feat: Gitea CI, and releases built once, previewed and promoted as one file
ci.yml runs tools/check.sh and the container gate on every push and pull request, with no secrets. Release 1 builds a version from its release commit on master or release/*, gates it, and keeps it in a Gitea pre-release. Release 2 gates that file again on the CI runner and publishes it to canary (Preview) from the release runner. Release 3 promotes the file Preview ran, on a person's approval. Import records a release from before Gitea kept the record. All of it is tools/release-ci.sh calling the existing scripts. docs/releasing.md: tracks, branches, each step, immutability, rollback, secrets, runners, Nightly and the hardware lab as designs, the Gitea administration still to do, and what was measured to make it. Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
ekklesia
co-authored by
Claude Opus 5.5
Claude Opus 5.5
parent
583f9b1809
commit
22f25854aa
Executable
+276
@@ -0,0 +1,276 @@
|
||||
#!/bin/bash
|
||||
# Preview, Stable and import, end to end, as the Gitea workflows run them.
|
||||
#
|
||||
# Nothing here reaches the real update server or the real Gitea. The
|
||||
# update server is a directory served over HTTP on the loopback, with ssh
|
||||
# and rsync stand-ins that act on it (as in test-release-versions.sh);
|
||||
# Gitea is tests/fake-gitea.py. What runs is the real thing:
|
||||
# tools/release-ci.sh, update_canary.sh, update_stable.sh,
|
||||
# tools/release-gate.sh --still-current and tools/gitea-release.
|
||||
#
|
||||
# The container gate itself needs Docker and is not run here: a gate
|
||||
# report stands in for it, and the question is whether a report that
|
||||
# must not be relied on ever is.
|
||||
set -uo pipefail
|
||||
|
||||
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
WORK="$(mktemp -d)"
|
||||
PIDS=()
|
||||
|
||||
cleanup() {
|
||||
for pid in "${PIDS[@]}"; do kill "$pid" 2>/dev/null; done
|
||||
rm -rf "$WORK"
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
passed=0
|
||||
failed=0
|
||||
|
||||
check() {
|
||||
local label="$1"
|
||||
shift
|
||||
|
||||
if "$@" >"$WORK/last.log" 2>&1; then
|
||||
echo " ok $label"
|
||||
passed=$((passed + 1))
|
||||
else
|
||||
echo " FAIL $label"
|
||||
sed 's/^/ /' "$WORK/last.log" | tail -n 8
|
||||
failed=$((failed + 1))
|
||||
fi
|
||||
}
|
||||
|
||||
refuses() {
|
||||
! "$@"
|
||||
}
|
||||
|
||||
# Refused, and for the reason given: a refusal for some other reason
|
||||
# would pass a test that means nothing.
|
||||
refuses_saying() {
|
||||
local reason="$1" out
|
||||
shift
|
||||
out="$("$@" 2>&1)" && return 1
|
||||
grep -qF -- "$reason" <<< "$out" || { printf '%s\n' "$out"; return 1; }
|
||||
}
|
||||
|
||||
fake_deb() {
|
||||
local version="$1" out="$2" stage="$WORK/stage-$version-$RANDOM"
|
||||
|
||||
mkdir -p "$stage/DEBIAN"
|
||||
printf 'Package: ekklesia-classroom\nVersion: %s\nArchitecture: amd64\nMaintainer: test\nDescription: test %s\n' \
|
||||
"$version" "${3:-}" > "$stage/DEBIAN/control"
|
||||
dpkg-deb --root-owner-group --build "$stage" "$out" >/dev/null
|
||||
}
|
||||
|
||||
sha() { sha256sum "$1" | awk '{print $1}'; }
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# The update server: stable on 0.2.6.4, canary on 0.2.6.5.
|
||||
SERVER="$WORK/server"
|
||||
mkdir -p "$SERVER/packages" "$SERVER/stable" "$SERVER/canary" "$WORK/bin"
|
||||
|
||||
for version in 0.2.2 0.2.6.4 0.2.6.5; do
|
||||
fake_deb "$version" "$SERVER/packages/ekklesia-classroom_${version}_amd64.deb"
|
||||
done
|
||||
|
||||
point() {
|
||||
local channel="$1" version="$2" name="ekklesia-classroom_$2_amd64.deb"
|
||||
printf '{\n "version": "%s",\n "package": "/packages/%s",\n "sha256": "%s",\n "requires_reboot": true\n}\n' \
|
||||
"$version" "$name" "$(sha "$SERVER/packages/$name")" > "$SERVER/$channel/manifest.json"
|
||||
ln -sfn "../packages/$name" "$SERVER/$channel/latest.deb"
|
||||
}
|
||||
|
||||
point stable 0.2.6.4
|
||||
point canary 0.2.6.5
|
||||
|
||||
cat > "$WORK/bin/ssh" <<'EOF'
|
||||
#!/bin/bash
|
||||
shift
|
||||
exec bash -c "$*"
|
||||
EOF
|
||||
cat > "$WORK/bin/rsync" <<'EOF'
|
||||
#!/bin/bash
|
||||
keep=0
|
||||
args=()
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--ignore-existing) keep=1 ;;
|
||||
-e) shift ;;
|
||||
-*) ;;
|
||||
*) args+=("$1") ;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
source="${args[0]}"
|
||||
dest="${args[1]#*:}"
|
||||
[[ -d "$dest" ]] && dest="$dest/$(basename "$source")"
|
||||
[[ "$keep" == 1 && -e "$dest" ]] && exit 0
|
||||
cp "$source" "$dest"
|
||||
EOF
|
||||
chmod +x "$WORK/bin/ssh" "$WORK/bin/rsync"
|
||||
|
||||
port() { python3 -c 'import socket; s = socket.socket(); s.bind(("127.0.0.1", 0)); print(s.getsockname()[1])'; }
|
||||
|
||||
HTTP_PORT="$(port)"
|
||||
python3 -m http.server --bind 127.0.0.1 --directory "$SERVER" "$HTTP_PORT" >/dev/null 2>&1 &
|
||||
PIDS+=($!)
|
||||
|
||||
python3 "$ROOT/tests/fake-gitea.py" > "$WORK/gitea-port" 2>/dev/null &
|
||||
PIDS+=($!)
|
||||
|
||||
for _ in $(seq 1 50); do
|
||||
[[ -s "$WORK/gitea-port" ]] && curl -fsS "http://127.0.0.1:$HTTP_PORT/stable/manifest.json" >/dev/null 2>&1 && break
|
||||
sleep 0.1
|
||||
done
|
||||
|
||||
export PATH="$WORK/bin:$PATH"
|
||||
export RELEASE_HOST=stand-in RELEASE_ROOT="$SERVER" RELEASE_URL="http://127.0.0.1:$HTTP_PORT"
|
||||
export GITEA_URL="http://127.0.0.1:$(cat "$WORK/gitea-port")" GITEA_REPO=church/classroom GITEA_TOKEN=not-a-real-token
|
||||
unset GITHUB_RUN_NUMBER GITHUB_REF GITHUB_OUTPUT RELEASE_SSH_KEY
|
||||
CI="$ROOT/tools/release-ci.sh"
|
||||
GITEA="$ROOT/tools/gitea-release"
|
||||
COMMIT="$(git -C "$ROOT" rev-parse HEAD)"
|
||||
|
||||
ci() { RELEASE_CI_WORK="$(mktemp -d -p "$WORK")" "$CI" "$@"; }
|
||||
notes() { "$GITEA" notes "$1"; }
|
||||
serves() { python3 -c 'import json, sys; print(json.load(open(sys.argv[1]))["version"])' "$SERVER/$1/manifest.json"; }
|
||||
packages() { (cd "$SERVER/packages" && sha256sum -- *.deb); }
|
||||
|
||||
# A release as "Release 1 - build" leaves it: the package and its
|
||||
# SHA256SUMS, in a Gitea pre-release.
|
||||
make_release() {
|
||||
local version="$1" dir="$WORK/built-$1" name="ekklesia-classroom_$1_amd64.deb"
|
||||
mkdir -p "$dir"
|
||||
fake_deb "$version" "$dir/$name"
|
||||
(cd "$dir" && sha256sum "$name" > SHA256SUMS)
|
||||
printf 'notes\n' > "$dir/notes.md"
|
||||
"$GITEA" create "v$version" "$COMMIT" "Ekklesia Classroom $version" "$dir/notes.md" --prerelease >/dev/null
|
||||
"$GITEA" upload "v$version" "$dir/$name" "$dir/SHA256SUMS" >/dev/null
|
||||
sha "$dir/$name"
|
||||
}
|
||||
|
||||
# A gate report as tools/release-gate.sh writes one.
|
||||
report() {
|
||||
local out="$1" version="$2" hash="$3" canary="$4" stable="$5" mode="${6:-release}"
|
||||
local name="ekklesia-classroom_${version}_amd64.deb"
|
||||
{
|
||||
echo "release gate for $name"
|
||||
echo "sha256 $hash"
|
||||
echo "mode $mode"
|
||||
echo "started 2026-09-29T00:00:00Z"
|
||||
echo "PASS fresh install of $version (a new machine, on stable) (5 min)"
|
||||
echo "PASS upgrade $canary -> $version on a canary room (canary serves $canary) (5 min)"
|
||||
echo "PASS upgrade $stable -> $version on a stable room (stable serves $stable) (5 min)"
|
||||
echo "finished 2026-09-29T00:20:00Z: $name passed the release gate"
|
||||
} > "$out"
|
||||
}
|
||||
|
||||
H6="$(make_release 0.2.6.6)"
|
||||
PKG6="$WORK/built-0.2.6.6/ekklesia-classroom_0.2.6.6_amd64.deb"
|
||||
mkdir -p "$WORK/reports"
|
||||
report "$WORK/reports/gate-report-preview-good.txt" 0.2.6.6 "$H6" 0.2.6.5 0.2.6.4
|
||||
report "$WORK/reports/gate-report-preview-other.txt" 0.2.6.6 "$(printf 'f%.0s' {1..64})" 0.2.6.5 0.2.6.4
|
||||
report "$WORK/reports/gate-report-preview-stale.txt" 0.2.6.6 "$H6" 0.2.6.3 0.2.6.4
|
||||
report "$WORK/reports/gate-report-preview-ci.txt" 0.2.6.6 "$H6" 0.2.6.5 0.2.6.4 ci
|
||||
head -n -1 "$WORK/reports/gate-report-preview-good.txt" > "$WORK/reports/gate-report-preview-unfinished.txt"
|
||||
"$GITEA" upload v0.2.6.6 "$WORK"/reports/*.txt >/dev/null
|
||||
before="$(packages)"
|
||||
|
||||
echo "1. a gate report is only relied on when it is about these bytes, now"
|
||||
GATE="$ROOT/tools/release-gate.sh"
|
||||
check "a passing release report for this file, from what the channels serve, is current" \
|
||||
"$GATE" --still-current "$WORK/reports/gate-report-preview-good.txt" "$PKG6"
|
||||
check "one about other bytes is not" \
|
||||
refuses_saying "it is about other bytes" "$GATE" --still-current "$WORK/reports/gate-report-preview-other.txt" "$PKG6"
|
||||
check "nor one made before canary moved" \
|
||||
refuses_saying "canary serves 0.2.6.5 now" "$GATE" --still-current "$WORK/reports/gate-report-preview-stale.txt" "$PKG6"
|
||||
check "nor a CI gate's report" \
|
||||
refuses_saying "not a release gate's report" "$GATE" --still-current "$WORK/reports/gate-report-preview-ci.txt" "$PKG6"
|
||||
check "nor one that never finished" \
|
||||
refuses_saying "does not end in a pass" "$GATE" --still-current "$WORK/reports/gate-report-preview-unfinished.txt" "$PKG6"
|
||||
|
||||
echo "2. Preview: the release's file, to canary, on a current report"
|
||||
check "a checksum that is not the release's is refused" \
|
||||
refuses_saying "is not sha256 eeee" ci preview 0.2.6.6 "$(printf 'e%.0s' {1..64})" gate-report-preview-good.txt
|
||||
check "a stale report is refused" \
|
||||
refuses_saying "canary serves 0.2.6.5 now" ci preview 0.2.6.6 "$H6" gate-report-preview-stale.txt
|
||||
check "a report for other bytes is refused" \
|
||||
refuses_saying "it is about other bytes" ci preview 0.2.6.6 "$H6" gate-report-preview-other.txt
|
||||
check "and after all of that, canary is where it was and no package was added" \
|
||||
bash -c "[[ \"\$(python3 -c 'import json; print(json.load(open(\"$SERVER/canary/manifest.json\"))[\"version\"])')\" == 0.2.6.5 ]] \
|
||||
&& [[ \"\$(cd '$SERVER/packages' && sha256sum -- *.deb)\" == \"$before\" ]]"
|
||||
check "the release's file is published to canary" \
|
||||
ci preview 0.2.6.6 "$H6" gate-report-preview-good.txt
|
||||
check "canary serves it, and latest.deb is that file" \
|
||||
bash -c "[[ \$(python3 -c 'import json; m=json.load(open(\"$SERVER/canary/manifest.json\")); print(m[\"version\"], m[\"sha256\"])') == '0.2.6.6 $H6' ]] \
|
||||
&& cmp -s '$SERVER/canary/latest.deb' '$PKG6'"
|
||||
check "exactly one package was added, and no other changed" \
|
||||
bash -c "diff <(printf '%s\n' \"$before\") <(cd '$SERVER/packages' && sha256sum -- *.deb) | grep -c '^[<>]' | grep -qx 1 \
|
||||
&& ! diff <(printf '%s\n' \"$before\") <(cd '$SERVER/packages' && sha256sum -- *.deb) | grep -q '^<'"
|
||||
check "stable was not touched" test "$(serves stable)" = 0.2.6.4
|
||||
check "the Gitea release records it, with the sha256" \
|
||||
bash -c "'$GITEA' notes v0.2.6.6 | grep -qF 'published to Preview (canary), sha256 \`$H6\`'"
|
||||
check "publishing it again is refused" \
|
||||
refuses_saying "0.2.6.6 has already been published" ci preview 0.2.6.6 "$H6" gate-report-preview-good.txt
|
||||
|
||||
echo "3. Stable: only the file Preview ran, only with an approval"
|
||||
H7="$(make_release 0.2.6.7)"
|
||||
check "a release that never went to Preview is refused" \
|
||||
refuses_saying "has no record of $H7 going to Preview" ci stable 0.2.6.7 "$H7" "approved"
|
||||
check "a checksum other than the one Preview ran is refused" \
|
||||
refuses_saying "has no record of $H7 going to Preview" ci stable 0.2.6.6 "$H7" "approved"
|
||||
check "a promotion with no approval is refused" \
|
||||
refuses_saying "names who approved it" ci stable 0.2.6.6 "$H6" ""
|
||||
check "stable is still 0.2.6.4 after all of that" test "$(serves stable)" = 0.2.6.4
|
||||
before="$(packages)"
|
||||
check "the approved file is promoted" \
|
||||
ci stable 0.2.6.6 "$H6" "physical checks passed on the laptop"
|
||||
check "stable serves exactly the file canary does" \
|
||||
bash -c "[[ \$(python3 -c 'import json; m=json.load(open(\"$SERVER/stable/manifest.json\")); print(m[\"version\"], m[\"sha256\"])') == '0.2.6.6 $H6' ]] \
|
||||
&& cmp -s '$SERVER/stable/latest.deb' '$SERVER/canary/latest.deb'"
|
||||
check "no package was added or changed by promoting" test "$(packages)" = "$before"
|
||||
check "the record has the promotion and its approval" \
|
||||
bash -c "'$GITEA' notes v0.2.6.6 | grep -qF 'Approval: physical checks passed on the laptop'"
|
||||
check "and the release is no longer a pre-release" \
|
||||
bash -c "curl -fsS '$GITEA_URL/api/v1/repos/church/classroom/releases/tags/v0.2.6.6' | grep -q '\"prerelease\": false'"
|
||||
check "the record reads in order: created, Preview, Stable" \
|
||||
bash -c "'$GITEA' notes v0.2.6.6 | python3 -c 'import sys
|
||||
t = sys.stdin.read()
|
||||
order = [t.index(s) for s in (\"release created at\", \"published to Preview\", \"promoted to Stable\")]
|
||||
assert order == sorted(order), order'"
|
||||
|
||||
echo "4. import: a release from before the record, as the server has it"
|
||||
H5="$(sha "$SERVER/packages/ekklesia-classroom_0.2.6.5_amd64.deb")"
|
||||
check "a checksum the server's file does not have is refused" \
|
||||
refuses_saying "is not sha256 $H7" ci import 0.2.6.5 "$H7" "$COMMIT"
|
||||
check "a commit that does not exist is refused" \
|
||||
refuses_saying "is not a commit here" ci import 0.2.6.5 "$H5" "$(printf '0%.0s' {1..40})"
|
||||
check "0.2.6.5 is recorded, with the server's own bytes" \
|
||||
bash -c "RELEASE_CI_WORK=\$(mktemp -d -p '$WORK') '$CI' import 0.2.6.5 '$H5' '$COMMIT' \
|
||||
&& '$GITEA' download v0.2.6.5 ekklesia-classroom_0.2.6.5_amd64.deb '$WORK/imported.deb' \
|
||||
&& cmp -s '$WORK/imported.deb' '$SERVER/packages/ekklesia-classroom_0.2.6.5_amd64.deb'"
|
||||
check "no channel serves it now, so the record claims neither" \
|
||||
bash -c "! '$GITEA' notes v0.2.6.5 | grep -qE 'published to Preview|promoted to Stable'"
|
||||
# A room of another era: stable serving 0.2.6.4, as it did before 0.2.6.6.
|
||||
point stable 0.2.6.4
|
||||
H4="$(sha "$SERVER/packages/ekklesia-classroom_0.2.6.4_amd64.deb")"
|
||||
check "a release a channel serves is recorded as on it, read off the server" \
|
||||
bash -c "RELEASE_CI_WORK=\$(mktemp -d -p '$WORK') '$CI' import 0.2.6.4 '$H4' '$COMMIT' \
|
||||
&& '$GITEA' notes v0.2.6.4 | grep -qF 'promoted to Stable, sha256 \`$H4\`' \
|
||||
&& ! '$GITEA' notes v0.2.6.4 | grep -q 'published to Preview' \
|
||||
&& curl -fsS '$GITEA_URL/api/v1/repos/church/classroom/releases/tags/v0.2.6.4' | grep -q '\"prerelease\": false'"
|
||||
check "a release that already has a record is not imported over it" \
|
||||
refuses_saying "its record is kept as it is" ci import 0.2.6.6 "$H6" "$COMMIT"
|
||||
|
||||
check "a Gitea that cannot be asked is never taken as having no release" \
|
||||
refuses_saying "could not ask Gitea whether v0.2.6.9 exists" \
|
||||
env GITEA_URL=http://127.0.0.1:9 bash -c "RELEASE_CI_WORK=\$(mktemp -d -p '$WORK') '$CI' import 0.2.6.9 '$H5' '$COMMIT'"
|
||||
|
||||
echo "5. build: only from master or a maintenance branch"
|
||||
check "a feature branch is refused before anything is built" \
|
||||
bash -c "GITHUB_REF=refs/heads/feat/something RELEASE_CI_WORK=\$(mktemp -d -p '$WORK') '$CI' build 0.2.6.8 2>&1 \
|
||||
| grep -q 'releases are built from master or release/\\*, not refs/heads/feat/something'"
|
||||
|
||||
echo
|
||||
echo "$passed passed, $failed failed"
|
||||
[[ $failed -eq 0 ]]
|
||||
Reference in New Issue
Block a user