714 lines
31 KiB
Bash
714 lines
31 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
#
|
||
|
|
# Build the container, push it, and leave every version string in the repo
|
||
|
|
# agreeing with the tag that was published.
|
||
|
|
#
|
||
|
|
# npm run release # patch: 0.46.0 -> 0.46.1
|
||
|
|
# npm run release -- minor # 0.46.0 -> 0.47.0
|
||
|
|
# npm run release -- 1.0.0 # exact
|
||
|
|
# npm run release -- --dry-run
|
||
|
|
# npm run release -- --no-prune # keep every published version
|
||
|
|
# RELEASE_KEEP=10 npm run release # keep ten instead of two
|
||
|
|
#
|
||
|
|
# ===========================================================================
|
||
|
|
# TEMPLATE COPY — configure this before the first run
|
||
|
|
# ===========================================================================
|
||
|
|
#
|
||
|
|
# Copy to `scripts/release.sh`, add `"release": "bash scripts/release.sh"` to
|
||
|
|
# package.json, and set the five values in the CONFIGURATION block below. The
|
||
|
|
# script refuses to run until they are set: it has no defaults, deliberately.
|
||
|
|
#
|
||
|
|
# The version it was adapted from carried its origin project's image name,
|
||
|
|
# deploy host and container name as defaults. Copied into a second project and
|
||
|
|
# run once, that would have built the new project's code, pushed it OVER the
|
||
|
|
# first project's image, pruned the first project's published versions, and
|
||
|
|
# read the first project's running container to decide what was safe to delete.
|
||
|
|
# Every one of those is silent and none is reversible. Hence: no defaults, and
|
||
|
|
# a loud failure instead.
|
||
|
|
#
|
||
|
|
# Assumes: bash, git, docker, ssh, and a Node project (`npm version` does the
|
||
|
|
# semver arithmetic). For a non-Node project, replace the two `npm version`
|
||
|
|
# calls and the `node -p` reader; everything else is language-agnostic.
|
||
|
|
#
|
||
|
|
# Assumes a registry with a Forgejo-compatible package API for the prune. If
|
||
|
|
# yours differs, the prune is the only part to rewrite — it is at the bottom
|
||
|
|
# and nothing else depends on it.
|
||
|
|
#
|
||
|
|
# ## Why this exists
|
||
|
|
#
|
||
|
|
# The project this came from had no build or push command at all. `git grep
|
||
|
|
# "docker push"` found nothing, there was no CI, and the README documented a
|
||
|
|
# `docker build` line and never the push. Every release was two commands typed
|
||
|
|
# from memory, and the version bump was a third thing to remember afterwards.
|
||
|
|
#
|
||
|
|
# It was not remembered. `package.json` sat at 0.2.0 across twenty-nine image
|
||
|
|
# releases because nothing read it and nothing checked it; the README and the
|
||
|
|
# example compose file stayed pinned at v0.40.01 while production ran v0.46.0.
|
||
|
|
# The git history shows the ritual dying in stages: one `chore(release)` commit
|
||
|
|
# touched only `.dockerignore`, and two others were empty.
|
||
|
|
#
|
||
|
|
# So the version bump is not a step beside the release. It is what the release
|
||
|
|
# command does, and a test fails when the files disagree. Write that test — see
|
||
|
|
# "The guard test" at the bottom of this header.
|
||
|
|
#
|
||
|
|
# ## package.json is the source of truth
|
||
|
|
#
|
||
|
|
# The tag is always `v` + the version in package.json. Nothing else decides it,
|
||
|
|
# which is why there is no --tag flag: a flag would be a second source of truth
|
||
|
|
# and this whole script exists because there were four.
|
||
|
|
#
|
||
|
|
# Arithmetic is `npm version`, which is built in and enforces semver. That is
|
||
|
|
# load-bearing rather than incidental — it makes a tag like `v0.40.01` (leading
|
||
|
|
# zero in the patch, not valid semver, and a real tag in this registry)
|
||
|
|
# impossible to produce from now on.
|
||
|
|
#
|
||
|
|
# ## The ordering is the safety property
|
||
|
|
#
|
||
|
|
# Bump, build, push, and commit LAST. The rule is: never pass through a state
|
||
|
|
# you cannot explain to somebody reading the repository afterwards.
|
||
|
|
#
|
||
|
|
# If the build or the push fails, the edits are sitting in the working tree —
|
||
|
|
# visible, uncommitted, unpushed, one `git checkout` from gone. If the commit
|
||
|
|
# came first, a failure would leave `main` carrying a commit that announces a
|
||
|
|
# release which was never published, and `post-commit` would have already
|
||
|
|
# pushed it to everyone. One of those is recoverable by noticing; the other is
|
||
|
|
# not.
|
||
|
|
#
|
||
|
|
# ## What it deliberately does not do
|
||
|
|
#
|
||
|
|
# It does not deploy. Whatever runs the container pins a tag, and updating that
|
||
|
|
# pin stays a separate, deliberate act. Publishing an image and running it are
|
||
|
|
# two decisions and this script only makes the first one — so a bad build sits
|
||
|
|
# in a registry rather than in production.
|
||
|
|
#
|
||
|
|
# ## The guard test
|
||
|
|
#
|
||
|
|
# This script is only half the mechanism. The other half is a test asserting
|
||
|
|
# that every file in FILES/PIN_FILES names the same version, so a hand-edit or
|
||
|
|
# a half-finished release fails the suite instead of shipping. Without it,
|
||
|
|
# nothing notices the drift this script was written to end — which is exactly
|
||
|
|
# how the original got to four disagreeing version strings.
|
||
|
|
|
||
|
|
set -uo pipefail
|
||
|
|
|
||
|
|
cd "$(git rev-parse --show-toplevel)" || exit 1
|
||
|
|
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
# CONFIGURATION — set these five, then delete this banner.
|
||
|
|
#
|
||
|
|
# Every one is empty on purpose. See the note at the top: inherited defaults
|
||
|
|
# from another project point a release at that project's image, registry and
|
||
|
|
# running container, and every consequence of that is silent.
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
|
||
|
|
# Fully-qualified image name, no tag. e.g. registry.example.com/team/my-app
|
||
|
|
IMAGE="${RELEASE_IMAGE:-}"
|
||
|
|
|
||
|
|
# The public origin, when the build bakes one in.
|
||
|
|
#
|
||
|
|
# Left empty by default: a project whose artifact carries no origin should not
|
||
|
|
# have one invented for it. But when it is set it is usually frozen into the
|
||
|
|
# build — canonical URLs, Open Graph tags, robots.txt, sitemaps — and cannot be
|
||
|
|
# corrected without another build, so a wrong value ships silently and is found
|
||
|
|
# by somebody else. Validated below rather than trusted.
|
||
|
|
SITE_URL="${RELEASE_SITE_URL:-}"
|
||
|
|
|
||
|
|
# A file sourced for FORGEJO_REGISTRY / FORGEJO_REGISTRY_USER /
|
||
|
|
# FORGEJO_REGISTRY_TOKEN. Keep it OUTSIDE the repository — a token in a file
|
||
|
|
# the repo can see is a token one `git add -A` away from being published.
|
||
|
|
REGISTRY_ENV="${RELEASE_REGISTRY_ENV:-}"
|
||
|
|
|
||
|
|
# The files that carry a version string. Every one of them is checked before
|
||
|
|
# the build and staged after the push; the guard test asserts they agree.
|
||
|
|
#
|
||
|
|
# FILES is what `npm version` rewrites and must exist. PIN_FILES carry an
|
||
|
|
# `IMAGE:vX.Y.Z` pin rewritten by search-and-replace; list only the ones this
|
||
|
|
# project actually has. A project with no compose file leaves PIN_FILES holding
|
||
|
|
# just the README, or empty — an absent file is skipped with a warning rather
|
||
|
|
# than failing the release, because "you do not have that file" and "the
|
||
|
|
# rewrite silently matched nothing" need different answers.
|
||
|
|
FILES=(package.json package-lock.json)
|
||
|
|
PIN_FILES=(README.md docker-compose.example.yml)
|
||
|
|
|
||
|
|
say() { printf '\033[1mrelease:\033[0m %s\n' "$*" >&2; }
|
||
|
|
die() { printf '\033[1mrelease:\033[0m %s\n' "$*" >&2; exit 1; }
|
||
|
|
|
||
|
|
# Refused, never corrected: guessing what somebody meant by a malformed origin
|
||
|
|
# is how the wrong one gets baked in with a reassuring log line above it.
|
||
|
|
if [ -n "$SITE_URL" ]; then
|
||
|
|
case "$SITE_URL" in
|
||
|
|
https://*)
|
||
|
|
printf '%s' "$SITE_URL" \
|
||
|
|
| grep -Eq '^https://[A-Za-z0-9][A-Za-z0-9.-]*\.[A-Za-z]{2,}/?$' \
|
||
|
|
|| die "RELEASE_SITE_URL is not a bare https origin: ${SITE_URL}
|
||
|
|
Expected something like https://example.com, with no path." ;;
|
||
|
|
*)
|
||
|
|
die "RELEASE_SITE_URL must be an https origin, got: ${SITE_URL}" ;;
|
||
|
|
esac
|
||
|
|
fi
|
||
|
|
|
||
|
|
BUMP="patch"
|
||
|
|
DRY_RUN=""
|
||
|
|
NO_PRUNE=""
|
||
|
|
|
||
|
|
# How many versions survive a prune, newest first — published AND local.
|
||
|
|
#
|
||
|
|
# Two is the floor the check below enforces, and it is now also the default:
|
||
|
|
# the newest, plus one to roll back to. It is deliberately tight because the
|
||
|
|
# count that used to matter — how much of the registry we keep — turned out not
|
||
|
|
# to be the expensive one. Releases here are frequent and the deployed tag is
|
||
|
|
# spared on top of this number whatever it is, so the practical floor is three
|
||
|
|
# images, not two.
|
||
|
|
KEEP="${RELEASE_KEEP:-2}"
|
||
|
|
|
||
|
|
# Where the running stack lives, so a prune can find out what is deployed and
|
||
|
|
# refuse to delete it. See the prune section for why this is not optional.
|
||
|
|
#
|
||
|
|
# DEPLOY_HOST is an ssh destination — a Host in ~/.ssh/config, not a password
|
||
|
|
# prompt: the lookup runs with BatchMode=yes and a host that asks for input is
|
||
|
|
# read as "could not determine", which correctly stops the prune.
|
||
|
|
DEPLOY_HOST="${RELEASE_DEPLOY_HOST:-}"
|
||
|
|
DEPLOY_CONTAINER="${RELEASE_DEPLOY_CONTAINER:-}"
|
||
|
|
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
# Refuse to run half-configured.
|
||
|
|
#
|
||
|
|
# Checked here, before the first side effect, and named one at a time so the
|
||
|
|
# message says which value is missing rather than "configuration error".
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
[ -n "$IMAGE" ] || die "set IMAGE (or RELEASE_IMAGE) — the image name to build and push. See the CONFIGURATION block."
|
||
|
|
[ -n "$REGISTRY_ENV" ] || die "set REGISTRY_ENV (or RELEASE_REGISTRY_ENV) — the file holding the registry credentials."
|
||
|
|
[ -n "$DEPLOY_HOST" ] || die "set DEPLOY_HOST (or RELEASE_DEPLOY_HOST) — the ssh host running the deployed container."
|
||
|
|
[ -n "$DEPLOY_CONTAINER" ] || die "set DEPLOY_CONTAINER (or RELEASE_DEPLOY_CONTAINER) — the container name to read the deployed version from."
|
||
|
|
|
||
|
|
# Refused rather than defaulted, because the failure is a publication.
|
||
|
|
#
|
||
|
|
# Docker treats the first path component as a registry only when it contains a
|
||
|
|
# dot or a colon (or is localhost); anything else is a Docker Hub namespace. So
|
||
|
|
# `acme/my-app` is not a private registry that happens to be unreachable — it is
|
||
|
|
# Docker Hub, and a successful push there makes a private project public. That
|
||
|
|
# is not a mistake to discover from the registry's web UI.
|
||
|
|
case "${IMAGE%%/*}" in
|
||
|
|
*.*|*:*|localhost) : ;;
|
||
|
|
*) die "IMAGE ('$IMAGE') has no registry host — '${IMAGE%%/*}' is a Docker Hub
|
||
|
|
namespace, so pushing would publish this image publicly. Use a
|
||
|
|
fully-qualified name like registry.example.com/team/app." ;;
|
||
|
|
esac
|
||
|
|
|
||
|
|
for arg in "$@"; do
|
||
|
|
case "$arg" in
|
||
|
|
--dry-run) DRY_RUN="yes" ;;
|
||
|
|
--no-prune) NO_PRUNE="yes" ;;
|
||
|
|
-*) die "unknown flag $arg. Usage: npm run release -- [patch|minor|major|<version>] [--dry-run] [--no-prune]" ;;
|
||
|
|
*) BUMP="$arg" ;;
|
||
|
|
esac
|
||
|
|
done
|
||
|
|
|
||
|
|
case "$KEEP" in
|
||
|
|
''|*[!0-9]*) die "RELEASE_KEEP must be a whole number, got '$KEEP'." ;;
|
||
|
|
esac
|
||
|
|
|
||
|
|
# Keeping zero would delete the tag this run just published. Refused rather than
|
||
|
|
# clamped, because a caller who typed 0 meant something and it was not that.
|
||
|
|
[ "$KEEP" -ge 2 ] || die "RELEASE_KEEP must be at least 2 — keeping fewer leaves nothing to roll back to."
|
||
|
|
|
||
|
|
# What production is actually running, asked once and remembered.
|
||
|
|
#
|
||
|
|
# Both prunes need it and neither may delete without it, so it is a function
|
||
|
|
# rather than a line copied twice — a second copy is a second thing to keep
|
||
|
|
# correct, and the consequence of getting it wrong is deleting the image the
|
||
|
|
# running container was created from.
|
||
|
|
#
|
||
|
|
# The empty string means "could not determine", which every caller must treat
|
||
|
|
# as a reason to stop rather than as "nothing is deployed".
|
||
|
|
DEPLOYED_VERSION=""
|
||
|
|
DEPLOYED_ASKED=""
|
||
|
|
|
||
|
|
deployed_version() {
|
||
|
|
if [ -z "$DEPLOYED_ASKED" ]; then
|
||
|
|
DEPLOYED_ASKED="yes"
|
||
|
|
DEPLOYED_VERSION=$(ssh -o BatchMode=yes -o ConnectTimeout=10 "$DEPLOY_HOST" \
|
||
|
|
"docker inspect --format '{{index .Config.Labels \"org.opencontainers.image.version\"}}' $DEPLOY_CONTAINER" \
|
||
|
|
2>/dev/null | tr -d '\r\n')
|
||
|
|
fi
|
||
|
|
|
||
|
|
printf '%s' "$DEPLOYED_VERSION"
|
||
|
|
}
|
||
|
|
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
# The same trim, applied to this machine.
|
||
|
|
#
|
||
|
|
# `prune` below deletes published versions. Nothing ever deleted the images this
|
||
|
|
# script BUILDS, so every release since the first left another ~250 MB tag on
|
||
|
|
# the disk: seventy-four of them by the time anyone looked, inside a daemon
|
||
|
|
# holding 79 GB with 47 GB reclaimable.
|
||
|
|
#
|
||
|
|
# ## Scoped to this image by name, and to nothing else
|
||
|
|
#
|
||
|
|
# `docker image prune` is one line and would have reached every project sharing
|
||
|
|
# this daemon, including a build running in another checkout at that moment.
|
||
|
|
# Dangling layers are left alone for the same reason — an untagged layer is not
|
||
|
|
# identifiable as ours, and "probably nobody's" is not ownership. This removes
|
||
|
|
# tags of $IMAGE matching vN.N.N and nothing else.
|
||
|
|
#
|
||
|
|
# ## The deployed tag is spared here too
|
||
|
|
#
|
||
|
|
# A local image is not the copy production pulls, so deleting one is far less
|
||
|
|
# dangerous than deleting a published version — but it is the copy that makes a
|
||
|
|
# rollback instant instead of a download, and it costs nothing to keep. Same
|
||
|
|
# rule, same reason: if the deployed version cannot be read, this does nothing.
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
prune_local() {
|
||
|
|
[ -z "$NO_PRUNE" ] || { say "prune: local images skipped (--no-prune)."; return 0; }
|
||
|
|
|
||
|
|
local deployed
|
||
|
|
deployed=$(deployed_version)
|
||
|
|
|
||
|
|
if [ -z "$deployed" ]; then
|
||
|
|
say "prune: local images SKIPPED — could not read the deployed version."
|
||
|
|
return 0
|
||
|
|
fi
|
||
|
|
|
||
|
|
local tags total keep_from doomed
|
||
|
|
tags=$(docker images --format '{{.Tag}}' "$IMAGE" 2>/dev/null \
|
||
|
|
| grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | sort -V)
|
||
|
|
|
||
|
|
total=$(printf '%s\n' "$tags" | grep -c .)
|
||
|
|
|
||
|
|
if [ "$total" -le "$KEEP" ]; then
|
||
|
|
say "prune: ${total} local image(s), keeping ${KEEP} — nothing to remove."
|
||
|
|
return 0
|
||
|
|
fi
|
||
|
|
|
||
|
|
keep_from=$((total - KEEP))
|
||
|
|
doomed=$(printf '%s\n' "$tags" | head -n "$keep_from" \
|
||
|
|
| grep -v "^${deployed}$" | grep -v "^${TAG}$")
|
||
|
|
|
||
|
|
if [ -z "$doomed" ]; then
|
||
|
|
say "prune: no local images to remove."
|
||
|
|
return 0
|
||
|
|
fi
|
||
|
|
|
||
|
|
if [ -n "$DRY_RUN" ]; then
|
||
|
|
say "prune: would remove $(printf '%s\n' "$doomed" | grep -c .) local image(s):"
|
||
|
|
printf ' %s\n' $doomed >&2
|
||
|
|
return 0
|
||
|
|
fi
|
||
|
|
|
||
|
|
say "prune: removing $(printf '%s\n' "$doomed" | grep -c .) local image(s), keeping"
|
||
|
|
say " the newest ${KEEP} plus ${deployed} (deployed)."
|
||
|
|
|
||
|
|
local tag
|
||
|
|
for tag in $doomed; do
|
||
|
|
# Untagging is all that is asked for. Layers shared with a kept image stay,
|
||
|
|
# and the space is reclaimed only when the last tag referencing them goes —
|
||
|
|
# which is the correct behaviour and why this reports what it untagged
|
||
|
|
# rather than claiming an amount of disk freed.
|
||
|
|
if docker rmi "${IMAGE}:${tag}" >/dev/null 2>&1; then
|
||
|
|
say " removed ${tag}"
|
||
|
|
else
|
||
|
|
# Said out loud, like its published counterpart. A container still using
|
||
|
|
# the image is the usual cause and it is not an error worth stopping for.
|
||
|
|
say " kept ${tag} (still in use, or already gone)"
|
||
|
|
fi
|
||
|
|
done
|
||
|
|
}
|
||
|
|
|
||
|
|
prune() {
|
||
|
|
[ -z "$NO_PRUNE" ] || { say "prune: skipped (--no-prune)."; return 0; }
|
||
|
|
|
||
|
|
if [ -z "${FORGEJO_REGISTRY:-}" ] || [ -z "${FORGEJO_REGISTRY_TOKEN:-}" ]; then
|
||
|
|
say "prune: skipped — no registry credentials."
|
||
|
|
return 0
|
||
|
|
fi
|
||
|
|
|
||
|
|
local owner="${IMAGE#*/}"; owner="${owner%%/*}"
|
||
|
|
local name="${IMAGE##*/}"
|
||
|
|
local api="https://${FORGEJO_REGISTRY}/api/v1/packages/${owner}/container/${name}"
|
||
|
|
|
||
|
|
# What is actually running. Not an optimisation — see the header.
|
||
|
|
local deployed
|
||
|
|
deployed=$(deployed_version)
|
||
|
|
|
||
|
|
if [ -z "$deployed" ]; then
|
||
|
|
say "prune: SKIPPED — could not read the deployed version from"
|
||
|
|
say " ${DEPLOY_HOST}/${DEPLOY_CONTAINER}. Refusing to delete anything"
|
||
|
|
say " without knowing which image production is running."
|
||
|
|
return 0
|
||
|
|
fi
|
||
|
|
|
||
|
|
local versions
|
||
|
|
versions=$(curl -sS --max-time 20 -u "${FORGEJO_REGISTRY_USER}:${FORGEJO_REGISTRY_TOKEN}" \
|
||
|
|
"https://${FORGEJO_REGISTRY}/api/v1/packages/${owner}?type=container&q=${name}" 2>/dev/null \
|
||
|
|
| PKG="$name" node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{
|
||
|
|
console.log(JSON.parse(s).filter(p => p.name === process.env.PKG).map(p => p.version).join("\n"))
|
||
|
|
}catch{process.exit(1)}})' 2>/dev/null)
|
||
|
|
|
||
|
|
if [ -z "$versions" ]; then
|
||
|
|
say "prune: skipped — could not list published versions."
|
||
|
|
return 0
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Semver order, newest last. `latest` is a moving pointer rather than a
|
||
|
|
# release and is never a candidate; it is filtered before anything is counted
|
||
|
|
# so it cannot occupy one of the kept slots either.
|
||
|
|
local candidates
|
||
|
|
candidates=$(printf '%s\n' "$versions" | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | sort -V)
|
||
|
|
|
||
|
|
local total keep_from doomed
|
||
|
|
total=$(printf '%s\n' "$candidates" | grep -c .)
|
||
|
|
|
||
|
|
if [ "$total" -le "$KEEP" ]; then
|
||
|
|
say "prune: ${total} published versions, keeping ${KEEP} — nothing to remove."
|
||
|
|
return 0
|
||
|
|
fi
|
||
|
|
|
||
|
|
keep_from=$((total - KEEP))
|
||
|
|
doomed=$(printf '%s\n' "$candidates" | head -n "$keep_from" | grep -v "^${deployed}$" | grep -v "^${TAG}$")
|
||
|
|
|
||
|
|
local protected
|
||
|
|
protected=$(printf '%s\n' "$candidates" | head -n "$keep_from" | grep -c "^${deployed}$" || true)
|
||
|
|
|
||
|
|
if [ "$protected" -gt 0 ]; then
|
||
|
|
say "prune: keeping ${deployed} — it is what production is running, even"
|
||
|
|
say " though it is old enough to drop."
|
||
|
|
fi
|
||
|
|
|
||
|
|
if [ -z "$doomed" ]; then
|
||
|
|
say "prune: nothing to remove."
|
||
|
|
return 0
|
||
|
|
fi
|
||
|
|
|
||
|
|
say "prune: keeping the newest ${KEEP}, plus ${deployed} (deployed) and latest."
|
||
|
|
|
||
|
|
if [ -n "$DRY_RUN" ]; then
|
||
|
|
say "prune: would remove $(printf '%s\n' "$doomed" | grep -c .) older version(s):"
|
||
|
|
printf ' %s\n' $doomed >&2
|
||
|
|
return 0
|
||
|
|
fi
|
||
|
|
|
||
|
|
say "prune: removing $(printf '%s\n' "$doomed" | grep -c .) older version(s):"
|
||
|
|
|
||
|
|
local version code
|
||
|
|
for version in $doomed; do
|
||
|
|
code=$(curl -sS --max-time 30 -o /dev/null -w '%{http_code}' \
|
||
|
|
-X DELETE -u "${FORGEJO_REGISTRY_USER}:${FORGEJO_REGISTRY_TOKEN}" \
|
||
|
|
"${api}/${version}" 2>/dev/null)
|
||
|
|
|
||
|
|
case "$code" in
|
||
|
|
2*) say " removed ${version}" ;;
|
||
|
|
# Said out loud rather than counted as done. A prune that quietly failed
|
||
|
|
# looks exactly like a prune that had nothing to do.
|
||
|
|
*) say " FAILED ${version} (HTTP ${code:-no response}) — left in place" ;;
|
||
|
|
esac
|
||
|
|
done
|
||
|
|
}
|
||
|
|
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
# Preconditions. Everything that can be checked without side effects, checked
|
||
|
|
# before the first side effect.
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
|
||
|
|
command -v docker >/dev/null 2>&1 || die "docker is not on PATH."
|
||
|
|
|
||
|
|
branch=$(git symbolic-ref --quiet --short HEAD) || die "detached HEAD — check out a branch first."
|
||
|
|
[ "$branch" = "main" ] || die "on '$branch'. Releases are cut from main."
|
||
|
|
|
||
|
|
# Only the release files are required to be clean, not the whole tree. Other
|
||
|
|
# work legitimately shares this checkout, and refusing to release because an
|
||
|
|
# unrelated file is open would make the command useless exactly when it is most
|
||
|
|
# wanted. The commit at the end stages these paths explicitly for the same
|
||
|
|
# reason: whatever else is in the tree is not part of this release.
|
||
|
|
dirty=$(git diff --name-only -- "${FILES[@]}" "${PIN_FILES[@]}" 2>/dev/null;
|
||
|
|
git diff --cached --name-only -- "${FILES[@]}" "${PIN_FILES[@]}" 2>/dev/null)
|
||
|
|
|
||
|
|
if [ -n "$dirty" ]; then
|
||
|
|
say "these release files have uncommitted changes:"
|
||
|
|
printf ' %s\n' $(printf '%s\n' "$dirty" | sort -u) >&2
|
||
|
|
die "commit or discard them first — a release must start from a known version."
|
||
|
|
fi
|
||
|
|
|
||
|
|
current=$(node -p 'require("./package.json").version') || die "cannot read package.json"
|
||
|
|
|
||
|
|
# `npm version` writes the file, so ask it what the answer would be by asking it
|
||
|
|
# somewhere disposable. Cheaper and more honest than reimplementing semver here,
|
||
|
|
# and it means the validation rules are npm's rather than a second opinion.
|
||
|
|
work=$(mktemp -d) || die "cannot create a temporary directory"
|
||
|
|
trap 'rm -rf "$work"' EXIT
|
||
|
|
printf '{"name":"v","version":"%s"}\n' "$current" > "$work/package.json"
|
||
|
|
|
||
|
|
if ! next=$(cd "$work" && npm version --no-git-tag-version "$BUMP" 2>&1 | tr -d 'v\n'); then
|
||
|
|
die "npm rejected '$BUMP': $next"
|
||
|
|
fi
|
||
|
|
|
||
|
|
[ -n "$next" ] || die "could not work out the next version from '$BUMP'."
|
||
|
|
|
||
|
|
TAG="v${next}"
|
||
|
|
|
||
|
|
say "$current -> $next (image ${IMAGE}:${TAG})"
|
||
|
|
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
# Refuse to move a tag that is already published.
|
||
|
|
#
|
||
|
|
# Overwriting one would silently change what a running stack pulls on its next
|
||
|
|
# recreate, and the old image would still be running with no way to tell from
|
||
|
|
# the tag. A published tag is immutable by convention here; this makes it
|
||
|
|
# immutable in practice.
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
|
||
|
|
if [ -r "$REGISTRY_ENV" ]; then
|
||
|
|
# shellcheck disable=SC1090
|
||
|
|
. "$REGISTRY_ENV"
|
||
|
|
fi
|
||
|
|
|
||
|
|
if [ -n "${FORGEJO_REGISTRY:-}" ] && [ -n "${FORGEJO_REGISTRY_TOKEN:-}" ]; then
|
||
|
|
repo="${IMAGE#*/}"
|
||
|
|
tags=$(curl -sS --max-time 20 -u "${FORGEJO_REGISTRY_USER}:${FORGEJO_REGISTRY_TOKEN}" \
|
||
|
|
"https://${FORGEJO_REGISTRY}/v2/${repo}/tags/list" 2>/dev/null)
|
||
|
|
|
||
|
|
if printf '%s' "$tags" | grep -q "\"${TAG}\""; then
|
||
|
|
die "${TAG} is already published. Pick a higher version — a published tag is not moved."
|
||
|
|
fi
|
||
|
|
|
||
|
|
if [ -z "$tags" ]; then
|
||
|
|
# Said out loud rather than passed over. "I could not check" and "it is not
|
||
|
|
# there" are different answers and only one of them is safe to act on.
|
||
|
|
say "WARNING: could not read the registry tag list. Proceeding without the"
|
||
|
|
say " already-published check."
|
||
|
|
fi
|
||
|
|
else
|
||
|
|
say "WARNING: no registry credentials at $REGISTRY_ENV — cannot check whether"
|
||
|
|
say " ${TAG} is already published."
|
||
|
|
fi
|
||
|
|
|
||
|
|
if [ -n "$DRY_RUN" ]; then
|
||
|
|
say "--dry-run: nothing was changed. It would have:"
|
||
|
|
# Only the ones actually present, for the reason the whole script exists:
|
||
|
|
# a "would have" line naming a file this project does not have is a claim.
|
||
|
|
present=("${FILES[@]}")
|
||
|
|
for file in "${PIN_FILES[@]}"; do [ -f "$file" ] && present+=("$file"); done
|
||
|
|
say " set version ${next} in ${present[*]}"
|
||
|
|
say " docker build --build-arg APP_VERSION=${TAG} -t ${IMAGE}:${TAG} ."
|
||
|
|
say " docker push ${IMAGE}:${TAG}"
|
||
|
|
say " git commit -m 'chore(release): ${TAG}' (post-commit then pushes)"
|
||
|
|
say ""
|
||
|
|
say "and then pruned. That part is shown for real, because it deletes:"
|
||
|
|
prune
|
||
|
|
prune_local
|
||
|
|
exit 0
|
||
|
|
fi
|
||
|
|
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
# Bump. Files first, so the image is built from the source that names it.
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
|
||
|
|
npm version --no-git-tag-version --allow-same-version "$next" >/dev/null \
|
||
|
|
|| die "npm version failed; nothing has been built or pushed."
|
||
|
|
|
||
|
|
# The pins that drifted for six releases in the original. Anchored on the image
|
||
|
|
# name so this cannot match a version string belonging to something else.
|
||
|
|
#
|
||
|
|
# A listed file that does not exist is a configuration fact, not a failure: not
|
||
|
|
# every project has a compose file. It is said out loud rather than passed over,
|
||
|
|
# because "you do not have that file" and "the rewrite matched nothing" have the
|
||
|
|
# same appearance and only one of them is fine.
|
||
|
|
BUMPED=("${FILES[@]}")
|
||
|
|
|
||
|
|
for file in "${PIN_FILES[@]}"; do
|
||
|
|
if [ ! -f "$file" ]; then
|
||
|
|
say "note: $file is listed in PIN_FILES but does not exist — skipping."
|
||
|
|
continue
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Only files that already carry a pin. A README that never mentioned the
|
||
|
|
# image is not a drift risk and must not become a failure.
|
||
|
|
grep -q "${IMAGE}:v" "$file" || { say "note: $file carries no ${IMAGE} pin — skipping."; continue; }
|
||
|
|
|
||
|
|
perl -pi -e "s{\Q${IMAGE}\E:v[0-9][0-9.]*}{${IMAGE}:${TAG}}g" "$file" \
|
||
|
|
|| die "could not rewrite the pin in $file"
|
||
|
|
|
||
|
|
# Checked, not assumed. A rewrite that silently matched nothing would produce
|
||
|
|
# a release whose own guard test fails on the next commit.
|
||
|
|
grep -q "${IMAGE}:${TAG}" "$file" || die "the pin in $file did not update — refusing to build."
|
||
|
|
|
||
|
|
BUMPED+=("$file")
|
||
|
|
done
|
||
|
|
|
||
|
|
say "bumped ${BUMPED[*]}"
|
||
|
|
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
# Guards, before anything is built.
|
||
|
|
#
|
||
|
|
# ## Why they are here and not left to the commit hook
|
||
|
|
#
|
||
|
|
# `pre-commit` runs the typecheck and the suite, and the commit is the LAST step
|
||
|
|
# of this script — after the push. So relying on it means the gate fires once
|
||
|
|
# the image is already published and cannot be unpublished: the hook would
|
||
|
|
# refuse the commit, and the registry would be left holding a tag whose tests
|
||
|
|
# never passed, with git carrying no record of it. The first real release
|
||
|
|
# through this script did exactly that, and passed only by luck.
|
||
|
|
#
|
||
|
|
# ## A missing test database refuses the release, it does not warn about it
|
||
|
|
#
|
||
|
|
# Without TEST_DATABASE_URL the database suites skip themselves, which on a
|
||
|
|
# repository of any size is a large fraction of the tests. That is the right
|
||
|
|
# default for a laptop with no Postgres and the wrong default for cutting a
|
||
|
|
# release — and warning about it while building anyway is the worst of the
|
||
|
|
# three, because the summary above it still says the tests passed.
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
|
||
|
|
if [ -z "${SKIP_GUARDS:-}" ]; then
|
||
|
|
say "typecheck…"
|
||
|
|
|
||
|
|
if ! npx tsc --noEmit; then
|
||
|
|
say "typecheck failed. The bump is in your working tree; nothing was built,"
|
||
|
|
say " published or committed."
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
# A warning is not a gate.
|
||
|
|
#
|
||
|
|
# This printed three lines saying half the suite would skip and then cut the
|
||
|
|
# release anyway. A gate that reports "tests passed" for a run which never
|
||
|
|
# touched the database is worse than no gate, because it is trusted — and the
|
||
|
|
# project this script came from shipped every release that way for months
|
||
|
|
# before anybody added up the numbers.
|
||
|
|
#
|
||
|
|
# So: use what is set, otherwise adopt a local test database if one is
|
||
|
|
# listening, and refuse if neither. The escape hatch stays for the machine
|
||
|
|
# with no database — which is what the warning was protecting — but it has to
|
||
|
|
# be asked for by name rather than being the default.
|
||
|
|
if [ -z "${TEST_DATABASE_URL:-}" ]; then
|
||
|
|
if [ -n "${RELEASE_TEST_DB_PORT:-}" ] \
|
||
|
|
&& (exec 3<>/dev/tcp/127.0.0.1/"${RELEASE_TEST_DB_PORT}") 2>/dev/null; then
|
||
|
|
exec 3<&- 2>/dev/null || true
|
||
|
|
export TEST_DATABASE_URL="${RELEASE_TEST_DB_URL:?set RELEASE_TEST_DB_URL beside RELEASE_TEST_DB_PORT}"
|
||
|
|
say "TEST_DATABASE_URL was unset; using the local test database on ${RELEASE_TEST_DB_PORT}."
|
||
|
|
elif [ -n "${RELEASE_ALLOW_SKIPPED_TESTS:-}" ]; then
|
||
|
|
say "WARNING: no test database, and RELEASE_ALLOW_SKIPPED_TESTS is set."
|
||
|
|
say " The database suites will SKIP. You are cutting a release"
|
||
|
|
say " that has not been fully tested."
|
||
|
|
else
|
||
|
|
die "no test database, so the database suites would silently skip.
|
||
|
|
|
||
|
|
Set TEST_DATABASE_URL, or set RELEASE_TEST_DB_PORT and RELEASE_TEST_DB_URL
|
||
|
|
so this script can find the local one, or pass RELEASE_ALLOW_SKIPPED_TESTS=1
|
||
|
|
to cut a release knowing it is half-tested."
|
||
|
|
fi
|
||
|
|
fi
|
||
|
|
|
||
|
|
say "tests…"
|
||
|
|
|
||
|
|
if ! npx vitest run --reporter=dot; then
|
||
|
|
say "tests failed. The bump is in your working tree; nothing was built,"
|
||
|
|
say " published or committed."
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
else
|
||
|
|
say "SKIP_GUARDS set — typecheck and tests did NOT run before this release."
|
||
|
|
fi
|
||
|
|
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
# Build, then push. Nothing is committed until both have succeeded.
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
|
||
|
|
say "building ${IMAGE}:${TAG}…"
|
||
|
|
|
||
|
|
if ! docker build \
|
||
|
|
--build-arg "NEXT_PUBLIC_SITE_URL=${SITE_URL}" \
|
||
|
|
--build-arg "APP_VERSION=${TAG}" \
|
||
|
|
-t "${IMAGE}:${TAG}" . ; then
|
||
|
|
say "build failed. The version bump is in your working tree and NOTHING was"
|
||
|
|
say " published or committed. Fix the build and run this again, or"
|
||
|
|
say " 'git checkout -- ${BUMPED[*]}' to undo the bump."
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Verify before trusting it — the same move a backup script makes with `pg_restore
|
||
|
|
# --list` before renaming a dump into place. The Dockerfile threads APP_VERSION
|
||
|
|
# through two stage-scoped ARGs and an ENV; drop any one of them and the build
|
||
|
|
# still succeeds, the tests still pass, and the only symptom is the settings
|
||
|
|
# screen reading "running from source" in production. Ask the image directly
|
||
|
|
# rather than trusting that the wiring is still there.
|
||
|
|
#
|
||
|
|
# `docker run` with a command overrides CMD, so this starts no server and needs
|
||
|
|
# no database.
|
||
|
|
say "verifying the image reports ${TAG}…"
|
||
|
|
|
||
|
|
baked=$(docker run --rm --entrypoint printenv "${IMAGE}:${TAG}" APP_VERSION 2>/dev/null | tr -d '\r\n')
|
||
|
|
|
||
|
|
if [ "$baked" != "$TAG" ]; then
|
||
|
|
# Remove the local tag. A correctly-named image with the wrong contents is a
|
||
|
|
# loaded gun for a later hand-typed `docker push`.
|
||
|
|
docker rmi "${IMAGE}:${TAG}" >/dev/null 2>&1
|
||
|
|
say "the image reports '${baked:-nothing}' but should report ${TAG}."
|
||
|
|
say " Check ARG/ENV APP_VERSION in the runner stage of the Dockerfile."
|
||
|
|
say " Nothing was published or committed; the local image was removed."
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
say "pushing ${IMAGE}:${TAG}…"
|
||
|
|
|
||
|
|
if ! docker push "${IMAGE}:${TAG}"; then
|
||
|
|
say "push failed. The image exists locally and the bump is in your working"
|
||
|
|
say " tree, but nothing was published or committed. Check the registry"
|
||
|
|
say " login and run this again."
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
# Commit last, by explicit path.
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
|
||
|
|
git add -- "${BUMPED[@]}" || die "git add failed after a successful push — commit ${BUMPED[*]} by hand."
|
||
|
|
|
||
|
|
# pre-commit runs the typecheck, and the suite when a .ts/.tsx is staged. None
|
||
|
|
# of these paths are, so this gets the typecheck only — which is what catches a
|
||
|
|
# package.json this script has mangled.
|
||
|
|
if ! git commit -q -m "chore(release): ${TAG}"; then
|
||
|
|
say "the commit was refused (see above). The image IS published as ${TAG};"
|
||
|
|
say " only the commit is missing. Fix and commit ${BUMPED[*]} by hand."
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
say "released ${TAG}."
|
||
|
|
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
# Prune old published versions.
|
||
|
|
#
|
||
|
|
# ## Last, and deliberately so
|
||
|
|
#
|
||
|
|
# The release is complete by this point — image published, files bumped, commit
|
||
|
|
# made. Everything below is housekeeping, and housekeeping must never be able to
|
||
|
|
# fail a release that already succeeded. Nothing here exits non-zero.
|
||
|
|
#
|
||
|
|
# ## It refuses to run blind
|
||
|
|
#
|
||
|
|
# Deleting a published version is irreversible and the registry is the only copy
|
||
|
|
# — there is no `git revert` for a pushed image. The one that actually matters
|
||
|
|
# is the version PRODUCTION IS RUNNING, and that is routinely an old tag: at the
|
||
|
|
# time this was written the stack pinned v0.54.0 while v0.54.3 was the newest,
|
||
|
|
# because deploying is a separate manual step. A newest-N rule with no
|
||
|
|
# knowledge of that would eventually delete the image the running container was
|
||
|
|
# created from, and the failure surfaces later — at the next recreate, when the
|
||
|
|
# stack cannot pull the tag it pins and the site does not come back.
|
||
|
|
#
|
||
|
|
# So the deployed tag is looked up, and if it cannot be determined the prune is
|
||
|
|
# skipped entirely. "I could not check" is not "there is nothing to protect",
|
||
|
|
# and only one of those is safe to act on — the same rule the published-tag
|
||
|
|
# check above follows.
|
||
|
|
#
|
||
|
|
# ## By version name, not by digest
|
||
|
|
#
|
||
|
|
# The v2 API deletes a manifest by digest, and two tags can point at the same
|
||
|
|
# digest — `latest` here does. A digest delete would take both and the second
|
||
|
|
# one would be silent. Forgejo's package API deletes the version that was named,
|
||
|
|
# which is the only thing this ever wants to do.
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
|
||
|
|
prune
|
||
|
|
prune_local
|
||
|
|
|
||
|
|
say "note: this published an image. It did not deploy it — whatever runs the"
|
||
|
|
say " container still pins its own tag and that edit is a separate step."
|