flan
cd39489c7f
The report body is full of backticks, so 'echo "${{ steps.report.outputs.body }}"'
pasted it into the shell text and bash executed create-snapshot, def and async as
commands. The report is built from iX's middleware source, so that was an injection
vector as well as a bug. inputs.tag on workflow_dispatch had the same shape.
Data goes through files, scalars through env:. Tests enforce it across every
workflow.
187 lines
7.2 KiB
YAML
187 lines
7.2 KiB
YAML
name: Release
|
|
|
|
# Push a tag, get a release. The body always comes from CHANGELOG.md, so there is
|
|
# no second place to write release notes and therefore no second place for them to
|
|
# go stale.
|
|
#
|
|
# git tag -a v0.4.0 -m "v0.4.0" && git push origin v0.4.0
|
|
#
|
|
# workflow_dispatch re-cuts (or updates) the release for a tag that already
|
|
# exists, since re-pushing an existing tag triggers nothing.
|
|
#
|
|
# It checks out the TAG, because the tagged code is what people install and it has
|
|
# to pass its own tests. That means it only works for tags that actually contain
|
|
# this tooling (>= v0.3.0). Tags older than that were backfilled by hand.
|
|
|
|
on:
|
|
push:
|
|
tags: ["v*"]
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: "Existing tag to create a release for (e.g. v0.2.1)"
|
|
required: true
|
|
type: string
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
# Via `env:`, never spliced into the script. `inputs.tag` is attacker-chosen on
|
|
# a workflow_dispatch, and a ${{ }} in a `run:` body is pasted into the shell
|
|
# TEXT -- a tag of `$(...)` would simply execute. env: is safe: the runner sets
|
|
# the variable instead of rewriting the script.
|
|
- name: Resolve tag
|
|
id: tag
|
|
env:
|
|
EVENT: ${{ github.event_name }}
|
|
INPUT_TAG: ${{ inputs.tag }}
|
|
run: |
|
|
if [ "$EVENT" = "workflow_dispatch" ]; then
|
|
tag="$INPUT_TAG"
|
|
else
|
|
tag="${GITHUB_REF#refs/tags/}"
|
|
fi
|
|
|
|
# Whatever it came from, it has to look like a tag we cut.
|
|
case "$tag" in
|
|
v[0-9]*.[0-9]*.[0-9]*) ;;
|
|
*) echo "::error::refusing to release a tag that is not vX.Y.Z[-rcN]: $tag"; exit 1 ;;
|
|
esac
|
|
|
|
echo "tag=$tag" >> "$GITHUB_OUTPUT"
|
|
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ steps.tag.outputs.tag }}
|
|
fetch-depth: 0
|
|
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.13"
|
|
|
|
# Never publish a release for code that does not pass its own tests. A
|
|
# tagged commit is what people install; it has to be at least as good as
|
|
# main.
|
|
- name: install dev deps
|
|
run: python -m pip install --upgrade pip pytest ruff
|
|
|
|
- name: ruff
|
|
run: ruff check patch tests tools
|
|
|
|
- name: pytest
|
|
run: pytest tests -q
|
|
|
|
- name: shell syntax
|
|
run: |
|
|
fail=0
|
|
while IFS= read -r f; do
|
|
bash -n "$f" || { echo "::error file=$f::bash syntax error"; fail=1; }
|
|
done < <(find . -name '*.sh' -not -path './.git/*')
|
|
exit $fail
|
|
|
|
# Catches the failure mode this repo actually had: VERSION= drifted to
|
|
# three different values across the scripts, and nothing noticed.
|
|
- name: "gate: version matches tag, CHANGELOG complete, nothing stranded"
|
|
env:
|
|
TAG: ${{ steps.tag.outputs.tag }}
|
|
run: python3 tools/release_notes.py check "$TAG"
|
|
|
|
# THE BARRIER. A stable release must have been a release candidate on this
|
|
# exact commit. Candidates are invisible to users (update.sh and the alert
|
|
# source both take the newest plain vX.Y.Z), so debugging happens across
|
|
# rc1/rc2/rc3 at no cost to anyone -- instead of across v0.5.0/v0.5.1/v0.5.2,
|
|
# which alerts every installed box every time.
|
|
#
|
|
# Same code release.sh runs locally, so this should never be the first place
|
|
# you find out. It is here because this is the only place that cannot be
|
|
# bypassed: it holds the token that publishes.
|
|
- name: "gate: this commit was a release candidate"
|
|
env:
|
|
TAG: ${{ steps.tag.outputs.tag }}
|
|
run: python3 tools/release_gate.py "$TAG" -C .
|
|
|
|
# There is deliberately NO "did the candidate's CI run pass?" gate here.
|
|
#
|
|
# It would have to query the forge's run history, which is the one thing that
|
|
# differs between GitHub and Gitea -- and it adds nothing: the steps above
|
|
# re-run ruff, pytest and the shell checks against the TAGGED COMMIT, and
|
|
# release_gate.py has already proved a candidate points at that same commit.
|
|
# If the code passes now, it passed then; they are the same code.
|
|
#
|
|
# What a candidate really buys is the thing no CI can check: that a human
|
|
# installed it on a real box and exercised it. The barrier makes room for
|
|
# that; it cannot verify it.
|
|
|
|
- name: extract release notes from CHANGELOG
|
|
env:
|
|
TAG: ${{ steps.tag.outputs.tag }}
|
|
run: |
|
|
python3 tools/release_notes.py notes "$TAG" > /tmp/notes.md
|
|
echo "--- release body ---"
|
|
cat /tmp/notes.md
|
|
|
|
# This repo is canonically hosted on Gitea (git.onetick.ninja) and mirrored to
|
|
# GitHub, and BOTH run this workflow -- Gitea reads .github/workflows too. So
|
|
# the publish step has to work on whichever forge it lands on. Everything
|
|
# above is forge-agnostic; only the "create a release" API differs.
|
|
|
|
- name: publish the release (GitHub)
|
|
if: ${{ contains(github.server_url, 'github.com') }}
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
TAG: ${{ steps.tag.outputs.tag }}
|
|
run: |
|
|
prerelease=""
|
|
case "$TAG" in
|
|
*-rc*|*-beta*|*-alpha*) prerelease="--prerelease" ;;
|
|
esac
|
|
|
|
if gh release view "$TAG" >/dev/null 2>&1; then
|
|
echo "Release $TAG exists — updating notes."
|
|
gh release edit "$TAG" --notes-file /tmp/notes.md
|
|
else
|
|
# shellcheck disable=SC2086
|
|
gh release create "$TAG" --title "$TAG" --notes-file /tmp/notes.md $prerelease
|
|
fi
|
|
|
|
- name: publish the release (Gitea)
|
|
if: ${{ !contains(github.server_url, 'github.com') }}
|
|
env:
|
|
TOKEN: ${{ secrets.GITEA_TOKEN || github.token }}
|
|
TAG: ${{ steps.tag.outputs.tag }}
|
|
API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
|
|
run: |
|
|
prerelease=false
|
|
case "$TAG" in
|
|
*-rc*|*-beta*|*-alpha*) prerelease=true ;;
|
|
esac
|
|
|
|
# jq -Rs so the notes are JSON-encoded properly: the changelog is full of
|
|
# quotes, backticks and newlines, and hand-built JSON would mangle them.
|
|
body="$(jq -Rs . < /tmp/notes.md)"
|
|
payload="$(printf '{"tag_name":%s,"name":%s,"body":%s,"prerelease":%s}' \
|
|
"$(printf '%s' "$TAG" | jq -Rs .)" \
|
|
"$(printf '%s' "$TAG" | jq -Rs .)" \
|
|
"$body" "$prerelease")"
|
|
|
|
existing="$(curl -sf -H "Authorization: token $TOKEN" \
|
|
"$API/releases/tags/$TAG" 2>/dev/null || true)"
|
|
|
|
if [ -n "$existing" ]; then
|
|
id="$(printf '%s' "$existing" | jq -r .id)"
|
|
echo "Release $TAG exists (id=$id) — updating notes."
|
|
curl -sS -X PATCH "$API/releases/$id" \
|
|
-H "Authorization: token $TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
-d "$payload" -o /dev/null -w 'PATCH -> %{http_code}\n'
|
|
else
|
|
curl -sS -X POST "$API/releases" \
|
|
-H "Authorization: token $TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
-d "$payload" -o /dev/null -w 'POST -> %{http_code}\n'
|
|
fi
|