Publish complete signed module catalogs

tools/release/publish-release-catalog.sh

@@ -15,6 +15,7 @@ Options:
   --channel <name>           Catalog channel. Defaults to stable.
   --sequence <number>        Monotonic channel sequence. Defaults to UTC timestamp.
   --expires-days <days>      Catalog expiry window. Defaults to 90.
+  --profile <base|full>      Package composition to publish. Defaults to full.
   --catalog-signing-key <key-id=/path/private.pem>
                              Ed25519 private key. May be repeated for rotation.
   --core-root <path>         govoplan-core checkout. Defaults to ../govoplan-core.
@@ -46,6 +47,7 @@ VERSION=""
 CHANNEL="stable"
 SEQUENCE=""
 EXPIRES_DAYS="90"
+PROFILE="full"
 PUBLIC_BASE_URL="https://govoplan.add-ideas.de"
 REMOTE="origin"
 BRANCH=""
@@ -95,6 +97,11 @@ while [[ $# -gt 0 ]]; do
       EXPIRES_DAYS="$2"
       shift 2
       ;;
+    --profile)
+      [[ $# -ge 2 ]] || fail "missing value for $1"
+      PROFILE="$2"
+      shift 2
+      ;;
     --catalog-signing-key)
       [[ $# -ge 2 ]] || fail "missing value for $1"
       SIGNING_KEYS+=("$2")
@@ -166,14 +173,12 @@ done
 
 [[ -n "$VERSION" ]] || fail "--version is required"
 [[ "$VERSION" =~ ^[0-9]+[.][0-9]+[.][0-9]+$ ]] || fail "version must be x.y.z: $VERSION"
+[[ "$PROFILE" == "base" || "$PROFILE" == "full" ]] || fail "profile must be base or full: $PROFILE"
 [[ ${#SIGNING_KEYS[@]} -gt 0 ]] || fail "at least one --catalog-signing-key is required"
 [[ -d "$CORE_ROOT/.git" ]] || fail "not a govoplan-core git repo: $CORE_ROOT"
 [[ -d "$WEB_ROOT/.git" ]] || fail "not an addideas-govoplan-website git repo: $WEB_ROOT"
 command -v "$PYTHON" >/dev/null 2>&1 || fail "Python not found: $PYTHON"
-
-if [[ "$BUILD_WEB" -eq 1 ]]; then
-  command -v "$NPM_BIN" >/dev/null 2>&1 || fail "npm not found: $NPM_BIN"
-fi
+command -v "$NPM_BIN" >/dev/null 2>&1 || fail "npm not found: $NPM_BIN"
 
 if [[ -z "$BRANCH" ]]; then
   BRANCH="$(git -C "$WEB_ROOT" symbolic-ref --quiet --short HEAD || true)"
@@ -183,6 +188,10 @@ fi
 CATALOG_PATH="$WEB_ROOT/public/catalogs/v1/channels/$CHANNEL.json"
 KEYRING_PATH="$WEB_ROOT/public/catalogs/v1/keyring.json"
 TAG_NAME="catalog-v$VERSION"
+TEMP_ROOT="$(mktemp -d "${TMPDIR:-/tmp}/govoplan-release-catalog.XXXXXXXX")"
+PACKAGE_SET="$TEMP_ROOT/release-packages.json"
+PACKAGE_LOCK="$TEMP_ROOT/package-artifacts.lock.json"
+trap 'rm -rf "$TEMP_ROOT"' EXIT
 
 run() {
   printf '+'
@@ -197,6 +206,9 @@ GEN_ARGS=(
   env "GOVOPLAN_CORE_ROOT=$CORE_ROOT"
   "$PYTHON" "$META_ROOT/tools/release/generate-release-catalog.py"
   --version "$VERSION"
+  --package-set "$PACKAGE_SET"
+  --package-lock "$PACKAGE_LOCK"
+  --workspace "$PARENT"
   --channel "$CHANNEL"
   --expires-days "$EXPIRES_DAYS"
   --catalog-output "$CATALOG_PATH"
@@ -210,6 +222,18 @@ for signing_key in "${SIGNING_KEYS[@]}"; do
   GEN_ARGS+=(--catalog-signing-key "$signing_key")
 done
 
+run "$PYTHON" "$META_ROOT/tools/release/generate-release-package-set.py" \
+  --version "$VERSION" \
+  --profile "$PROFILE" \
+  --workspace "$PARENT" \
+  --output "$PACKAGE_SET"
+run "$PYTHON" "$META_ROOT/tools/release/resolve-package-artifacts.py" \
+  --package-set "$PACKAGE_SET" \
+  --wheelhouse "$TEMP_ROOT/wheelhouse" \
+  --webui-packages "$TEMP_ROOT/webui-packages" \
+  --lock-output "$PACKAGE_LOCK" \
+  --python "$PYTHON" \
+  --npm "$NPM_BIN"
 run "${GEN_ARGS[@]}"
 
 if [[ "$DRY_RUN" -eq 0 ]]; then