bots-garden/mini-me · 47a9a4e

modified RELEASING.macos.en.md +3 -0 Viewed

@@ -145,10 +145,13 @@ Without `MM_SIGN_IDENTITY`, nothing changes: the macOS binary keeps the ad hoc s
145	145	./local-ci-03-create-draft.sh
146	146	./local-ci-04-upload.sh
147	147	./local-ci-05-publish.sh
	148	+./local-ci-06-promote.sh # optional: the prerelease becomes a release
148	149	```
149	150
150	151	`local-ci-03-create-draft.sh` sees `macos-signature.txt` and adds the line `macOS binary signed with a Developer ID and notarized by Apple` to the release notes. `local-ci-05-publish.sh` downloads every published file and compares it with `release/<TAG>/`: so the binary online is indeed the signed one.
151	152
	153	+`local-ci-05-publish.sh` always publishes a prerelease (and on Rickub a published prerelease already becomes `/releases/latest`). `local-ci-06-promote.sh` then removes the pre-release label: it asks you to type the tag, reads the release back to check it is no longer a prerelease, and refuses a draft or a release that is not a prerelease. The files, the notes and the tag do not change.
	154	+
152	155	### B3. Try it on a Mac
153	156
154	157	1. Download `mm-<version>-darwin-arm64` from the release page, with a browser: the file then carries the quarantine attribute of a real download.

  ./local-ci-03-create-draft.sh
  ./local-ci-04-upload.sh
  ./local-ci-05-publish.sh
++./local-ci-06-promote.sh     # optional: the prerelease becomes a release
  ```
  `local-ci-03-create-draft.sh` sees `macos-signature.txt` and adds the line `macOS binary signed with a Developer ID and notarized by Apple` to the release notes. `local-ci-05-publish.sh` downloads every published file and compares it with `release/<TAG>/`: so the binary online is indeed the signed one.
++`local-ci-05-publish.sh` always publishes a **prerelease** (and on Rickub a published prerelease already becomes `/releases/latest`). `local-ci-06-promote.sh` then removes the pre-release label: it asks you to type the tag, reads the release back to check it is no longer a prerelease, and refuses a draft or a release that is not a prerelease. The files, the notes and the tag do not change.
++
  ### B3. Try it on a Mac
 . Download `mm-<version>-darwin-arm64` from the release page, **with a browser**: the file then carries the quarantine attribute of a real download.

modified RELEASING.macos.fr.md +3 -0 Viewed

@@ -145,10 +145,13 @@ Sans `MM_SIGN_IDENTITY`, rien ne change : le binaire macOS garde la signature ad
145	145	./local-ci-03-create-draft.sh
146	146	./local-ci-04-upload.sh
147	147	./local-ci-05-publish.sh
	148	+./local-ci-06-promote.sh # facultatif : la prerelease devient une release
148	149	```
149	150
150	151	`local-ci-03-create-draft.sh` voit `macos-signature.txt` et ajoute aux notes de la release la ligne `macOS binary signed with a Developer ID and notarized by Apple`. `local-ci-05-publish.sh` télécharge chaque fichier publié et le compare à `release/<TAG>/` : le binaire en ligne est donc bien le binaire signé.
151	152
	153	+`local-ci-05-publish.sh` publie toujours en prerelease (et sur Rickub, une prerelease publiée devient déjà `/releases/latest`). `local-ci-06-promote.sh` retire ensuite l'étiquette « pre-release » : il demande de taper le tag, relit la release pour vérifier qu'elle n'est plus une prerelease, et refuse un brouillon ou une release qui n'est pas une prerelease. Les fichiers, les notes et le tag ne changent pas.
	154	+
152	155	### B3. Essayer sur un Mac
153	156
154	157	1. Téléchargez `mm-<version>-darwin-arm64` depuis la page de la release, avec un navigateur : le fichier porte alors l'attribut de quarantaine d'un vrai téléchargement.

  ./local-ci-03-create-draft.sh
  ./local-ci-04-upload.sh
  ./local-ci-05-publish.sh
++./local-ci-06-promote.sh     # facultatif : la prerelease devient une release
  ```
  `local-ci-03-create-draft.sh` voit `macos-signature.txt` et ajoute aux notes de la release la ligne `macOS binary signed with a Developer ID and notarized by Apple`. `local-ci-05-publish.sh` télécharge chaque fichier publié et le compare à `release/<TAG>/` : le binaire en ligne est donc bien le binaire signé.
++`local-ci-05-publish.sh` publie toujours en **prerelease** (et sur Rickub, une prerelease publiée devient déjà `/releases/latest`). `local-ci-06-promote.sh` retire ensuite l'étiquette « pre-release » : il demande de taper le tag, relit la release pour vérifier qu'elle n'est plus une prerelease, et refuse un brouillon ou une release qui n'est pas une prerelease. Les fichiers, les notes et le tag ne changent pas.
++
  ### B3. Essayer sur un Mac
 . Téléchargez `mm-<version>-darwin-arm64` depuis la page de la release, **avec un navigateur** : le fichier porte alors l'attribut de quarantaine d'un vrai téléchargement.

modified local-ci-00-common.sh +3 -3 Viewed

@@ -9,8 +9,7 @@
9	9	# ./local-ci-03-create-draft.sh the tag and a draft prerelease
10	10	# ./local-ci-04-upload.sh the binaries, through a temporary branch
11	11	# ./local-ci-05-publish.sh the draft becomes public; asks first
12		-#
13		-# Tests only: ./local-ci-09-remove-test-release.sh
	12	+# ./local-ci-06-promote.sh optional: the prerelease becomes a release; asks first
14	13	#
15	14	# Reads TAG, ABOUT, OWNER, REPO, MM_SIGN_IDENTITY and MM_NOTARY_PROFILE from
16	15	# .release.env, and CI_TOKEN from
@@ -59,7 +58,8 @@ release_field() {
59	58	local status
60	59	status="$(call GET /releases)"
61	60	[ "${status}" = "200" ] \|\| { echo "❌ HTTP ${status} listing the releases: $(cat "${work}/body")" >&2; exit 1; }
62		- jq -r --arg tag "${TAG}" --arg field "$1" '[.[] \| select(.tag == $tag)][0][$field] // empty \| tostring' "${work}/body"
	61	+ # Not `// empty`: jq's // also drops false, and "draft": false would read as nothing.
	62	+ jq -r --arg tag "${TAG}" --arg field "$1" '[.[] \| select(.tag == $tag)][0][$field] \| if . == null then empty else tostring end' "${work}/body"
63	63	}
64	64
65	65	# latest_location prints where /releases/latest redirects to.

  #   ./local-ci-03-create-draft.sh   the tag and a draft prerelease
  #   ./local-ci-04-upload.sh         the binaries, through a temporary branch
  #   ./local-ci-05-publish.sh        the draft becomes public; asks first
--#
++#   ./local-ci-06-promote.sh        optional: the prerelease becomes a release; asks first
--# Tests only: ./local-ci-09-remove-test-release.sh
  #
  # Reads TAG, ABOUT, OWNER, REPO, MM_SIGN_IDENTITY and MM_NOTARY_PROFILE from
  # .release.env, and CI_TOKEN from
  	local status
  	status="$(call GET /releases)"
  	[ "${status}" = "200" ] || { echo "❌ HTTP ${status} listing the releases: $(cat "${work}/body")" >&2; exit 1; }
--	jq -r --arg tag "${TAG}" --arg field "$1" '[.[] | select(.tag == $tag)][0][$field] // empty | tostring' "${work}/body"
++	# Not `// empty`: jq's // also drops false, and "draft": false would read as nothing.
++	jq -r --arg tag "${TAG}" --arg field "$1" '[.[] | select(.tag == $tag)][0][$field] | if . == null then empty else tostring end' "${work}/body"
  }
  # latest_location prints where /releases/latest redirects to.

added local-ci-06-promote.sh +44 -0 Viewed

new file mode 100755
@@ -0,0 +1,44 @@
	1	+#!/usr/bin/env bash
	2	+# local-ci-06-promote.sh — a published prerelease becomes a release.
	3	+#
	4	+# ./local-ci-06-promote.sh # the TAG of .release.env
	5	+# ./local-ci-06-promote.sh v1.0.5 # another published prerelease
	6	+#
	7	+# Only the "pre-release" label goes: the files, the notes and the tag stay as
	8	+# they are. On Rickub a published prerelease is already /releases/latest, so
	9	+# downloads should not change. It asks you to type the tag first.
	10	+source "$(dirname "$0")/local-ci-00-common.sh"
	11	+load_token
	12	+
	13	+TAG="${1:-${TAG}}"
	14	+
	15	+id="$(release_field id)"
	16	+[ -n "${id}" ] \|\| { echo "❌ no release ${TAG}"; exit 1; }
	17	+[ "$(release_field draft)" = "false" ] \|\| { echo "❌ ${TAG} is still a draft: run local-ci-05-publish.sh first"; exit 1; }
	18	+[ "$(release_field prerelease)" = "true" ] \|\| { echo "❌ ${TAG} is not a prerelease: nothing to do"; exit 1; }
	19	+
	20	+echo "/releases/latest is now: $(latest_location)"
	21	+echo "Promoting removes the pre-release label from ${TAG}."
	22	+printf 'Type %s to promote: ' "${TAG}"
	23	+read -r answer \|\| answer=""
	24	+[ "${answer}" = "${TAG}" ] \|\| { echo "❌ not promoted"; exit 1; }
	25	+
	26	+status="$(call PATCH "/releases/${id}" -H 'Content-Type: application/json' -d '{"prerelease": false}')"
	27	+[ "${status}" = "200" ] \|\| { echo "❌ HTTP ${status}: $(cat "${work}/body")"; exit 1; }
	28	+
	29	+# Read the release back rather than trusting the 200: a field the server
	30	+# ignores would answer 200 too.
	31	+prerelease="$(release_field prerelease)"
	32	+draft="$(release_field draft)"
	33	+if [ "${prerelease}" != "false" ] \|\| [ "${draft}" != "false" ]; then
	34	+ echo "❌ ${TAG} reads back as prerelease=${prerelease}, draft=${draft}"
	35	+ exit 1
	36	+fi
	37	+
	38	+location="$(latest_location)"
	39	+echo "/releases/latest -> ${location}"
	40	+case "${location}" in
	41	+ *"/${TAG}") ;;
	42	+ *) echo "⚠️ /releases/latest does not point at ${TAG}" ;;
	43	+esac
	44	+echo "✅ ${TAG} is a release"

++#!/usr/bin/env bash
++# local-ci-06-promote.sh — a published prerelease becomes a release.
++#
++#   ./local-ci-06-promote.sh            # the TAG of .release.env
++#   ./local-ci-06-promote.sh v1.0.5     # another published prerelease
++#
++# Only the "pre-release" label goes: the files, the notes and the tag stay as
++# they are. On Rickub a published prerelease is already /releases/latest, so
++# downloads should not change. It asks you to type the tag first.
++source "$(dirname "$0")/local-ci-00-common.sh"
++load_token
++
++TAG="${1:-${TAG}}"
++
++id="$(release_field id)"
++[ -n "${id}" ] || { echo "❌ no release ${TAG}"; exit 1; }
++[ "$(release_field draft)" = "false" ] || { echo "❌ ${TAG} is still a draft: run local-ci-05-publish.sh first"; exit 1; }
++[ "$(release_field prerelease)" = "true" ] || { echo "❌ ${TAG} is not a prerelease: nothing to do"; exit 1; }
++
++echo "/releases/latest is now: $(latest_location)"
++echo "Promoting removes the pre-release label from ${TAG}."
++printf 'Type %s to promote: ' "${TAG}"
++read -r answer || answer=""
++[ "${answer}" = "${TAG}" ] || { echo "❌ not promoted"; exit 1; }
++
++status="$(call PATCH "/releases/${id}" -H 'Content-Type: application/json' -d '{"prerelease": false}')"
++[ "${status}" = "200" ] || { echo "❌ HTTP ${status}: $(cat "${work}/body")"; exit 1; }
++
++# Read the release back rather than trusting the 200: a field the server
++# ignores would answer 200 too.
++prerelease="$(release_field prerelease)"
++draft="$(release_field draft)"
++if [ "${prerelease}" != "false" ] || [ "${draft}" != "false" ]; then
++	echo "❌ ${TAG} reads back as prerelease=${prerelease}, draft=${draft}"
++	exit 1
++fi
++
++location="$(latest_location)"
++echo "/releases/latest -> ${location}"
++case "${location}" in
++	*"/${TAG}") ;;
++	*) echo "⚠️ /releases/latest does not point at ${TAG}" ;;
++esac
++echo "✅ ${TAG} is a release"

deleted local-ci-09-remove-test-release.sh +0 -26 Viewed

deleted file mode 100755
@@ -1,26 +0,0 @@
1		-#!/usr/bin/env bash
2		-# local-ci-09-remove-test-release.sh — delete a test release, for v9.9.9 and
3		-# demo-* only: this must never reach a real one.
4		-#
5		-# ./local-ci-09-remove-test-release.sh # the TAG of .release.env
6		-# ./local-ci-09-remove-test-release.sh demo-002
7		-#
8		-# The tag stays: Rickub refuses to delete one by push, and the API has no route
9		-# for it. Delete it from the repository's Tags page.
10		-source "$(dirname "$0")/local-ci-00-common.sh"
11		-load_token
12		-
13		-TAG="${1:-${TAG}}"
14		-case "${TAG}" in
15		- v9.9.9 \| demo-*) ;;
16		- ) echo "❌ refusing ${TAG}: only v9.9.9 and demo-"; exit 2 ;;
17		-esac
18		-
19		-id="$(release_field id)"
20		-if [ -n "${id}" ]; then
21		- echo "release ${TAG}: HTTP $(call DELETE "/releases/${id}")"
22		-else
23		- echo "release ${TAG}: none"
24		-fi
25		-echo "/releases/latest -> $(latest_location)"
26		-echo "tag ${TAG}: delete it from the Tags page of ${web}"

--#!/usr/bin/env bash
--# local-ci-09-remove-test-release.sh — delete a test release, for v9.9.9 and
--# demo-* only: this must never reach a real one.
--#
--#   ./local-ci-09-remove-test-release.sh           # the TAG of .release.env
--#   ./local-ci-09-remove-test-release.sh demo-002
--#
--# The tag stays: Rickub refuses to delete one by push, and the API has no route
--# for it. Delete it from the repository's Tags page.
--source "$(dirname "$0")/local-ci-00-common.sh"
--load_token
--
--TAG="${1:-${TAG}}"
--case "${TAG}" in
--	v9.9.9 | demo-*) ;;
--	*) echo "❌ refusing ${TAG}: only v9.9.9 and demo-*"; exit 2 ;;
--esac
--
--id="$(release_field id)"
--if [ -n "${id}" ]; then
--	echo "release ${TAG}: HTTP $(call DELETE "/releases/${id}")"
--else
--	echo "release ${TAG}: none"
--fi
--echo "/releases/latest -> $(latest_location)"
--echo "tag ${TAG}: delete it from the Tags page of ${web}"

deleted release-notes/v9.9.9.en.md +0 -7 Viewed

deleted file mode 100644
@@ -1,7 +0,0 @@
1		-# mini-me v9.9.9
2		-
3		-[Version française](v9.9.9.fr.md)
4		-
5		-A test release, not a real version. It checks the local release pipeline (`local-ci-*.sh`): binaries built on a local machine, uploaded through a temporary branch, published as a prerelease. It will be deleted once the test is over.
6		-
7		-Do not install it: use the latest real release from the [releases page](https://rickub.com/bots-garden/mini-me/releases).

--# mini-me v9.9.9
--
--*[Version française](v9.9.9.fr.md)*
--
--**A test release, not a real version.** It checks the local release pipeline (`local-ci-*.sh`): binaries built on a local machine, uploaded through a temporary branch, published as a prerelease. It will be deleted once the test is over.
--
--Do not install it: use the latest real release from the [releases page](https://rickub.com/bots-garden/mini-me/releases).

deleted release-notes/v9.9.9.fr.md +0 -7 Viewed

deleted file mode 100644
@@ -1,7 +0,0 @@
1		-# mini-me v9.9.9
2		-
3		-[English version](v9.9.9.en.md)
4		-
5		-Une release de test, pas une vraie version. Elle vérifie la chaîne de publication locale (`local-ci-*.sh`) : binaires construits sur une machine locale, envoyés par une branche temporaire, publiés en prerelease. Elle sera supprimée à la fin du test.
6		-
7		-Ne l'installez pas : utilisez la dernière vraie release depuis la [page des releases](https://rickub.com/bots-garden/mini-me/releases).

--# mini-me v9.9.9
--
--*[English version](v9.9.9.en.md)*
--
--**Une release de test, pas une vraie version.** Elle vérifie la chaîne de publication locale (`local-ci-*.sh`) : binaires construits sur une machine locale, envoyés par une branche temporaire, publiés en prerelease. Elle sera supprimée à la fin du test.
--
--Ne l'installez pas : utilisez la dernière vraie release depuis la [page des releases](https://rickub.com/bots-garden/mini-me/releases).

🛟 Updated.