tools: release.sh publishes the ISO, and keeps only the newest one
A release on the Forgejo carries the ISO and its sha256. The server is a small VPS shared with other projects, so publishing a release deletes the ISO from every older one; their notes, tags and checksums stay, with a line saying how to rebuild the image from the tag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01S1giNvrHTrPMPw7V6x1kQ4
This commit is contained in:
Nexoniarz
parent
4265794437
commit
b524a73522
1 changed files with 149 additions and 0 deletions
149
tools/posix/release.sh
Normal file
149
tools/posix/release.sh
Normal file
|
|
@ -0,0 +1,149 @@
|
||||||
|
#!/bin/sh
|
||||||
|
# SPDX-License-Identifier: GPL-2.0-or-later
|
||||||
|
#
|
||||||
|
# Publish a release on the Forgejo the project lives on, with the ISO attached.
|
||||||
|
#
|
||||||
|
# tools/posix/release.sh v0.2.0 notes from the commits since the last tag
|
||||||
|
# tools/posix/release.sh v0.2.0 --notes FILE notes from a file
|
||||||
|
# tools/posix/release.sh v0.2.0 --prerelease
|
||||||
|
# tools/posix/release.sh v0.2.0 --dry-run say what would happen, change nothing
|
||||||
|
#
|
||||||
|
# **Only the newest release keeps its ISO.** The server is a small VPS shared
|
||||||
|
# with other projects, and an ISO is a third of a gigabyte. So publishing one
|
||||||
|
# deletes the ISO from every older release; their notes, tags and checksums
|
||||||
|
# stay, and each says how to rebuild its image from the tag. Every release is
|
||||||
|
# reproducible from its tag -- world.lock pins the packages -- so nothing is
|
||||||
|
# lost but the download.
|
||||||
|
#
|
||||||
|
# The ISO must be built from the commit being released, and that commit must
|
||||||
|
# already be on the server: the release tags it there. The token is read from
|
||||||
|
# $FORGEJO_TOKEN or ~/.config/pandor-git-token and goes only into request
|
||||||
|
# headers, never into a command line that `ps` would show or a file.
|
||||||
|
|
||||||
|
set -eu
|
||||||
|
|
||||||
|
FORGEJO=${FORGEJO:-https://pandor.pl/git}
|
||||||
|
REPO=${REPO:-nexoniarz/SchOS}
|
||||||
|
API="$FORGEJO/api/v1/repos/$REPO"
|
||||||
|
ROOT=$(cd "$(dirname "$0")/../.." && pwd)
|
||||||
|
ISO="$ROOT/schos.iso"
|
||||||
|
|
||||||
|
die() { echo "release: $*" >&2; exit 1; }
|
||||||
|
|
||||||
|
[ $# -ge 1 ] || die "usage: $0 TAG [--notes FILE] [--prerelease] [--dry-run]"
|
||||||
|
TAG=$1; shift
|
||||||
|
NOTES=""; PRE=false; DRY=0
|
||||||
|
while [ $# -gt 0 ]; do
|
||||||
|
case $1 in
|
||||||
|
--notes) NOTES=$2; shift 2 ;;
|
||||||
|
--prerelease) PRE=true; shift ;;
|
||||||
|
--dry-run) DRY=1; shift ;;
|
||||||
|
*) die "unknown option $1" ;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
case $TAG in v[0-9]*) ;; *) die "tags look like v0.2.0, not '$TAG'" ;; esac
|
||||||
|
|
||||||
|
if [ -n "${FORGEJO_TOKEN:-}" ]; then
|
||||||
|
TOKEN=$FORGEJO_TOKEN
|
||||||
|
elif [ -r "$HOME/.config/pandor-git-token" ]; then
|
||||||
|
TOKEN=$(cat "$HOME/.config/pandor-git-token")
|
||||||
|
else
|
||||||
|
die "no token: set FORGEJO_TOKEN or write one to ~/.config/pandor-git-token"
|
||||||
|
fi
|
||||||
|
# curl reads its headers from this file descriptor, so the token is never an
|
||||||
|
# argument.
|
||||||
|
auth() { printf 'Authorization: token %s\n' "$TOKEN"; }
|
||||||
|
api() { # METHOD PATH [curl args...]
|
||||||
|
m=$1; p=$2; shift 2
|
||||||
|
auth | curl -sS --fail-with-body -H @- -X "$m" "$@" "$API$p"
|
||||||
|
}
|
||||||
|
json() { python3 -c "import json,sys; d=json.load(sys.stdin); $1"; }
|
||||||
|
|
||||||
|
SHA=$(git -C "$ROOT" rev-parse HEAD)
|
||||||
|
[ -f "$ISO" ] || die "no schos.iso; run make iso first"
|
||||||
|
# Built after the commit was made, or it is an image of something else.
|
||||||
|
COMMITTED=$(git -C "$ROOT" log -1 --format=%ct HEAD)
|
||||||
|
BUILT=$(stat -c %Y "$ISO" 2>/dev/null || stat -f %m "$ISO")
|
||||||
|
[ "$BUILT" -ge "$COMMITTED" ] || die "schos.iso is older than HEAD; run make iso"
|
||||||
|
if ! git -C "$ROOT" diff --quiet HEAD -- kernel include boot cmd lib ports tools Makefile; then
|
||||||
|
echo "release: warning: the tree has uncommitted changes; the ISO may include them" >&2
|
||||||
|
fi
|
||||||
|
api GET "/git/commits/$SHA" >/dev/null 2>&1 || die "HEAD ($SHA) is not on the server; push first"
|
||||||
|
if api GET "/releases/tags/$TAG" >/dev/null 2>&1; then
|
||||||
|
die "release $TAG already exists"
|
||||||
|
fi
|
||||||
|
|
||||||
|
NAME="schos-$TAG.iso"
|
||||||
|
WORK=$(mktemp -d)
|
||||||
|
trap 'rm -rf "$WORK"' EXIT
|
||||||
|
HASH=$( (sha256sum "$ISO" 2>/dev/null || shasum -a 256 "$ISO") | cut -d' ' -f1)
|
||||||
|
printf '%s %s\n' "$HASH" "$NAME" > "$WORK/$NAME.sha256"
|
||||||
|
SIZE=$(( $(wc -c < "$ISO") / 1048576 ))
|
||||||
|
|
||||||
|
if [ -n "$NOTES" ]; then
|
||||||
|
cp "$NOTES" "$WORK/notes.md"
|
||||||
|
else
|
||||||
|
PREV=$(git -C "$ROOT" describe --tags --abbrev=0 HEAD 2>/dev/null || true)
|
||||||
|
{
|
||||||
|
if [ -n "$PREV" ]; then
|
||||||
|
echo "## Since $PREV"
|
||||||
|
git -C "$ROOT" log --format='- %s' "$PREV..HEAD"
|
||||||
|
else
|
||||||
|
echo "## The first release"
|
||||||
|
echo
|
||||||
|
echo "The most recent changes:"
|
||||||
|
echo
|
||||||
|
git -C "$ROOT" log --format='- %s' -n 30 HEAD
|
||||||
|
fi
|
||||||
|
} > "$WORK/notes.md"
|
||||||
|
fi
|
||||||
|
cat >> "$WORK/notes.md" <<EOF
|
||||||
|
|
||||||
|
## The image
|
||||||
|
|
||||||
|
\`$NAME\` · $SIZE MB · UEFI x86-64 · sha256 \`$HASH\`
|
||||||
|
|
||||||
|
Write it to a USB stick (\`dd if=$NAME of=/dev/sdX bs=4M\`, or Rufus/Etcher in
|
||||||
|
DD mode) and boot it. It runs from RAM and writes nothing to the machine's
|
||||||
|
disks.
|
||||||
|
EOF
|
||||||
|
|
||||||
|
echo "release: $TAG at ${SHA%"${SHA#????????????}"}, $NAME ($SIZE MB)"
|
||||||
|
if [ $DRY = 1 ]; then
|
||||||
|
echo "--- notes ---"; cat "$WORK/notes.md"; echo "-------------"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Older releases first, so a failed upload below never leaves two ISOs on the
|
||||||
|
# server; the worst case is a release without one, fixed by running this again.
|
||||||
|
OLD=$(api GET "/releases?limit=50" | json '
|
||||||
|
for r in d:
|
||||||
|
for a in r["assets"]:
|
||||||
|
if a["name"].endswith(".iso"):
|
||||||
|
print(r["id"], a["id"], r["tag_name"], a["name"])')
|
||||||
|
echo "$OLD" | while read -r rid aid tag name; do
|
||||||
|
[ -n "$rid" ] || continue
|
||||||
|
echo "release: removing $name from $tag"
|
||||||
|
[ $DRY = 1 ] && continue
|
||||||
|
api DELETE "/releases/$rid/assets/$aid" >/dev/null
|
||||||
|
body=$(api GET "/releases/$rid" | json 'print(d["body"])')
|
||||||
|
case $body in *"ISO for this release was removed"*) continue ;; esac
|
||||||
|
printf '%s\n\n_The ISO for this release was removed to make room for newer ones. Build it from the tag: `git checkout %s && make iso`._\n' \
|
||||||
|
"$body" "$tag" | python3 -c 'import json,sys; print(json.dumps({"body": sys.stdin.read()}))' \
|
||||||
|
> "$WORK/patch.json"
|
||||||
|
api PATCH "/releases/$rid" -H 'Content-Type: application/json' --data @"$WORK/patch.json" >/dev/null
|
||||||
|
done
|
||||||
|
|
||||||
|
[ $DRY = 1 ] && { echo "release: dry run; nothing changed"; exit 0; }
|
||||||
|
|
||||||
|
python3 - "$TAG" "$SHA" "$PRE" "$WORK/notes.md" > "$WORK/release.json" <<'EOF'
|
||||||
|
import json, sys
|
||||||
|
tag, sha, pre, notes = sys.argv[1:]
|
||||||
|
print(json.dumps({"tag_name": tag, "target_commitish": sha, "name": "SchOS " + tag,
|
||||||
|
"body": open(notes).read(), "prerelease": pre == "true"}))
|
||||||
|
EOF
|
||||||
|
RID=$(api POST /releases -H 'Content-Type: application/json' --data @"$WORK/release.json" \
|
||||||
|
| json 'print(d["id"])')
|
||||||
|
echo "release: uploading $NAME"
|
||||||
|
api POST "/releases/$RID/assets?name=$NAME" -F "attachment=@$ISO" >/dev/null
|
||||||
|
api POST "/releases/$RID/assets?name=$NAME.sha256" -F "attachment=@$WORK/$NAME.sha256" >/dev/null
|
||||||
|
echo "release: $FORGEJO/$REPO/releases/tag/$TAG"
|
||||||
Loading…
Reference in a new issue