|
| 1 | +#!/usr/bin/env python3 |
| 2 | +""" |
| 3 | +Tag and push a GitHub release for capsec-github-action. |
| 4 | +
|
| 5 | +Usage: |
| 6 | + python scripts/releases/1_github.py # dry-run (shows what would happen) |
| 7 | + python scripts/releases/1_github.py --push # create tag and push |
| 8 | +
|
| 9 | +What it does: |
| 10 | + 1. Reads the version from action.yml (auto-increments from latest git tag if not set) |
| 11 | + 2. Checks that the git tag doesn't already exist on GitHub |
| 12 | + 3. Creates a git tag v{version} and pushes it to origin |
| 13 | + 4. Updates the floating major tag (v1) to point to the new release |
| 14 | +
|
| 15 | +The floating major tag (v1) is how users reference the action: |
| 16 | + uses: bordumb/capsec-github-action@v1 |
| 17 | +
|
| 18 | +Requires: |
| 19 | + - python3 (no external dependencies) |
| 20 | + - git on PATH |
| 21 | +""" |
| 22 | + |
| 23 | +import re |
| 24 | +import subprocess |
| 25 | +import sys |
| 26 | +from pathlib import Path |
| 27 | + |
| 28 | +REPO_ROOT = Path(__file__).resolve().parents[2] |
| 29 | +ACTION_YML = REPO_ROOT / "action.yml" |
| 30 | +GITHUB_REPO = "bordumb/capsec-github-action" |
| 31 | + |
| 32 | + |
| 33 | +def get_latest_tag() -> str | None: |
| 34 | + """Get the latest semver tag from git.""" |
| 35 | + result = subprocess.run( |
| 36 | + ["git", "tag", "-l", "v*.*.*", "--sort=-v:refname"], |
| 37 | + capture_output=True, |
| 38 | + text=True, |
| 39 | + cwd=REPO_ROOT, |
| 40 | + ) |
| 41 | + tags = result.stdout.strip().splitlines() |
| 42 | + return tags[0] if tags else None |
| 43 | + |
| 44 | + |
| 45 | +def bump_patch(tag: str) -> str: |
| 46 | + """Bump patch version: v1.0.0 -> v1.0.1""" |
| 47 | + m = re.match(r"v(\d+)\.(\d+)\.(\d+)", tag) |
| 48 | + if not m: |
| 49 | + return "v1.0.0" |
| 50 | + major, minor, patch = int(m.group(1)), int(m.group(2)), int(m.group(3)) |
| 51 | + return f"v{major}.{minor}.{patch + 1}" |
| 52 | + |
| 53 | + |
| 54 | +def get_version() -> str: |
| 55 | + """Determine the next version tag.""" |
| 56 | + latest = get_latest_tag() |
| 57 | + if latest: |
| 58 | + return bump_patch(latest) |
| 59 | + return "v1.0.0" |
| 60 | + |
| 61 | + |
| 62 | +def git(*args: str) -> str: |
| 63 | + result = subprocess.run( |
| 64 | + ["git", *args], |
| 65 | + capture_output=True, |
| 66 | + text=True, |
| 67 | + cwd=REPO_ROOT, |
| 68 | + ) |
| 69 | + if result.returncode != 0: |
| 70 | + print(f"ERROR: git {' '.join(args)} failed:\n{result.stderr.strip()}", file=sys.stderr) |
| 71 | + sys.exit(1) |
| 72 | + return result.stdout.strip() |
| 73 | + |
| 74 | + |
| 75 | +def local_tag_exists(tag: str) -> bool: |
| 76 | + result = subprocess.run( |
| 77 | + ["git", "tag", "-l", tag], |
| 78 | + capture_output=True, |
| 79 | + text=True, |
| 80 | + cwd=REPO_ROOT, |
| 81 | + ) |
| 82 | + return bool(result.stdout.strip()) |
| 83 | + |
| 84 | + |
| 85 | +def remote_tag_exists(tag: str) -> bool: |
| 86 | + result = subprocess.run( |
| 87 | + ["git", "ls-remote", "--tags", "origin", f"refs/tags/{tag}"], |
| 88 | + capture_output=True, |
| 89 | + text=True, |
| 90 | + cwd=REPO_ROOT, |
| 91 | + ) |
| 92 | + return bool(result.stdout.strip()) |
| 93 | + |
| 94 | + |
| 95 | +def delete_local_tag(tag: str) -> None: |
| 96 | + subprocess.run( |
| 97 | + ["git", "tag", "-d", tag], |
| 98 | + capture_output=True, |
| 99 | + cwd=REPO_ROOT, |
| 100 | + ) |
| 101 | + |
| 102 | + |
| 103 | +def main() -> None: |
| 104 | + push = "--push" in sys.argv |
| 105 | + |
| 106 | + tag = get_version() |
| 107 | + major_tag = re.match(r"(v\d+)", tag).group(1) # e.g., "v1" |
| 108 | + latest = get_latest_tag() |
| 109 | + |
| 110 | + print(f"Latest tag: {latest or '(none)'}") |
| 111 | + print(f"New tag: {tag}") |
| 112 | + print(f"Floating tag: {major_tag} (will point to {tag})") |
| 113 | + |
| 114 | + # Check remote |
| 115 | + if remote_tag_exists(tag): |
| 116 | + print(f"\nERROR: Git tag {tag} already exists on origin.", file=sys.stderr) |
| 117 | + print("Delete the remote tag first or let it auto-bump.", file=sys.stderr) |
| 118 | + sys.exit(1) |
| 119 | + |
| 120 | + if local_tag_exists(tag): |
| 121 | + print(f"Local tag {tag} exists but not on origin — deleting stale local tag.") |
| 122 | + delete_local_tag(tag) |
| 123 | + |
| 124 | + # Clean working tree |
| 125 | + status = git("status", "--porcelain") |
| 126 | + if status: |
| 127 | + print(f"\nERROR: Working tree is not clean:\n{status}", file=sys.stderr) |
| 128 | + print("Commit or stash changes before releasing.", file=sys.stderr) |
| 129 | + sys.exit(1) |
| 130 | + |
| 131 | + if not push: |
| 132 | + print(f"\nDry run: would create and push tag {tag}") |
| 133 | + print(f" would update floating tag {major_tag} -> {tag}") |
| 134 | + print("Run with --push to execute.") |
| 135 | + return |
| 136 | + |
| 137 | + # Create version tag |
| 138 | + print(f"\nCreating tag {tag}...", flush=True) |
| 139 | + result = subprocess.run( |
| 140 | + ["git", "tag", "-a", tag, "-m", f"release: {tag}"], |
| 141 | + cwd=REPO_ROOT, |
| 142 | + ) |
| 143 | + if result.returncode != 0: |
| 144 | + print(f"\nERROR: git tag failed (exit {result.returncode})", file=sys.stderr) |
| 145 | + sys.exit(1) |
| 146 | + |
| 147 | + # Push version tag |
| 148 | + print(f"Pushing tag {tag} to origin...", flush=True) |
| 149 | + result = subprocess.run( |
| 150 | + ["git", "push", "origin", tag], |
| 151 | + cwd=REPO_ROOT, |
| 152 | + ) |
| 153 | + if result.returncode != 0: |
| 154 | + print(f"\nERROR: git push failed (exit {result.returncode})", file=sys.stderr) |
| 155 | + sys.exit(1) |
| 156 | + |
| 157 | + # Update floating major tag (v1 -> latest) |
| 158 | + print(f"Updating floating tag {major_tag} -> {tag}...", flush=True) |
| 159 | + if local_tag_exists(major_tag): |
| 160 | + delete_local_tag(major_tag) |
| 161 | + |
| 162 | + result = subprocess.run( |
| 163 | + ["git", "tag", "-fa", major_tag, "-m", f"{major_tag} floating tag -> {tag}"], |
| 164 | + cwd=REPO_ROOT, |
| 165 | + ) |
| 166 | + if result.returncode != 0: |
| 167 | + print(f"\nERROR: git tag {major_tag} failed (exit {result.returncode})", file=sys.stderr) |
| 168 | + sys.exit(1) |
| 169 | + |
| 170 | + result = subprocess.run( |
| 171 | + ["git", "push", "origin", major_tag, "--force"], |
| 172 | + cwd=REPO_ROOT, |
| 173 | + ) |
| 174 | + if result.returncode != 0: |
| 175 | + print(f"\nERROR: git push {major_tag} failed (exit {result.returncode})", file=sys.stderr) |
| 176 | + sys.exit(1) |
| 177 | + |
| 178 | + print(f"\nDone.") |
| 179 | + print(f" Version tag: {tag}") |
| 180 | + print(f" Floating: {major_tag} -> {tag}") |
| 181 | + print(f" Users reference: uses: {GITHUB_REPO}@{major_tag}") |
| 182 | + |
| 183 | + |
| 184 | +if __name__ == "__main__": |
| 185 | + main() |
0 commit comments