Evan Hu
d59be91390
release.yml had grown thirteen inline shell and PowerShell blocks, some of them twenty lines, which made the workflow hard to read and impossible to lint or run outside Actions. Each one is now a file under scripts/ci and the workflow only wires them up. Two things fall out of the move rather than being separate changes. The two signing steps were near-duplicates and are now one sign-binaries.ps1 taking a path list, used for both the packaged binaries and the finished installer. The pinned Inno Setup language file URL and checksum move to the packaging job's env, where they read as configuration instead of being buried mid-script. The Server job now checks this repository out into automation/ for its two scripts. That checkout has to come after the MSIME-Server one, because checkout cleans its destination and the workspace root would take automation/ with it. shellcheck is clean on all six shell scripts. The PowerShell is not syntax-checked here for lack of pwsh, but four of the seven are verbatim from steps that already ran green in run 33953797415.
36 lines
1.4 KiB
Bash
Executable File
36 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Check that a manually requested tag names an unpublished draft release pinned to an immutable
|
|
# commit whose version.txt agrees with the tag, then report the commit and version for the build
|
|
# jobs to use. Nothing is built until this passes.
|
|
#
|
|
# Requires GH_TOKEN, GH_REPO, TAG_NAME. Writes target_sha and version to GITHUB_OUTPUT.
|
|
set -euo pipefail
|
|
|
|
if [[ ! "$TAG_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
|
|
echo "Tag must use the vMAJOR.MINOR.PATCH format, got '$TAG_NAME'." >&2
|
|
exit 1
|
|
fi
|
|
|
|
release_json=$(gh release view "$TAG_NAME" --json isDraft,targetCommitish)
|
|
|
|
if [[ "$(jq -er .isDraft <<< "$release_json")" != true ]]; then
|
|
echo "Release $TAG_NAME is not an unpublished draft." >&2
|
|
exit 1
|
|
fi
|
|
|
|
target_sha=$(jq -er .targetCommitish <<< "$release_json")
|
|
if [[ ! "$target_sha" =~ ^[0-9a-f]{40}$ ]]; then
|
|
echo "Draft release target must be an immutable full commit SHA, got '$target_sha'." >&2
|
|
exit 1
|
|
fi
|
|
|
|
version=$(gh api "repos/$GH_REPO/contents/version.txt?ref=$target_sha" --jq .content | base64 --decode | tr -d '[:space:]')
|
|
if [[ "$TAG_NAME" != "v$version" ]]; then
|
|
echo "Release $TAG_NAME does not match version.txt ($version)." >&2
|
|
exit 1
|
|
fi
|
|
|
|
printf 'target_sha=%s\n' "$target_sha" >> "$GITHUB_OUTPUT"
|
|
printf 'version=%s\n' "$version" >> "$GITHUB_OUTPUT"
|
|
echo "Draft $TAG_NAME is valid: version $version at $target_sha"
|