Add guarded single-command release publication

scripts/release.sh

@@ -0,0 +1,130 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repository_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
+cd "$repository_dir"
+
+remote_url=https://gitea.maximumdirect.net/eric/ConfigKit.git
+
+fail() {
+  printf '%s\n' "$*" >&2
+  exit 1
+}
+
+check_candidate() {
+  local current status
+  current=$(git branch --show-current) || fail "cannot read the current branch"
+  [[ "$current" == main ]] || fail "release requires the main branch"
+  status=$(git status --porcelain=v1 --untracked-files=all) || fail "cannot inspect the worktree"
+  [[ -z "$status" ]] || fail "release requires a clean index and worktree"
+  current=$(git rev-parse --verify HEAD) || fail "cannot identify the candidate"
+  [[ "$current" == "$candidate" ]] || fail "candidate changed; commit and validate it again"
+}
+
+check_unused_version() {
+  if git show-ref --verify --quiet "refs/tags/$version"; then
+    fail "version already has a local tag"
+  fi
+  local oid result
+  if oid=$(read_remote_ref "refs/tags/$version"); then
+    fail "version already has an authoritative tag"
+  else
+    result=$?
+    ((result == 2)) || fail "cannot determine authoritative tag state; publication status is unknown"
+  fi
+}
+
+read_remote_ref() {
+  local ref=$1 response result
+  if response=$(git ls-remote --refs --exit-code "$remote_url" "$ref" 2>/dev/null); then
+    [[ "$response" == *$'\t'"$ref" ]] || return 3
+    printf '%s\n' "${response%%$'\t'*}"
+  else
+    result=$?
+    ((result == 2)) && return 2
+    return 3
+  fi
+}
+
+if (($# != 1)); then
+  fail "usage: ./scripts/release.sh vMAJOR.MINOR.PATCH"
+fi
+version=$1
+[[ "$version" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]] ||
+  fail "release version must be a stable vMAJOR.MINOR.PATCH without leading zeroes"
+
+fetch_urls=$(git remote get-url --all origin 2>/dev/null) || fail "origin is unavailable"
+push_urls=$(git remote get-url --push --all origin 2>/dev/null) || fail "origin push destination is unavailable"
+[[ "$fetch_urls" == "$remote_url" && "$push_urls" == "$remote_url" ]] ||
+  fail "origin must have exactly the authoritative fetch and push destination"
+
+candidate=$(git rev-parse --verify HEAD) || fail "cannot identify the candidate"
+check_candidate
+check_unused_version
+
+note_path="docs/releases/$version.md"
+note_file=$(mktemp)
+trap 'rm -f -- "$note_file"' EXIT
+git show "$candidate:$note_path" >"$note_file" 2>/dev/null ||
+  fail "matching release note is absent from the candidate"
+IFS= read -r title <"$note_file" || [[ -n "$title" ]] ||
+  fail "matching release note is empty"
+[[ "$title" == "# ConfigKit $version" ]] || fail "release note title does not match the version"
+
+if remote_main=$(read_remote_ref refs/heads/main); then
+  :
+else
+  result=$?
+  ((result == 2)) && fail "authoritative main is absent"
+  fail "cannot read authoritative main; publication status is unknown"
+fi
+git fetch --no-tags "$remote_url" refs/heads/main >/dev/null ||
+  fail "cannot fetch authoritative main"
+fetched_main=$(git rev-parse --verify FETCH_HEAD) || fail "cannot inspect fetched main"
+git merge-base --is-ancestor "$fetched_main" "$candidate" ||
+  fail "candidate cannot advance authoritative main without discarding history"
+
+./scripts/release-check.sh || fail "release validation failed; no refs were published"
+check_candidate
+check_unused_version
+
+if git push --no-follow-tags "$remote_url" "$candidate:refs/heads/main"; then
+  :
+else
+  if observed_main=$(read_remote_ref refs/heads/main); then
+    [[ "$observed_main" == "$candidate" ]] ||
+      fail "main push did not publish; authoritative main differs from the candidate"
+  else
+    result=$?
+    ((result == 2)) && fail "main push failed; authoritative main is absent"
+    fail "main push outcome is unknown; inspect authoritative main before retrying"
+  fi
+fi
+
+check_candidate
+git tag -a -F "$note_file" --cleanup=verbatim "$version" "$candidate" ||
+  fail "could not create the local annotated tag"
+tag_target=$(git rev-parse --verify "refs/tags/$version^{}") ||
+  fail "cannot verify the local tag target"
+[[ "$tag_target" == "$candidate" ]] || fail "local tag does not identify the candidate"
+tag_type=$(git cat-file -t "refs/tags/$version") ||
+  fail "cannot inspect the local tag"
+[[ "$tag_type" == tag ]] || fail "release tag must be annotated"
+tag_oid=$(git rev-parse --verify "refs/tags/$version") ||
+  fail "cannot identify the annotated tag"
+
+if git push --no-follow-tags "$remote_url" "refs/tags/$version:refs/tags/$version"; then
+  :
+else
+  if observed_tag=$(read_remote_ref "refs/tags/$version"); then
+    [[ "$observed_tag" == "$tag_oid" ]] ||
+      fail "authoritative tag conflicts with the local tag; never replace it"
+  else
+    result=$?
+    ((result == 2)) &&
+      fail "tag push failed; main is published, but the local tag is unpublished"
+    fail "tag push outcome is unknown; retain the local tag and inspect authoritative state"
+  fi
+fi
+
+printf 'Published %s at %s\n' "$version" "$candidate"