965 lines
27 KiB
Bash
965 lines
27 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
usage() {
|
|
cat <<'USAGE'
|
|
Usage:
|
|
tools/release/push-release-tag.sh [options]
|
|
|
|
Bumps installable GovOPlaN package versions, commits pending changes in the
|
|
GovOPlaN release/module repositories, creates an annotated release tag in each
|
|
repo, and pushes branch+tag.
|
|
|
|
By default the script asks which version part to bump:
|
|
major X.Y.Z -> (X+1).0.0
|
|
minor X.Y.Z -> X.(Y+1).0
|
|
subversion X.Y.Z -> X.Y.(Z+1)
|
|
|
|
Options:
|
|
--bump <kind> Version bump: major, minor, subversion, or patch.
|
|
--version <x.y.z> Explicit target version instead of a bump. May equal
|
|
the current repo versions when they were bumped already.
|
|
-r, --remote <name> Remote to push to. Defaults to origin.
|
|
-b, --branch <name> Branch to update in every repo. Defaults to each current branch.
|
|
-m, --message <text> Commit message. Defaults to "Release v<x.y.z>".
|
|
--tag-message <text> Annotated tag message. Defaults to the commit message.
|
|
--skip-release-lock Do not regenerate core webui/package-lock.release.json.
|
|
--warn-migration-audit Run the migration release audit without baseline strictness.
|
|
--strict-migration-audit
|
|
Require current Alembic heads to be recorded in the
|
|
latest migration release baseline.
|
|
--skip-migration-audit Do not run the release migration audit.
|
|
--publish-web-catalog After core/modules are pushed, publish a signed release
|
|
catalog into addideas-govoplan-website.
|
|
--web-root <path> addideas-govoplan-website checkout for --publish-web-catalog.
|
|
Defaults to ../addideas-govoplan-website.
|
|
--catalog-signing-key <key-id=/path/private.pem>
|
|
Catalog signing key for --publish-web-catalog. May be
|
|
repeated during key rotation.
|
|
--catalog-channel <name>
|
|
Catalog channel. Defaults to stable.
|
|
--catalog-sequence <n> Monotonic catalog sequence. Defaults to UTC timestamp.
|
|
--catalog-expires-days <days>
|
|
Catalog expiry window. Defaults to 90.
|
|
--catalog-public-url <url>
|
|
Public website URL. Defaults to
|
|
https://govoplan.add-ideas.de.
|
|
--build-web-catalog Run npm run build in addideas-govoplan-website before committing the
|
|
catalog update.
|
|
--npm <path> npm executable for lockfile generation.
|
|
-y, --yes Do not prompt before committing, tagging, and pushing.
|
|
-n, --dry-run Print intended actions without changing files or git state.
|
|
-h, --help Show this help.
|
|
|
|
Repos:
|
|
Core, every registered release/module repository listed below in this script,
|
|
and the meta repository. Repositories with pyproject.toml are versioned and
|
|
alignment-gated dynamically; remaining roadmap/scaffold repositories are
|
|
committed and tagged without inventing package metadata.
|
|
|
|
Examples:
|
|
tools/release/push-release-tag.sh
|
|
tools/release/push-release-tag.sh --bump subversion
|
|
tools/release/push-release-tag.sh --version 0.2.0 --message "Release v0.2.0"
|
|
USAGE
|
|
}
|
|
|
|
fail() {
|
|
echo "error: $*" >&2
|
|
exit 1
|
|
}
|
|
|
|
META_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
PARENT="$(dirname "$META_ROOT")"
|
|
ROOT="${GOVOPLAN_CORE_ROOT:-$PARENT/govoplan-core}"
|
|
ROOT="$(cd "$ROOT" && pwd)"
|
|
PACKAGE_MODULE_REPOS=(
|
|
"$PARENT/govoplan-access"
|
|
"$PARENT/govoplan-admin"
|
|
"$PARENT/govoplan-approvals"
|
|
"$PARENT/govoplan-assets"
|
|
"$PARENT/govoplan-audit"
|
|
"$PARENT/govoplan-booking"
|
|
"$PARENT/govoplan-calendar"
|
|
"$PARENT/govoplan-campaign"
|
|
"$PARENT/govoplan-certificates"
|
|
"$PARENT/govoplan-committee"
|
|
"$PARENT/govoplan-consultation"
|
|
"$PARENT/govoplan-connectors"
|
|
"$PARENT/govoplan-contracts"
|
|
"$PARENT/govoplan-dashboard"
|
|
"$PARENT/govoplan-dataflow"
|
|
"$PARENT/govoplan-datasources"
|
|
"$PARENT/govoplan-docs"
|
|
"$PARENT/govoplan-facilities"
|
|
"$PARENT/govoplan-files"
|
|
"$PARENT/govoplan-forms-runtime"
|
|
"$PARENT/govoplan-grants"
|
|
"$PARENT/govoplan-helpdesk"
|
|
"$PARENT/govoplan-identity"
|
|
"$PARENT/govoplan-idm"
|
|
"$PARENT/govoplan-inspections"
|
|
"$PARENT/govoplan-issue-reporting"
|
|
"$PARENT/govoplan-learning"
|
|
"$PARENT/govoplan-mail"
|
|
"$PARENT/govoplan-ops"
|
|
"$PARENT/govoplan-organizations"
|
|
"$PARENT/govoplan-permits"
|
|
"$PARENT/govoplan-policy"
|
|
"$PARENT/govoplan-poll"
|
|
"$PARENT/govoplan-procurement"
|
|
"$PARENT/govoplan-records"
|
|
"$PARENT/govoplan-resources"
|
|
"$PARENT/govoplan-risk-compliance"
|
|
"$PARENT/govoplan-tenancy"
|
|
"$PARENT/govoplan-transparency"
|
|
"$PARENT/govoplan-evaluation"
|
|
"$PARENT/govoplan-views"
|
|
"$PARENT/govoplan-workflow"
|
|
)
|
|
TAG_ONLY_MODULE_REPOS=(
|
|
"$PARENT/govoplan-addresses"
|
|
"$PARENT/govoplan-appointments"
|
|
"$PARENT/govoplan-cases"
|
|
"$PARENT/govoplan-dms"
|
|
"$PARENT/govoplan-dist-lists"
|
|
"$PARENT/govoplan-erp"
|
|
"$PARENT/govoplan-fit-connect"
|
|
"$PARENT/govoplan-forms"
|
|
"$PARENT/govoplan-identity-trust"
|
|
"$PARENT/govoplan-ledger"
|
|
"$PARENT/govoplan-notifications"
|
|
"$PARENT/govoplan-payments"
|
|
"$PARENT/govoplan-portal"
|
|
"$PARENT/govoplan-postbox"
|
|
"$PARENT/govoplan-reporting"
|
|
"$PARENT/govoplan-rest"
|
|
"$PARENT/govoplan-scheduling"
|
|
"$PARENT/govoplan-search"
|
|
"$PARENT/govoplan-soap"
|
|
"$PARENT/govoplan-tasks"
|
|
"$PARENT/govoplan-templates"
|
|
"$PARENT/govoplan-xoev"
|
|
"$PARENT/govoplan-xrechnung"
|
|
"$PARENT/govoplan-xta-osci"
|
|
)
|
|
MODULE_REPOS=("${PACKAGE_MODULE_REPOS[@]}" "${TAG_ONLY_MODULE_REPOS[@]}")
|
|
SUPPORT_REPOS=("$META_ROOT")
|
|
PACKAGE_REPOS=()
|
|
REPOS=(
|
|
"${MODULE_REPOS[@]}"
|
|
"$ROOT"
|
|
"${SUPPORT_REPOS[@]}"
|
|
)
|
|
|
|
REMOTE="origin"
|
|
BRANCH=""
|
|
BUMP=""
|
|
TARGET_VERSION=""
|
|
COMMIT_MESSAGE=""
|
|
TAG_MESSAGE=""
|
|
DRY_RUN=0
|
|
YES=0
|
|
GENERATE_RELEASE_LOCK=1
|
|
MIGRATION_AUDIT_MODE="auto"
|
|
NPM_BIN="${NPM:-}"
|
|
PUBLISH_WEB_CATALOG=0
|
|
WEB_ROOT="$PARENT/addideas-govoplan-website"
|
|
CATALOG_CHANNEL="stable"
|
|
CATALOG_SEQUENCE=""
|
|
CATALOG_EXPIRES_DAYS="90"
|
|
CATALOG_PUBLIC_URL="https://govoplan.add-ideas.de"
|
|
BUILD_WEB_CATALOG=0
|
|
CATALOG_SIGNING_KEYS=()
|
|
|
|
if [[ -z "${PYTHON:-}" ]]; then
|
|
if [[ -x "$META_ROOT/.venv/bin/python" ]]; then
|
|
PYTHON="$META_ROOT/.venv/bin/python"
|
|
else
|
|
PYTHON="python3"
|
|
fi
|
|
fi
|
|
|
|
if [[ -z "$NPM_BIN" ]]; then
|
|
if [[ -x "/home/zemion/.nvm/versions/node/v22.22.3/bin/npm" ]]; then
|
|
NPM_BIN="/home/zemion/.nvm/versions/node/v22.22.3/bin/npm"
|
|
else
|
|
NPM_BIN="npm"
|
|
fi
|
|
fi
|
|
|
|
export GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o BatchMode=yes -o ConnectTimeout=15}"
|
|
GIT_REMOTE_TIMEOUT="${GIT_REMOTE_TIMEOUT:-30}"
|
|
|
|
normalize_bump() {
|
|
local value="${1,,}"
|
|
case "$value" in
|
|
major|minor|subversion)
|
|
printf '%s\n' "$value"
|
|
;;
|
|
patch|sub|sub-version)
|
|
printf '%s\n' "subversion"
|
|
;;
|
|
*)
|
|
return 1
|
|
;;
|
|
esac
|
|
}
|
|
|
|
validate_version() {
|
|
[[ "$1" =~ ^[0-9]+[.][0-9]+[.][0-9]+$ ]]
|
|
}
|
|
|
|
version_gt() {
|
|
local new_major new_minor new_patch old_major old_minor old_patch
|
|
IFS=. read -r new_major new_minor new_patch <<< "$1"
|
|
IFS=. read -r old_major old_minor old_patch <<< "$2"
|
|
|
|
(( new_major > old_major )) && return 0
|
|
(( new_major < old_major )) && return 1
|
|
(( new_minor > old_minor )) && return 0
|
|
(( new_minor < old_minor )) && return 1
|
|
(( new_patch > old_patch )) && return 0
|
|
return 1
|
|
}
|
|
|
|
bump_version() {
|
|
local version="$1"
|
|
local bump="$2"
|
|
local major minor patch
|
|
IFS=. read -r major minor patch <<< "$version"
|
|
|
|
case "$bump" in
|
|
major)
|
|
printf '%s.0.0\n' "$((major + 1))"
|
|
;;
|
|
minor)
|
|
printf '%s.%s.0\n' "$major" "$((minor + 1))"
|
|
;;
|
|
subversion)
|
|
printf '%s.%s.%s\n' "$major" "$minor" "$((patch + 1))"
|
|
;;
|
|
*)
|
|
fail "unknown bump kind: $bump"
|
|
;;
|
|
esac
|
|
}
|
|
|
|
get_project_name() {
|
|
"$PYTHON" -c 'import pathlib, sys, tomllib; print(tomllib.loads(pathlib.Path(sys.argv[1]).read_text())["project"]["name"])' "$1/pyproject.toml"
|
|
}
|
|
|
|
get_project_version() {
|
|
"$PYTHON" -c 'import pathlib, sys, tomllib; print(tomllib.loads(pathlib.Path(sys.argv[1]).read_text())["project"]["version"])' "$1/pyproject.toml"
|
|
}
|
|
|
|
update_pyproject() {
|
|
local repo="$1"
|
|
local version="$2"
|
|
|
|
"$PYTHON" - "$repo/pyproject.toml" "$version" <<'PYCODE'
|
|
from __future__ import annotations
|
|
|
|
import pathlib
|
|
import re
|
|
import sys
|
|
import tomllib
|
|
|
|
path = pathlib.Path(sys.argv[1])
|
|
new_version = sys.argv[2]
|
|
text = path.read_text()
|
|
data = tomllib.loads(text)
|
|
project = data["project"]
|
|
name = project["name"]
|
|
old_version = project["version"]
|
|
|
|
text, version_count = re.subn(
|
|
r'(?m)^version\s*=\s*["\'][^"\']+["\']\s*$',
|
|
f'version = "{new_version}"',
|
|
text,
|
|
count=1,
|
|
)
|
|
if version_count != 1:
|
|
raise SystemExit(f"could not update project.version in {path}")
|
|
|
|
if name != "govoplan-core":
|
|
text, dependency_count = re.subn(
|
|
r'(govoplan-[A-Za-z0-9-]+>=)\d+\.\d+\.\d+',
|
|
rf'\g<1>{new_version}',
|
|
text,
|
|
)
|
|
if dependency_count < 1:
|
|
raise SystemExit(f"could not update govoplan-core dependency in {path}")
|
|
|
|
path.write_text(text)
|
|
print(f"{name}: {old_version} -> {new_version}")
|
|
PYCODE
|
|
}
|
|
|
|
update_manifest_version() {
|
|
local repo="$1"
|
|
local project_name="$2"
|
|
local version="$3"
|
|
local manifest_paths=()
|
|
|
|
if [[ "$project_name" == "govoplan-core" ]]; then
|
|
return 0
|
|
fi
|
|
|
|
while IFS= read -r -d '' manifest_path; do
|
|
manifest_paths+=("$manifest_path")
|
|
done < <(find "$repo/src" -path "*/backend/manifest.py" -print0 2>/dev/null)
|
|
|
|
[[ "${#manifest_paths[@]}" -gt 0 ]] || fail "missing module manifest under $repo/src"
|
|
|
|
for manifest_path in "${manifest_paths[@]}"; do
|
|
"$PYTHON" - "$manifest_path" "$version" <<'PYCODE'
|
|
from __future__ import annotations
|
|
|
|
import pathlib
|
|
import re
|
|
import sys
|
|
|
|
path = pathlib.Path(sys.argv[1])
|
|
new_version = sys.argv[2]
|
|
text = path.read_text()
|
|
text, count = re.subn(
|
|
r'(?m)^(\s*version=)["\'][^"\']+["\'](,?\s*)$',
|
|
rf'\1"{new_version}"\2',
|
|
text,
|
|
count=1,
|
|
)
|
|
if count == 0:
|
|
text, count = re.subn(
|
|
r'(?m)^(MODULE_VERSION\s*=\s*)["\'][^"\']+["\'](\s*)$',
|
|
rf'\1"{new_version}"\2',
|
|
text,
|
|
count=1,
|
|
)
|
|
if count != 1:
|
|
raise SystemExit(f"could not update ModuleManifest.version in {path}")
|
|
path.write_text(text)
|
|
PYCODE
|
|
done
|
|
}
|
|
|
|
update_webui_package() {
|
|
local repo="$1"
|
|
local project_name="$2"
|
|
local version="$3"
|
|
local package_path=""
|
|
local release_package_path="$repo/webui/package.release.json"
|
|
|
|
for package_path in "$repo/package.json" "$repo/webui/package.json"; do
|
|
[[ -f "$package_path" ]] || continue
|
|
"$PYTHON" - "$package_path" "$project_name" "$version" <<'PYCODE'
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
import pathlib
|
|
import sys
|
|
|
|
path = pathlib.Path(sys.argv[1])
|
|
project_name = sys.argv[2]
|
|
new_version = sys.argv[3]
|
|
|
|
data = json.loads(path.read_text())
|
|
data["version"] = new_version
|
|
if project_name != "govoplan-core":
|
|
peers = data.setdefault("peerDependencies", {})
|
|
if "@govoplan/core-webui" in peers:
|
|
peers["@govoplan/core-webui"] = f"^{new_version}"
|
|
path.write_text(json.dumps(data, indent=2) + "\n")
|
|
PYCODE
|
|
synchronize_lockfile_root "$package_path" "${package_path%package.json}package-lock.json"
|
|
done
|
|
|
|
if [[ "$project_name" == "govoplan-core" && -f "$release_package_path" ]]; then
|
|
"$PYTHON" - "$release_package_path" "$version" <<'PYCODE'
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
import pathlib
|
|
import re
|
|
import sys
|
|
|
|
path = pathlib.Path(sys.argv[1])
|
|
new_version = sys.argv[2]
|
|
|
|
data = json.loads(path.read_text())
|
|
data["version"] = new_version
|
|
dependencies = data.setdefault("dependencies", {})
|
|
for name, spec in list(dependencies.items()):
|
|
if name.startswith("@govoplan/") and isinstance(spec, str) and spec.startswith("git+"):
|
|
dependencies[name] = re.sub(r"#v\d+\.\d+\.\d+$", f"#v{new_version}", spec)
|
|
path.write_text(json.dumps(data, indent=2) + "\n")
|
|
PYCODE
|
|
synchronize_lockfile_root "$release_package_path" "$repo/webui/package-lock.release.json"
|
|
fi
|
|
}
|
|
|
|
synchronize_lockfile_root() {
|
|
local package_path="$1"
|
|
local lock_path="$2"
|
|
[[ -f "$package_path" && -f "$lock_path" ]] || return 0
|
|
"$PYTHON" - "$package_path" "$lock_path" <<'PYCODE'
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
from pathlib import Path
|
|
import sys
|
|
|
|
package_path = Path(sys.argv[1])
|
|
lock_path = Path(sys.argv[2])
|
|
package = json.loads(package_path.read_text())
|
|
lock = json.loads(lock_path.read_text())
|
|
version = package.get("version")
|
|
if not isinstance(version, str) or not version:
|
|
raise SystemExit(f"package version is missing from {package_path}")
|
|
lock["version"] = version
|
|
packages = lock.get("packages")
|
|
if isinstance(packages, dict) and isinstance(packages.get(""), dict):
|
|
packages[""]["version"] = version
|
|
lock_path.write_text(json.dumps(lock, indent=2) + "\n")
|
|
PYCODE
|
|
}
|
|
|
|
update_release_requirements() {
|
|
local version="$1"
|
|
"$PYTHON" - "$META_ROOT/requirements-release.txt" "$version" <<'PYCODE'
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
import re
|
|
import sys
|
|
|
|
path = Path(sys.argv[1])
|
|
version = sys.argv[2]
|
|
text = path.read_text()
|
|
updated, count = re.subn(
|
|
r"(?m)^(govoplan-[a-z0-9-]+\s+@\s+git\+ssh://[^\s]+\.git)@v[^\s]+$",
|
|
rf"\1@v{version}",
|
|
text,
|
|
)
|
|
if count == 0:
|
|
raise SystemExit(f"no tagged GovOPlaN requirements found in {path}")
|
|
path.write_text(updated)
|
|
PYCODE
|
|
}
|
|
|
|
update_version_files() {
|
|
local repo="$1"
|
|
local version="$2"
|
|
local project_name="${PROJECT_NAMES[$repo]}"
|
|
|
|
update_pyproject "$repo" "$version"
|
|
update_manifest_version "$repo" "$project_name" "$version"
|
|
update_webui_package "$repo" "$project_name" "$version"
|
|
}
|
|
|
|
refresh_development_webui_lock() {
|
|
[[ -f "$ROOT/webui/package.json" ]] || return 0
|
|
[[ -f "$ROOT/webui/package-lock.json" ]] || return 0
|
|
|
|
run env PATH="$(dirname "$NPM_BIN"):$PATH" "$NPM_BIN" --prefix "$ROOT/webui" install --package-lock-only --ignore-scripts
|
|
}
|
|
|
|
generate_release_lock() {
|
|
if [[ "$GENERATE_RELEASE_LOCK" -eq 0 ]]; then
|
|
return
|
|
fi
|
|
|
|
[[ -x "$META_ROOT/tools/release/generate-release-lock.sh" ]] || fail "missing executable release lock generator: $META_ROOT/tools/release/generate-release-lock.sh"
|
|
local command=("$META_ROOT/tools/release/generate-release-lock.sh" --core-root "$ROOT" --npm "$NPM_BIN")
|
|
local repo
|
|
for repo in "${MODULE_REPOS[@]}"; do
|
|
command+=(--local-git-repo "$repo")
|
|
done
|
|
run "${command[@]}"
|
|
}
|
|
|
|
run_version_alignment_gate() {
|
|
local mode="${1:-full}"
|
|
local command=(
|
|
"$PYTHON"
|
|
"$META_ROOT/tools/checks/check-version-alignment.py"
|
|
--workspace-root "$PARENT"
|
|
--release-composition
|
|
)
|
|
if [[ "$mode" == "source" ]]; then
|
|
command+=(--source-metadata-only)
|
|
fi
|
|
local repo
|
|
for repo in "${PACKAGE_REPOS[@]}"; do
|
|
command+=(--repo-version "$(basename "$repo")=$TARGET_VERSION")
|
|
done
|
|
run "${command[@]}"
|
|
}
|
|
|
|
run_manifest_shape_gate() {
|
|
run env PYTHONDONTWRITEBYTECODE=1 \
|
|
"$PYTHON" \
|
|
"$META_ROOT/tools/checks/check-manifest-shapes.py" \
|
|
--workspace-root "$PARENT"
|
|
}
|
|
|
|
run_migration_release_audit() {
|
|
local audit_script="$META_ROOT/tools/release/release-migration-audit.py"
|
|
local command=("$PYTHON" "$audit_script" "--track" "release")
|
|
|
|
case "$MIGRATION_AUDIT_MODE" in
|
|
skip)
|
|
echo "Migration release audit: skipped"
|
|
return
|
|
;;
|
|
strict)
|
|
command+=("--strict")
|
|
;;
|
|
auto)
|
|
command+=("--strict-if-baseline")
|
|
;;
|
|
warn)
|
|
;;
|
|
*)
|
|
fail "unknown migration audit mode: $MIGRATION_AUDIT_MODE"
|
|
;;
|
|
esac
|
|
|
|
[[ -f "$audit_script" ]] || fail "missing migration audit helper: $audit_script"
|
|
run "${command[@]}"
|
|
}
|
|
|
|
print_command() {
|
|
printf '+'
|
|
printf ' %q' "$@"
|
|
printf '\n'
|
|
}
|
|
|
|
run() {
|
|
print_command "$@"
|
|
if [[ "$DRY_RUN" -eq 0 ]]; then
|
|
"$@"
|
|
fi
|
|
}
|
|
|
|
prompt_for_bump() {
|
|
local answer=""
|
|
|
|
if [[ -n "$BUMP" || -n "$TARGET_VERSION" ]]; then
|
|
return
|
|
fi
|
|
|
|
if [[ ! -t 0 ]]; then
|
|
fail "pass --bump major|minor|subversion or --version x.y.z for non-interactive use"
|
|
fi
|
|
|
|
echo "Select version increase:"
|
|
echo " 1) major X.Y.Z -> (X+1).0.0"
|
|
echo " 2) minor X.Y.Z -> X.(Y+1).0"
|
|
echo " 3) subversion X.Y.Z -> X.Y.(Z+1)"
|
|
printf 'Choice [subversion]: '
|
|
read -r answer
|
|
|
|
case "${answer,,}" in
|
|
""|3|subversion|patch|sub|sub-version)
|
|
BUMP="subversion"
|
|
;;
|
|
1|major)
|
|
BUMP="major"
|
|
;;
|
|
2|minor)
|
|
BUMP="minor"
|
|
;;
|
|
*)
|
|
fail "unknown version bump: $answer"
|
|
;;
|
|
esac
|
|
}
|
|
|
|
confirm_release() {
|
|
local answer=""
|
|
|
|
if [[ "$DRY_RUN" -eq 1 || "$YES" -eq 1 ]]; then
|
|
return
|
|
fi
|
|
|
|
if [[ ! -t 0 ]]; then
|
|
fail "refusing to commit, tag, and push without confirmation; pass --yes for non-interactive use"
|
|
fi
|
|
|
|
printf 'Commit all changes, tag all repos, and push to %s? [y/N] ' "$REMOTE"
|
|
read -r answer
|
|
case "${answer,,}" in
|
|
y|yes)
|
|
;;
|
|
*)
|
|
echo "Aborted."
|
|
exit 1
|
|
;;
|
|
esac
|
|
}
|
|
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--bump)
|
|
[[ $# -ge 2 ]] || fail "missing value for $1"
|
|
BUMP="$(normalize_bump "$2")" || fail "unknown bump kind: $2"
|
|
shift 2
|
|
;;
|
|
--version)
|
|
[[ $# -ge 2 ]] || fail "missing value for $1"
|
|
TARGET_VERSION="$2"
|
|
shift 2
|
|
;;
|
|
-r|--remote)
|
|
[[ $# -ge 2 ]] || fail "missing value for $1"
|
|
REMOTE="$2"
|
|
shift 2
|
|
;;
|
|
-b|--branch)
|
|
[[ $# -ge 2 ]] || fail "missing value for $1"
|
|
BRANCH="$2"
|
|
shift 2
|
|
;;
|
|
-m|--message)
|
|
[[ $# -ge 2 ]] || fail "missing value for $1"
|
|
COMMIT_MESSAGE="$2"
|
|
shift 2
|
|
;;
|
|
--tag-message)
|
|
[[ $# -ge 2 ]] || fail "missing value for $1"
|
|
TAG_MESSAGE="$2"
|
|
shift 2
|
|
;;
|
|
--skip-release-lock)
|
|
GENERATE_RELEASE_LOCK=0
|
|
shift
|
|
;;
|
|
--warn-migration-audit)
|
|
MIGRATION_AUDIT_MODE="warn"
|
|
shift
|
|
;;
|
|
--strict-migration-audit)
|
|
MIGRATION_AUDIT_MODE="strict"
|
|
shift
|
|
;;
|
|
--skip-migration-audit)
|
|
MIGRATION_AUDIT_MODE="skip"
|
|
shift
|
|
;;
|
|
--publish-web-catalog)
|
|
PUBLISH_WEB_CATALOG=1
|
|
shift
|
|
;;
|
|
--web-root)
|
|
[[ $# -ge 2 ]] || fail "missing value for $1"
|
|
WEB_ROOT="$2"
|
|
shift 2
|
|
;;
|
|
--catalog-signing-key)
|
|
[[ $# -ge 2 ]] || fail "missing value for $1"
|
|
CATALOG_SIGNING_KEYS+=("$2")
|
|
shift 2
|
|
;;
|
|
--catalog-channel)
|
|
[[ $# -ge 2 ]] || fail "missing value for $1"
|
|
CATALOG_CHANNEL="$2"
|
|
shift 2
|
|
;;
|
|
--catalog-sequence)
|
|
[[ $# -ge 2 ]] || fail "missing value for $1"
|
|
CATALOG_SEQUENCE="$2"
|
|
shift 2
|
|
;;
|
|
--catalog-expires-days)
|
|
[[ $# -ge 2 ]] || fail "missing value for $1"
|
|
CATALOG_EXPIRES_DAYS="$2"
|
|
shift 2
|
|
;;
|
|
--catalog-public-url)
|
|
[[ $# -ge 2 ]] || fail "missing value for $1"
|
|
CATALOG_PUBLIC_URL="$2"
|
|
shift 2
|
|
;;
|
|
--build-web-catalog)
|
|
BUILD_WEB_CATALOG=1
|
|
shift
|
|
;;
|
|
--npm)
|
|
[[ $# -ge 2 ]] || fail "missing value for $1"
|
|
NPM_BIN="$2"
|
|
shift 2
|
|
;;
|
|
-y|--yes)
|
|
YES=1
|
|
shift
|
|
;;
|
|
-n|--dry-run)
|
|
DRY_RUN=1
|
|
shift
|
|
;;
|
|
-h|--help)
|
|
usage
|
|
exit 0
|
|
;;
|
|
*)
|
|
echo "Unknown argument: $1" >&2
|
|
usage >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
done
|
|
|
|
if [[ -n "$BUMP" && -n "$TARGET_VERSION" ]]; then
|
|
fail "use either --bump or --version, not both"
|
|
fi
|
|
if [[ "$PUBLISH_WEB_CATALOG" -eq 1 && ${#CATALOG_SIGNING_KEYS[@]} -eq 0 ]]; then
|
|
fail "--publish-web-catalog requires at least one --catalog-signing-key"
|
|
fi
|
|
|
|
prompt_for_bump
|
|
|
|
if ! command -v "$PYTHON" >/dev/null 2>&1; then
|
|
fail "Python interpreter not found: $PYTHON"
|
|
fi
|
|
if ! command -v "$NPM_BIN" >/dev/null 2>&1; then
|
|
fail "npm executable not found: $NPM_BIN"
|
|
fi
|
|
if [[ "$PUBLISH_WEB_CATALOG" -eq 1 ]]; then
|
|
[[ -d "$WEB_ROOT/.git" ]] || fail "addideas-govoplan-website repo not found: $WEB_ROOT"
|
|
[[ -x "$META_ROOT/tools/release/publish-release-catalog.sh" ]] || fail "missing executable catalog publisher: $META_ROOT/tools/release/publish-release-catalog.sh"
|
|
fi
|
|
|
|
declare -A PROJECT_NAMES
|
|
declare -A OLD_VERSIONS
|
|
declare -A BRANCHES
|
|
declare -A REPO_KINDS
|
|
|
|
for repo in "${REPOS[@]}"; do
|
|
[[ -d "$repo/.git" ]] || fail "not a git repo: $repo"
|
|
|
|
if [[ -f "$repo/pyproject.toml" ]]; then
|
|
REPO_KINDS["$repo"]="package"
|
|
PROJECT_NAMES["$repo"]="$(get_project_name "$repo")"
|
|
OLD_VERSIONS["$repo"]="$(get_project_version "$repo")"
|
|
|
|
validate_version "${OLD_VERSIONS[$repo]}" || fail "unsupported version ${OLD_VERSIONS[$repo]} in $repo"
|
|
else
|
|
REPO_KINDS["$repo"]="tag-only"
|
|
PROJECT_NAMES["$repo"]="$(basename "$repo")"
|
|
OLD_VERSIONS["$repo"]="tag-only"
|
|
fi
|
|
|
|
if [[ -n "$BRANCH" ]]; then
|
|
BRANCHES["$repo"]="$BRANCH"
|
|
else
|
|
BRANCHES["$repo"]="$(git -C "$repo" symbolic-ref --quiet --short HEAD || true)"
|
|
fi
|
|
|
|
[[ -n "${BRANCHES[$repo]}" ]] || fail "cannot infer branch for $repo; pass --branch <name>"
|
|
git -C "$repo" check-ref-format "refs/heads/${BRANCHES[$repo]}" || fail "invalid branch name ${BRANCHES[$repo]} for $repo"
|
|
git -C "$repo" remote get-url "$REMOTE" >/dev/null || fail "remote $REMOTE not found in $repo"
|
|
|
|
upstream="$(git -C "$repo" rev-parse --abbrev-ref --symbolic-full-name '@{u}' 2>/dev/null || true)"
|
|
if [[ -n "$upstream" && "$upstream" != "@{u}" ]]; then
|
|
behind_count="$(git -C "$repo" rev-list --count "HEAD..$upstream")"
|
|
[[ "$behind_count" == "0" ]] || fail "$repo is behind $upstream by $behind_count commit(s); pull/rebase first"
|
|
fi
|
|
done
|
|
|
|
EFFECTIVE_TAG_ONLY_REPOS=()
|
|
for repo in "${REPOS[@]}"; do
|
|
if [[ "${REPO_KINDS[$repo]}" == "package" ]]; then
|
|
PACKAGE_REPOS+=("$repo")
|
|
else
|
|
EFFECTIVE_TAG_ONLY_REPOS+=("$repo")
|
|
fi
|
|
done
|
|
|
|
if [[ -z "$TARGET_VERSION" ]]; then
|
|
BASE_VERSION="${OLD_VERSIONS[$ROOT]}"
|
|
for repo in "${PACKAGE_REPOS[@]}"; do
|
|
if [[ "${OLD_VERSIONS[$repo]}" != "$BASE_VERSION" ]]; then
|
|
fail "repo versions differ; pass --version x.y.z to choose an explicit target"
|
|
fi
|
|
done
|
|
TARGET_VERSION="$(bump_version "$BASE_VERSION" "$BUMP")"
|
|
fi
|
|
|
|
validate_version "$TARGET_VERSION" || fail "target version must be x.y.z: $TARGET_VERSION"
|
|
|
|
for repo in "${PACKAGE_REPOS[@]}"; do
|
|
if [[ "$TARGET_VERSION" == "${OLD_VERSIONS[$repo]}" ]]; then
|
|
continue
|
|
fi
|
|
if ! version_gt "$TARGET_VERSION" "${OLD_VERSIONS[$repo]}"; then
|
|
fail "target version $TARGET_VERSION must be greater than ${OLD_VERSIONS[$repo]} for ${PROJECT_NAMES[$repo]}"
|
|
fi
|
|
done
|
|
|
|
TAG="v$TARGET_VERSION"
|
|
COMMIT_MESSAGE="${COMMIT_MESSAGE:-Release $TAG}"
|
|
TAG_MESSAGE="${TAG_MESSAGE:-$COMMIT_MESSAGE}"
|
|
|
|
git -C "$ROOT" check-ref-format "refs/tags/$TAG" || fail "invalid tag name: $TAG"
|
|
|
|
for repo in "${REPOS[@]}"; do
|
|
if git -C "$repo" rev-parse --quiet --verify "refs/tags/$TAG" >/dev/null; then
|
|
fail "local tag already exists in ${PROJECT_NAMES[$repo]}: $TAG"
|
|
fi
|
|
|
|
set +e
|
|
timeout "$GIT_REMOTE_TIMEOUT" git -C "$repo" ls-remote --exit-code --tags "$REMOTE" "refs/tags/$TAG" >/dev/null
|
|
ls_remote_status=$?
|
|
set -e
|
|
|
|
if [[ "$ls_remote_status" -eq 0 ]]; then
|
|
fail "remote tag already exists for ${PROJECT_NAMES[$repo]} on $REMOTE: $TAG"
|
|
elif [[ "$ls_remote_status" -ne 2 ]]; then
|
|
fail "could not check remote tags for ${PROJECT_NAMES[$repo]} on $REMOTE"
|
|
fi
|
|
done
|
|
|
|
echo "Release plan:"
|
|
echo " version: $TARGET_VERSION"
|
|
echo " tag: $TAG"
|
|
echo " remote: $REMOTE"
|
|
echo " commit message: $COMMIT_MESSAGE"
|
|
echo " package repos: ${#PACKAGE_REPOS[@]} versioned"
|
|
echo " tag-only/support repos: ${#EFFECTIVE_TAG_ONLY_REPOS[@]} committed/tagged/pushed without package version files"
|
|
if [[ "$GENERATE_RELEASE_LOCK" -eq 1 ]]; then
|
|
echo " release lock: resolve core webui/package-lock.release.json from local reviewed module tags"
|
|
else
|
|
echo " release lock: skipped"
|
|
fi
|
|
echo " migration audit: $MIGRATION_AUDIT_MODE"
|
|
if [[ "$PUBLISH_WEB_CATALOG" -eq 1 ]]; then
|
|
echo " web catalog: publish $CATALOG_CHANNEL catalog to $WEB_ROOT after core tag is pushed"
|
|
else
|
|
echo " web catalog: skipped"
|
|
fi
|
|
echo
|
|
|
|
for repo in "${REPOS[@]}"; do
|
|
if [[ "${REPO_KINDS[$repo]}" == "package" ]]; then
|
|
echo "${PROJECT_NAMES[$repo]}: ${OLD_VERSIONS[$repo]} -> $TARGET_VERSION on ${BRANCHES[$repo]}"
|
|
else
|
|
echo "${PROJECT_NAMES[$repo]}: tag-only $TAG on ${BRANCHES[$repo]}"
|
|
fi
|
|
git -C "$repo" status --short
|
|
echo
|
|
done
|
|
|
|
run_migration_release_audit
|
|
run_manifest_shape_gate
|
|
|
|
confirm_release
|
|
|
|
for repo in "${PACKAGE_REPOS[@]}"; do
|
|
if [[ "$DRY_RUN" -eq 1 ]]; then
|
|
echo "Would update version files in $repo to $TARGET_VERSION"
|
|
else
|
|
update_version_files "$repo" "$TARGET_VERSION"
|
|
fi
|
|
done
|
|
|
|
if [[ "$DRY_RUN" -eq 1 ]]; then
|
|
echo "Would update $META_ROOT/requirements-release.txt to $TAG"
|
|
else
|
|
update_release_requirements "$TARGET_VERSION"
|
|
fi
|
|
|
|
refresh_development_webui_lock
|
|
|
|
# Source metadata, release refs, and lock roots must agree before creating any
|
|
# release commit or tag. A second gate below verifies the fully resolved release
|
|
# lock before any remote mutation.
|
|
run_version_alignment_gate source
|
|
|
|
PRE_CORE_REPOS=("${MODULE_REPOS[@]}" "${SUPPORT_REPOS[@]}")
|
|
for repo in "${PRE_CORE_REPOS[@]}"; do
|
|
run git -C "$repo" add -A
|
|
|
|
if [[ "$DRY_RUN" -eq 0 ]]; then
|
|
if git -C "$repo" diff --cached --quiet; then
|
|
if [[ "${REPO_KINDS[$repo]}" == "package" ]]; then
|
|
if [[ "$TARGET_VERSION" == "${OLD_VERSIONS[$repo]}" ]]; then
|
|
echo "No staged changes for ${PROJECT_NAMES[$repo]}; version is already $TARGET_VERSION, tagging current HEAD."
|
|
else
|
|
fail "no staged changes for ${PROJECT_NAMES[$repo]} after version bump"
|
|
fi
|
|
else
|
|
echo "No staged changes for ${PROJECT_NAMES[$repo]}; tagging current HEAD."
|
|
fi
|
|
else
|
|
run git -C "$repo" commit -m "$COMMIT_MESSAGE"
|
|
fi
|
|
else
|
|
run git -C "$repo" commit -m "$COMMIT_MESSAGE"
|
|
fi
|
|
|
|
run git -C "$repo" tag -a "$TAG" -m "$TAG_MESSAGE"
|
|
done
|
|
|
|
generate_release_lock
|
|
|
|
# npm resolves the new module tags from the local repositories. Nothing has
|
|
# been pushed yet; a failed lock or alignment check leaves only local,
|
|
# recoverable commits/tags.
|
|
run_version_alignment_gate
|
|
|
|
run git -C "$ROOT" add -A
|
|
|
|
if [[ "$DRY_RUN" -eq 0 ]]; then
|
|
if git -C "$ROOT" diff --cached --quiet; then
|
|
fail "no staged changes for ${PROJECT_NAMES[$ROOT]} after version bump"
|
|
fi
|
|
fi
|
|
|
|
run git -C "$ROOT" commit -m "$COMMIT_MESSAGE"
|
|
run git -C "$ROOT" tag -a "$TAG" -m "$TAG_MESSAGE"
|
|
|
|
for repo in "${PRE_CORE_REPOS[@]}"; do
|
|
run git -C "$repo" push --atomic "$REMOTE" "HEAD:refs/heads/${BRANCHES[$repo]}" "refs/tags/$TAG"
|
|
done
|
|
run git -C "$ROOT" push --atomic "$REMOTE" "HEAD:refs/heads/${BRANCHES[$ROOT]}" "refs/tags/$TAG"
|
|
|
|
if [[ "$PUBLISH_WEB_CATALOG" -eq 1 ]]; then
|
|
CATALOG_ARGS=(
|
|
"$META_ROOT/tools/release/publish-release-catalog.sh"
|
|
--version "$TARGET_VERSION"
|
|
--channel "$CATALOG_CHANNEL"
|
|
--expires-days "$CATALOG_EXPIRES_DAYS"
|
|
--core-root "$ROOT"
|
|
--web-root "$WEB_ROOT"
|
|
--public-base-url "$CATALOG_PUBLIC_URL"
|
|
--npm "$NPM_BIN"
|
|
--commit
|
|
--tag
|
|
--push
|
|
--remote "$REMOTE"
|
|
)
|
|
if [[ -n "$BRANCH" ]]; then
|
|
CATALOG_ARGS+=(--branch "$BRANCH")
|
|
fi
|
|
if [[ -n "$CATALOG_SEQUENCE" ]]; then
|
|
CATALOG_ARGS+=(--sequence "$CATALOG_SEQUENCE")
|
|
fi
|
|
if [[ "$BUILD_WEB_CATALOG" -eq 1 ]]; then
|
|
CATALOG_ARGS+=(--build-web)
|
|
fi
|
|
for signing_key in "${CATALOG_SIGNING_KEYS[@]}"; do
|
|
CATALOG_ARGS+=(--catalog-signing-key "$signing_key")
|
|
done
|
|
if [[ "$DRY_RUN" -eq 1 ]]; then
|
|
CATALOG_ARGS+=(--dry-run)
|
|
fi
|
|
run "${CATALOG_ARGS[@]}"
|
|
fi
|
|
|
|
if [[ "$DRY_RUN" -eq 1 ]]; then
|
|
echo "Dry run complete for $TAG across all GovOPlaN repos."
|
|
else
|
|
echo "Released $TAG across all GovOPlaN repos."
|
|
fi
|