eric/ConfigKit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Align release policy and operational documentation

Browse Source
This commit is contained in:
Eric Rakestraw
2026-09-28 01:13:09 +00:00
parent 299ebc21a9
commit 3d0093e1fd
7 changed files with 242 additions and 177 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
scripts/release.sh
View File

@@ -12,13 +12,13 @@ fail() {
}
check_candidate() {
local current status
current=$(git branch --show-current) || fail "cannot read the current branch"
[[ "$current" == main ]] || fail "release requires the main branch"
status=$(git status --porcelain=v1 --untracked-files=all) || fail "cannot inspect the worktree"
[[ -z "$status" ]] || fail "release requires a clean index and worktree"
current=$(git rev-parse --verify HEAD) || fail "cannot identify the candidate"
[[ "$current" == "$candidate" ]] || fail "candidate changed; commit and validate it again"
local context=$1 current status
current=$(git branch --show-current) || fail "$context: cannot read the current branch"
[[ "$current" == main ]] || fail "$context: release requires the main branch"
status=$(git status --porcelain=v1 --untracked-files=all) || fail "$context: cannot inspect the worktree"
[[ -z "$status" ]] || fail "$context: release requires a clean index and worktree"
current=$(git rev-parse --verify HEAD) || fail "$context: cannot identify the candidate"
[[ "$current" == "$candidate" ]] || fail "$context: candidate changed; commit and validate it again"
}
check_unused_version() {
@@ -59,7 +59,7 @@ push_urls=$(git remote get-url --push --all origin 2>/dev/null) || fail "origin
fail "origin must have exactly the authoritative fetch and push destination"
candidate=$(git rev-parse --verify HEAD) || fail "cannot identify the candidate"
check_candidate
check_candidate "before validation"
check_unused_version
note_path="docs/releases/$version.md"
@@ -85,7 +85,7 @@ git merge-base --is-ancestor "$fetched_main" "$candidate" ||
fail "candidate cannot advance authoritative main without discarding history"
./scripts/release-check.sh || fail "release validation failed; no refs were published"
check_candidate
check_candidate "after validation"
check_unused_version
if git push --no-follow-tags "$remote_url" "$candidate:refs/heads/main"; then
@@ -93,37 +93,37 @@ if git push --no-follow-tags "$remote_url" "$candidate:refs/heads/main"; then
else
if observed_main=$(read_remote_ref refs/heads/main); then
[[ "$observed_main" == "$candidate" ]] ||
fail "main push did not publish; authoritative main differs from the candidate"
fail "main push did not publish candidate $candidate; authoritative main differs"
else
result=$?
((result == 2)) && fail "main push failed; authoritative main is absent"
fail "main push outcome is unknown; inspect authoritative main before retrying"
((result == 2)) && fail "main push failed for $candidate; authoritative main is absent"
fail "main push outcome is unknown for $candidate; inspect authoritative main before retrying"
fi
fi
check_candidate
check_candidate "main at $candidate; tag not yet published"
git tag -a -F "$note_file" --cleanup=verbatim "$version" "$candidate" ||
fail "could not create the local annotated tag"
fail "main is at $candidate; could not create local tag $version"
tag_target=$(git rev-parse --verify "refs/tags/$version^{}") ||
fail "cannot verify the local tag target"
[[ "$tag_target" == "$candidate" ]] || fail "local tag does not identify the candidate"
fail "main is at $candidate; cannot verify local tag $version"
[[ "$tag_target" == "$candidate" ]] || fail "main is at $candidate; local tag $version targets another commit"
tag_type=$(git cat-file -t "refs/tags/$version") ||
fail "cannot inspect the local tag"
[[ "$tag_type" == tag ]] || fail "release tag must be annotated"
fail "main is at $candidate; cannot inspect local tag $version"
[[ "$tag_type" == tag ]] || fail "main is at $candidate; local tag $version is not annotated"
tag_oid=$(git rev-parse --verify "refs/tags/$version") ||
fail "cannot identify the annotated tag"
fail "main is at $candidate; cannot identify local tag $version"
if git push --no-follow-tags "$remote_url" "refs/tags/$version:refs/tags/$version"; then
:
else
if observed_tag=$(read_remote_ref "refs/tags/$version"); then
[[ "$observed_tag" == "$tag_oid" ]] ||
fail "authoritative tag conflicts with the local tag; never replace it"
fail "authoritative tag $version conflicts with the local tag at $candidate; never replace it"
else
result=$?
((result == 2)) &&
fail "tag push failed; main is published, but the local tag is unpublished"
fail "tag push outcome is unknown; retain the local tag and inspect authoritative state"
fail "tag push failed; main is at $candidate, but local tag $version is unpublished"
fail "tag $version push outcome is unknown for $candidate; retain the local tag and inspect authoritative state"
fi
fi