mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
db7e84d4f8
## Summary - validate desktop release candidates before merge and keep the repository squash-only - tag the squash commit only after proving frozen-base parent and complete-tree identity with the validated PR head - accept either an exact-head approval or the durable Default-ruleset bypass record as release authorization - remove the unusable App-backed preparation workflow; retain `just release-desktop` ## Ruleset follow-up After this PR merges, update Default ruleset `13596885` to: - enable strict required status checks - dismiss stale reviews on push and require approval after the last push - require the integration-bound `Desktop Release Candidate` check The next desktop release should be cut only after that settings update. ## Verification At commit `d8c254db427eedbcffac1a6e078e90d1d0f5e151` with a clean worktree: - `scripts/test-release-ref-contract.sh` - `scripts/test-desktop-release-candidate.sh` - `bash -n scripts/verify-desktop-release-merge.sh scripts/prepare-desktop-release.sh scripts/test-release-ref-contract.sh` - `git diff --check` The bypass test fixture is the captured rule-suite shape from real squash merge PR #2864 / suite `3520068134`. --------- Signed-off-by: Wes <wesbillman@users.noreply.github.com> Co-authored-by: Carl <c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@buzz.block.builderlab.xyz>
84 lines
3.2 KiB
Bash
Executable File
84 lines
3.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
version="${1:-}"
|
|
mode="${2:-publish}"
|
|
[[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || {
|
|
echo "usage: $0 <semver> [publish|validate-only]" >&2
|
|
exit 1
|
|
}
|
|
|
|
remote="${RELEASE_REMOTE:-origin}"
|
|
git fetch "$remote" refs/heads/main:refs/remotes/origin/main --no-tags
|
|
git fetch "$remote" '+refs/tags/v*:refs/tags/v*' '+refs/tags/desktop-v*:refs/tags/desktop-v*'
|
|
base_sha="$(git rev-parse refs/remotes/origin/main)"
|
|
branch="version-bump/$version"
|
|
|
|
remote_branch="refs/heads/$branch"
|
|
remote_oid=""
|
|
if remote_oid="$(git ls-remote "$remote" "$remote_branch" | awk '{print $1}')" && [[ -n "$remote_oid" ]]; then
|
|
git fetch "$remote" "$remote_branch:refs/remotes/origin/$branch"
|
|
fi
|
|
|
|
git checkout -B "$branch" "$base_sha"
|
|
just bump-desktop-version "$version"
|
|
scripts/desktop_release.py generate "$version" --base "$base_sha" --repo block/buzz
|
|
|
|
git add \
|
|
.release/desktop-candidate.json \
|
|
CHANGELOG.md \
|
|
desktop/package.json \
|
|
desktop/src-tauri/tauri.conf.json \
|
|
desktop/src-tauri/Cargo.toml \
|
|
desktop/src-tauri/Cargo.lock \
|
|
pnpm-lock.yaml
|
|
|
|
agent_name="${RELEASE_AUTOMATION_NAME:-${AGENT_NAME:-Release Automation}}"
|
|
agent_email="${RELEASE_AUTOMATION_EMAIL:-${AGENT_EMAIL:-release-automation@users.noreply.github.com}}"
|
|
msg="$(mktemp)"
|
|
trap 'rm -f "$msg"' EXIT
|
|
cat >"$msg" <<EOF
|
|
chore(release): release Buzz Desktop version $version
|
|
|
|
Co-authored-by: $agent_name <$agent_email>
|
|
EOF
|
|
git -c user.name='Wes' -c user.email='wesbillman@users.noreply.github.com' \
|
|
commit -s -F "$msg"
|
|
scripts/desktop_release.py validate --candidate HEAD --version "$version" --repo block/buzz
|
|
|
|
candidate_sha="$(git rev-parse HEAD)"
|
|
previous_tag="$(python3 -c 'import json; print(json.load(open(".release/desktop-candidate.json"))["previous_tag"] or "initial")')"
|
|
printf 'base_sha=%s\ncandidate_sha=%s\nprevious_tag=%s\ntag=desktop-v%s\n' \
|
|
"$base_sha" "$candidate_sha" "$previous_tag" "$version"
|
|
|
|
if [[ "$mode" == validate-only ]]; then
|
|
exit 0
|
|
fi
|
|
[[ "$mode" == publish ]] || { echo "unknown mode: $mode" >&2; exit 1; }
|
|
if [[ -n "$remote_oid" ]]; then
|
|
git push --force-with-lease="$remote_branch:$remote_oid" "$remote" "HEAD:$remote_branch"
|
|
else
|
|
git push --force-with-lease="$remote_branch:" "$remote" "HEAD:$remote_branch"
|
|
fi
|
|
|
|
body="$(mktemp)"
|
|
trap 'rm -f "$msg" "$body"' EXIT
|
|
cat >"$body" <<EOF
|
|
## Buzz Desktop release v$version
|
|
|
|
- **Frozen main:** \`$base_sha\`
|
|
- **Reviewed candidate:** \`$candidate_sha\`
|
|
- **Previous desktop release:** \`$previous_tag\`
|
|
- **Proposed immutable tag:** \`desktop-v$version\`
|
|
|
|
This PR must be **squash merged** only after the Desktop Release Candidate check passes. The branch must remain based directly on current `main`; stale base, payload drift, incomplete notes, or an unauthorized merge produce no tag.
|
|
|
|
The checked-in changelog accounts for every non-merge commit in the release range. Publication remains bound to the immutable candidate tag.
|
|
EOF
|
|
if existing="$(gh pr list --head "$branch" --state open --json number --jq '.[0].number')" && [[ -n "$existing" ]]; then
|
|
gh pr edit "$existing" --title "chore(release): release Buzz Desktop version $version" --body-file "$body"
|
|
else
|
|
gh pr create --base main --head "$branch" \
|
|
--title "chore(release): release Buzz Desktop version $version" --body-file "$body"
|
|
fi
|