf8').trim() : '');
|
||||
if (!/^[A-Za-z0-9._-]+@[A-Za-z0-9.-]+$/.test(h)) fail(`the publish host (user@host of the VDS) is not set: STOREBOUND_PUBLISH_HOST or ${f.replace(HOME, '~')}`);
|
||||
return h;
|
||||
}
|
||||
|
||||
/** Node binaries for the macOS acceptance runs: fnm's Node 20 and 22 (installed from nodejs.org once if missing). */
|
||||
function nodeBin(major: 20 | 22): string {
|
||||
const find = () => sh(['fnm', 'exec', `--using=${major}`, '--', 'node', '-p', 'process.execPath'], { allowFail: true }).trim();
|
||||
let p = find();
|
||||
if (!p) { say(`fnm install ${major} (Node ${major} for the macOS acceptance run)`); sh(['fnm', 'install', String(major)]); p = find(); }
|
||||
if (!p || !existsSync(p)) fail(`no Node ${major}: fnm install ${major}`);
|
||||
return p;
|
||||
}
|
||||
|
||||
const RUNTIMES = [
|
||||
{ file: 'macOS-bun.json', args: ['--runtime', 'bun'] },
|
||||
{ file: 'macOS-node20.json', args: ['--runtime', 'node', '--node', '@20'] },
|
||||
{ file: 'macOS-node22.json', args: ['--runtime', 'node', '--node', '@22'] },
|
||||
];
|
||||
|
||||
function cachedMacAcceptance(key: string): string | null {
|
||||
const dir = join(ACC_CACHE, key);
|
||||
const ok = RUNTIMES.every(r => {
|
||||
const f = join(dir, r.file);
|
||||
if (!existsSync(f)) return false;
|
||||
const run = JSON.parse(readFileSync(f, 'utf8')) as { cliKey?: string; quick?: boolean; results: { ok: boolean }[] };
|
||||
return run.cliKey === key && !run.quick && run.results.length > 0 && run.results.every(x => x.ok);
|
||||
});
|
||||
return ok ? dir : null;
|
||||
}
|
||||
|
||||
/** The macOS acceptance matrix for this checkout's CLI key: from the cache, else the three runs in parallel from one
|
||||
* packed tarball (parallel `npm pack` in one checkout would race on dist/). */
|
||||
async function macAcceptance(key: string, logDir: string): Promise<string> {
|
||||
const hit = cachedMacAcceptance(key);
|
||||
if (hit) { say(`macOS acceptance: cached for CLI key ${key.slice(0, 12)} (${hit.replace(HOME, '~')})`); return hit; }
|
||||
const dir = join(ACC_CACHE, key);
|
||||
mkdirSync(dir, { recursive: true });
|
||||
const packDir = mkdtempSync(join(tmpdir(), 'sb-pack-'));
|
||||
sh(['npm', 'pack', '--silent', '--pack-destination', packDir]);
|
||||
const tgz = join(packDir, readdirSync(packDir).find(f => f.endsWith('.tgz')) ?? fail('npm pack made no tarball'));
|
||||
const codes = await Promise.all(RUNTIMES.map(r => {
|
||||
const args = r.args.map(a => (a === '@20' ? nodeBin(20) : a === '@22' ? nodeBin(22) : a));
|
||||
return bg(`acceptance ${r.file}`, ['bun', 'tools/acceptance.ts', 'run', ...args, '--tgz', tgz, '--platform', 'macOS', '--jobs', '3', '--out', join(dir, r.file)], join(logDir, `acceptance-${r.file}.log`), { timeoutMs: 30 * 60_000 });
|
||||
}));
|
||||
rmSync(packDir, { recursive: true, force: true });
|
||||
if (codes.some(c => c !== 0)) fail(`macOS acceptance has red cells (logs in ${logDir.replace(HOME, '~')}); nothing is released`);
|
||||
if (!cachedMacAcceptance(key)) fail('macOS acceptance: results missing after the run');
|
||||
return dir;
|
||||
}
|
||||
|
||||
async function waitRelease(tag: string, timeoutMin: number): Promise<void> {
|
||||
const end = Date.now() + timeoutMin * 60_000;
|
||||
let last = 0;
|
||||
for (;;) {
|
||||
const rel = (await listReleases()).find(r => r.tag_name === tag);
|
||||
if (rel && !rel.draft && rel.assets.some(a => a.name.endsWith('.AppImage')) && rel.assets.some(a => a.name.endsWith('.exe'))) return;
|
||||
if (Date.now() > end) fail(`timeout after ${timeoutMin} min: release.yml has not released ${tag} (Actions > release on git.crt.fyi)`);
|
||||
if (Date.now() - last >= HEARTBEAT_MS) { last = Date.now(); say(` waiting for release.yml to release ${tag}${rel ? ` (${rel.assets.length} assets so far)` : ''}`); }
|
||||
await Bun.sleep(5_000);
|
||||
}
|
||||
}
|
||||
|
||||
/** Quit the running app (gracefully, then its exact PID), copy the new one from the DMG, reopen it in the
|
||||
* background. In a rehearsal the copy goes to a scratch folder and nothing is quit or opened. */
|
||||
function installApp(dmg: string, target: string, rehearsal: boolean): string {
|
||||
const pids = rehearsal ? [] : sh(['pgrep', '-f', `${target}/Contents/MacOS/storebound-desktop`], { allowFail: true }).trim().split('\n').filter(Boolean).map(Number);
|
||||
if (pids.length) {
|
||||
say(`quitting storebound (pid ${pids.join(', ')}) gracefully`);
|
||||
sh(['osascript', '-e', `tell application id "${APP_ID}" to quit`], { allowFail: true });
|
||||
const gone = (pid: number) => { try { process.kill(pid, 0); return false; } catch { return true; } };
|
||||
const until = Date.now() + 15_000;
|
||||
while (Date.now() < until && !pids.every(gone)) Bun.sleepSync(250);
|
||||
for (const pid of pids.filter(p => !gone(p))) { say(`pid ${pid} still running: SIGTERM`); try { process.kill(pid, 'SIGTERM'); } catch { /* gone */ } }
|
||||
const until2 = Date.now() + 5_000;
|
||||
while (Date.now() < until2 && !pids.every(gone)) Bun.sleepSync(250);
|
||||
for (const pid of pids.filter(p => !gone(p))) { say(`pid ${pid} still running: SIGKILL`); try { process.kill(pid, 'SIGKILL'); } catch { /* gone */ } }
|
||||
}
|
||||
const mnt = mkdtempSync(join(tmpdir(), 'sb-inst-'));
|
||||
sh(['hdiutil', 'attach', '-readonly', '-nobrowse', '-noautoopen', '-mountpoint', mnt, dmg]);
|
||||
try {
|
||||
mkdirSync(resolve(target, '..'), { recursive: true });
|
||||
const tmp = `${target}.new`;
|
||||
rmSync(tmp, { recursive: true, force: true });
|
||||
sh(['ditto', join(mnt, 'storebound.app'), tmp]);
|
||||
sh(['codesign', '--verify', '--deep', '--strict', tmp]);
|
||||
rmSync(target, { recursive: true, force: true });
|
||||
sh(['mv', tmp, target]);
|
||||
} finally { sh(['hdiutil', 'detach', mnt, '-force'], { allowFail: true }); rmSync(mnt, { recursive: true, force: true }); }
|
||||
const v = JSON.parse(sh(['plutil', '-convert', 'json', '-o', '-', join(target, 'Contents/Info.plist')])).CFBundleShortVersionString as string;
|
||||
if (pids.length) { sh(['open', '-g', target]); say(`reopened ${target} in the background`); }
|
||||
return v;
|
||||
}
|
||||
|
||||
async function main(): Promise<void> {
|
||||
const argv = process.argv.slice(2);
|
||||
const has = (f: string) => argv.includes(f);
|
||||
const yes = has('--yes');
|
||||
if (argv[0] === 'mac-acceptance') { const key = cliKey(ROOT); console.log(await macAcceptance(key, join(RELEASES, 'logs', `acceptance-${key}`))); return; }
|
||||
const rehearsal = has('--rehearsal');
|
||||
const positional = argv.filter(a => !a.startsWith('--'));
|
||||
const current = COPIES[0]!.read(readFileSync(join(ROOT, 'package.json'), 'utf8'))!;
|
||||
const n = rehearsal ? Number(positional[0] ?? Math.floor(Date.now() / 1000)) : 0;
|
||||
const version = rehearsal ? `0.0.0-rehearsal.${n}` : positional[0] ?? fail('usage: bun tools/release.ts <version> [--yes] | --rehearsal [<n>] [--yes]');
|
||||
if (!SEMVER.test(version)) fail(`${version} is not a version`);
|
||||
if (!rehearsal && !newer(version, current)) fail(`${version} is not newer than ${current}`);
|
||||
const tag = `v${version}`;
|
||||
const branch = rehearsal ? `rehearsal/${n}` : 'main';
|
||||
const out = join(RELEASES, 'desktop', version);
|
||||
const logDir = join(RELEASES, 'logs', version);
|
||||
const host = publishHost();
|
||||
|
||||
// ---------------------------------------------------------------- 1. preflight
|
||||
const remote = remoteSessionReason(process.env, sh(['launchctl', 'managername'], { allowFail: true }).trim());
|
||||
if (remote) fail(`${remote}: signing and notarization need the owner's logged-in macOS session`);
|
||||
if (!existsSync(join(KEYS, 'updater.key'))) fail(`no updater key in ${KEYS.replace(HOME, '~')}`);
|
||||
if (sh(['git', 'status', '--porcelain']).trim()) fail('the checkout has uncommitted changes');
|
||||
sh(['git', 'fetch', '--quiet', 'origin', 'main', '--tags']);
|
||||
const head = sh(['git', 'rev-parse', 'HEAD']).trim();
|
||||
if (head !== sh(['git', 'rev-parse', 'origin/main']).trim()) fail(`HEAD ${head.slice(0, 10)} is not origin/main: release from main as it is on git.crt.fyi (pull / push first), so the bump's parent is a candidate`);
|
||||
if (!rehearsal && sh(['git', 'rev-parse', '-q', '--verify', `refs/tags/${tag}`], { allowFail: true }).trim()) fail(`tag ${tag} exists already`);
|
||||
const parent = await status(head);
|
||||
if (parent.state === 'red') fail(`origin/main ${head.slice(0, 10)} is red (${parent.failed.join(', ')}): ${parent.run}`);
|
||||
if (parent.state === 'none') fail(`origin/main ${head.slice(0, 10)} has no ci run: its candidate is needed (push to main runs ci.yml)`);
|
||||
say(`storebound ${current} -> ${version}${rehearsal ? ' (rehearsal: prerelease, rehearsal channel, deleted at the end)' : ''}; parent ${head.slice(0, 10)} is ${parent.state}${parent.state === 'pending' ? ` (${parent.run})` : ''}`);
|
||||
// the release commit's author is the one of the commits already on main (the project's identity)
|
||||
const identity = sh(['git', 'log', '-1', '--format=%an <%ae>', 'origin/main']).trim();
|
||||
const key = cliKey(ROOT);
|
||||
const accCached = cachedMacAcceptance(key);
|
||||
console.log(`plan:
|
||||
bump ${current} -> ${version} (package.json + ${COPIES.length - 1} copies)${rehearsal ? '' : ', CHANGELOG Unreleased -> ' + version}; bun run ci:quick; commit as ${identity}
|
||||
push ${branch}, push ${tag}; then in parallel: Mac build + notarize -> ${out.replace(HOME, '~')}; macOS acceptance (${accCached ? 'cached' : 'runs now'}, key ${key.slice(0, 12)});
|
||||
Forgejo ci (candidate of the bump commit) + release.yml (promotion); add, verify, publish to ${rehearsal ? 'the rehearsal channel' : 'stable'} via ${host};
|
||||
${rehearsal ? 'app copied to a scratch folder; then the tag, release, candidates, branch and storebound.dev files of the rehearsal are deleted' : 'update /Applications/storebound.app; print npm publish + npm deprecate'}`);
|
||||
if (!yes) { console.log('\ndry run: nothing changed (--yes to release)'); return; }
|
||||
|
||||
const accP = phase('macOS acceptance (cache or 3 runs)', () => macAcceptance(key, logDir));
|
||||
accP.catch(() => undefined);
|
||||
|
||||
// ---------------------------------------------------------------- 2. + 3. bump, gate, commit, push
|
||||
const startBranch = sh(['git', 'rev-parse', '--abbrev-ref', 'HEAD']).trim();
|
||||
let sha = '';
|
||||
await phase('bump + fast gate + commit + push', async () => {
|
||||
if (rehearsal) sh(['git', 'checkout', '-q', '-b', branch]);
|
||||
setVersion(version);
|
||||
if (!rehearsal) writeFileSync(join(ROOT, 'CHANGELOG.md'), cutChangelog(readFileSync(join(ROOT, 'CHANGELOG.md'), 'utf8'), version, new Date().toISOString().slice(0, 10)));
|
||||
const code = await bg('ci:quick', ['bun', 'run', 'ci:quick'], join(logDir, 'ci-quick.log'), { timeoutMs: 15 * 60_000 });
|
||||
if (code !== 0) fail(`bun run ci:quick failed (${join(logDir, 'ci-quick.log').replace(HOME, '~')}); the bump is not committed (git checkout -- . to undo)`);
|
||||
const me = `${sh(['git', 'config', 'user.name']).trim()} <${sh(['git', 'config', 'user.email']).trim()}>`;
|
||||
if (me !== identity) fail(`git identity is ${me}; the commits on main are by ${identity} (git config user.name / user.email)`);
|
||||
sh(['git', 'add', '-A']);
|
||||
sh(['git', 'commit', '-q', '-m', rehearsal ? `release rehearsal ${version} (deleted after the run)` : `storebound ${version}: version in package.json and every copy, CHANGELOG ${version} section`]);
|
||||
sha = sh(['git', 'rev-parse', 'HEAD']).trim();
|
||||
sh(['git', 'push', '-q', 'origin', `HEAD:refs/heads/${branch}`]);
|
||||
sh(['git', 'tag', tag]);
|
||||
sh(['git', 'push', '-q', 'origin', `refs/tags/${tag}`]);
|
||||
say(`pushed ${sha.slice(0, 10)} to ${branch} and ${tag}`);
|
||||
});
|
||||
const tPush = Date.now();
|
||||
phases.push({ name: '== tag pushed: clock for "tag -> published" ==', start: tPush, end: tPush });
|
||||
|
||||
// ---------------------------------------------------------------- 4. in parallel
|
||||
rmSync(out, { recursive: true, force: true });
|
||||
const macP = phase('Mac build + sign + notarize (app, DMG)', async () => {
|
||||
const code = await bg('mac build', ['bun', 'tools/desktop-release.ts', 'mac', '--out', out], join(logDir, 'mac.log'), { timeoutMs: 60 * 60_000 });
|
||||
if (code !== 0) fail(`the Mac build failed: ${join(logDir, 'mac.log').replace(HOME, '~')}`);
|
||||
});
|
||||
const dl = join(RELEASES, 'candidates', sha);
|
||||
const candP = phase('Forgejo: candidate of the bump commit (installers)', async () => {
|
||||
const s = await waitGreen(sha, 45);
|
||||
return s;
|
||||
});
|
||||
const fetchP = candP.then(s => phase('download Linux / Windows installers + acceptance runs', () => fetchCandidate(s, dl)));
|
||||
const relP = candP.then(() => phase('Forgejo: release.yml promotes the tag', () => waitRelease(tag, 15)));
|
||||
await Promise.all([macP, fetchP, relP, accP]);
|
||||
const cand = await candP;
|
||||
|
||||
// ---------------------------------------------------------------- 5. add, acceptance matrix, verify
|
||||
await phase('add Linux / Windows + acceptance matrix + verify', async () => {
|
||||
const files = readdirSync(dl).filter(f => /\.(AppImage|deb|exe)$/.test(f)).map(f => join(dl, f));
|
||||
sh(['bun', 'tools/desktop-release.ts', 'add', '--out', out, '--commit', sha, '--run', cand.record.run, ...files]);
|
||||
const accDir = mkdtempSync(join(tmpdir(), 'sb-acc-'));
|
||||
for (const f of readdirSync(dl).filter(f => /^acceptance-.*\.json$/.test(f))) writeFileSync(join(accDir, f), readFileSync(join(dl, f)));
|
||||
const macDir = await accP;
|
||||
for (const r of RUNTIMES) writeFileSync(join(accDir, r.file), readFileSync(join(macDir, r.file)));
|
||||
const md = join(logDir, `storebound_${version}_acceptance.md`);
|
||||
sh(['bun', 'tools/acceptance.ts', 'report', accDir, '--md', md, '--expect', '9', '--strict']);
|
||||
rmSync(accDir, { recursive: true, force: true });
|
||||
sh(['bun', 'tools/desktop-release.ts', 'verify', '--out', out]);
|
||||
await upsert({ tag, files: [md], create: false, yes: true });
|
||||
});
|
||||
|
||||
// ---------------------------------------------------------------- 6. publish
|
||||
await phase('publish (VDS seeds from Forgejo, Mac files once, latest.json)', async () => {
|
||||
const code = await bg('publish', ['bun', 'tools/desktop-release.ts', 'publish', '--out', out, '--host', host, '--channel', rehearsal ? 'rehearsal' : 'stable', '--forgejo-tag', tag, '--yes'], join(logDir, 'publish.log'), { timeoutMs: 45 * 60_000 });
|
||||
if (code !== 0) fail(`publish failed: ${join(logDir, 'publish.log').replace(HOME, '~')}`);
|
||||
});
|
||||
const tPublished = Date.now();
|
||||
phases.push({ name: '== published ==', start: tPublished, end: tPublished });
|
||||
|
||||
// ---------------------------------------------------------------- 7. the app on this Mac
|
||||
const dmg = readdirSync(out).find(f => f.endsWith('.dmg')) ?? fail('no DMG');
|
||||
const target = rehearsal ? join(RELEASES, 'rehearsal-install', 'storebound.app') : '/Applications/storebound.app';
|
||||
const installed = await phase(`install ${target.replace(HOME, '~')}`, async () => installApp(join(out, dmg), target, rehearsal));
|
||||
say(`installed storebound ${installed} at ${target.replace(HOME, '~')}`);
|
||||
|
||||
// ---------------------------------------------------------------- 8. the end
|
||||
if (rehearsal) {
|
||||
await phase('rehearsal cleanup', async () => {
|
||||
await deleteTest(tag, true);
|
||||
for (const s of [sha]) await deleteTest(candidateTag(s), true);
|
||||
sh(['git', 'push', '-q', 'origin', '--delete', branch], { allowFail: true });
|
||||
sh(['git', 'checkout', '-q', startBranch === 'HEAD' ? head : startBranch]);
|
||||
sh(['git', 'branch', '-q', '-D', branch], { allowFail: true });
|
||||
sh(['git', 'tag', '-d', tag], { allowFail: true });
|
||||
if (!/^0\.0\.0-rehearsal\.\d+$/.test(version)) fail('cleanup: not a rehearsal version');
|
||||
sh(['ssh', '-o', 'BatchMode=yes', host, `rm -rf /var/www/storebound-desktop/dl/${version} /var/www/storebound-desktop/rehearsal/latest.json /var/lib/storebound-desktop/incoming/${version}`]);
|
||||
rmSync(out, { recursive: true, force: true });
|
||||
rmSync(dl, { recursive: true, force: true });
|
||||
rmSync(resolve(target, '..'), { recursive: true, force: true });
|
||||
});
|
||||
}
|
||||
const table = timingTable(phases, tPush);
|
||||
mkdirSync(join(RELEASES, 'timings'), { recursive: true });
|
||||
const tf = join(RELEASES, 'timings', `${version}-${new Date().toISOString().replace(/[:.]/g, '-')}.json`);
|
||||
writeFileSync(tf, `${JSON.stringify({ version, sha, tPush, tPublished, phases }, null, 2)}\n`);
|
||||
console.log(`\nstorebound ${version}: ${rehearsal ? 'rehearsal done and cleaned up' : 'released'}. Times (from the tag push):\n${table}\n start of this command to tag push: ${Math.round((tPush - t0) / 1000)} s; timings in ${tf.replace(HOME, '~')}`);
|
||||
if (!rehearsal) {
|
||||
console.log(`\nThe owner's step (npm), from this checkout at ${tag}:
|
||||
npm publish
|
||||
npm deprecate storebound@"<${version}" "storebound ${version} is out: npx storebound@${version}"`);
|
||||
}
|
||||
}
|
||||
|
||||
if (import.meta.main) await main();
|
||||
|
|
@ -5,6 +5,7 @@
|
|||
# document root, because the site's publish rsync deletes everything that is not in the repository.
|
||||
Alias /desktop/latest.json /var/www/storebound-desktop/latest.json
|
||||
Alias /desktop/beta/latest.json /var/www/storebound-desktop/beta/latest.json
|
||||
Alias /desktop/rehearsal/latest.json /var/www/storebound-desktop/rehearsal/latest.json
|
||||
Alias /desktop/dl/ /var/www/storebound-desktop/dl/
|
||||
<Directory /var/www/storebound-desktop>
|
||||
Options -Indexes -FollowSymLinks
|
||||
|
|
@ -15,7 +16,7 @@ Alias /desktop/dl/ /var/www/storebound-desktop/dl/
|
|||
Header set Content-Disposition "attachment"
|
||||
</FilesMatch>
|
||||
</Directory>
|
||||
<LocationMatch "^/desktop/(beta/)?latest\.json$">
|
||||
<LocationMatch "^/desktop/((beta|rehearsal)/)?latest\.json$">
|
||||
Header set Cache-Control "no-cache"
|
||||
Header set Access-Control-Allow-Origin "*"
|
||||
</LocationMatch>
|
||||
|
|
|
|||
|
|
@ -1,7 +1,8 @@
|
|||
#!/usr/bin/env bash
|
||||
# Root-owned publish step for storebound desktop releases (install as /usr/local/sbin/storebound-desktop-publish,
|
||||
# root:root 755; see docs/desktop-release.md). tools/desktop-release.ts publish uploads one version folder to
|
||||
# /var/lib/storebound-desktop/incoming/<version>/ and then runs: storebound-desktop-publish <version> [stable|beta]
|
||||
# /var/lib/storebound-desktop/incoming/<version>/ and then runs: storebound-desktop-publish <version> [stable|beta|rehearsal]
|
||||
# (rehearsal: tools/release.ts --rehearsal, a throwaway prerelease at /desktop/rehearsal/latest.json that no app reads)
|
||||
#
|
||||
# It checks the upload (regular files with plain names only, SHA256SUMS, latest.json of that version whose every URL
|
||||
# points at an uploaded file of /desktop/dl/<version>/), copies the files into /var/www/storebound-desktop/dl/<version>/
|
||||
|
|
@ -20,8 +21,10 @@ ROOT=/var/www/storebound-desktop
|
|||
SITE=https://storebound.dev/desktop
|
||||
|
||||
die() { echo "storebound-desktop-publish: $*" >&2; exit 1; }
|
||||
[[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?$ ]] || die "usage: storebound-desktop-publish <version> [stable|beta]"
|
||||
[[ "$CHANNEL" == stable || "$CHANNEL" == beta ]] || die "channel: stable or beta"
|
||||
[[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?$ ]] || die "usage: storebound-desktop-publish <version> [stable|beta|rehearsal]"
|
||||
[[ "$CHANNEL" == stable || "$CHANNEL" == beta || "$CHANNEL" == rehearsal ]] || die "channel: stable, beta or rehearsal"
|
||||
# a stable or beta version is never a rehearsal, and a rehearsal never reaches stable or beta
|
||||
if [[ "$VERSION" == *-rehearsal.* ]]; then [ "$CHANNEL" = rehearsal ] || die "a rehearsal version goes to the rehearsal channel only"; else [ "$CHANNEL" != rehearsal ] || die "the rehearsal channel takes rehearsal versions only"; fi
|
||||
IN="$INCOMING/$VERSION"
|
||||
DL="$ROOT/dl/$VERSION"
|
||||
[ -d "$IN" ] && [ ! -L "$IN" ] || die "nothing uploaded at $IN"
|
||||
|
|
@ -51,7 +54,7 @@ for e in entries:
|
|||
assert e.get("signature"), url
|
||||
PY
|
||||
|
||||
install -d -m 755 "$ROOT" "$ROOT/dl" "$ROOT/beta"
|
||||
install -d -m 755 "$ROOT" "$ROOT/dl" "$ROOT/beta" "$ROOT/rehearsal"
|
||||
if [ ! -e "$DL" ]; then
|
||||
TMP="$(mktemp -d "$ROOT/dl/.tmp-$VERSION.XXXXXX")"
|
||||
for f in "$IN"/*; do n="$(basename "$f")"; [ "$n" = latest.json ] || install -m 644 "$f" "$TMP/$n"; done
|
||||
|
|
@ -76,7 +79,7 @@ fi
|
|||
install -m 644 "$IN/latest.json" "$DL/.latest.json.tmp" && mv -f "$DL/.latest.json.tmp" "$DL/latest.json"
|
||||
|
||||
# latest.json last: installed apps see the new version only once every file it names is in place
|
||||
if [ "$CHANNEL" = stable ]; then LJ="$ROOT/latest.json"; URL="$SITE/latest.json"; else LJ="$ROOT/beta/latest.json"; URL="$SITE/beta/latest.json"; fi
|
||||
if [ "$CHANNEL" = stable ]; then LJ="$ROOT/latest.json"; URL="$SITE/latest.json"; else LJ="$ROOT/$CHANNEL/latest.json"; URL="$SITE/$CHANNEL/latest.json"; fi
|
||||
install -m 644 "$IN/latest.json" "$LJ.tmp"
|
||||
mv -f "$LJ.tmp" "$LJ"
|
||||
rm -rf "$IN"
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue