.gitbay/release.sh

 1#!/bin/sh
 2# The tag push is the release. Builds the Linux binaries, creates the gitbay
 3# release with the tag's own annotation as its notes, attaches the tarballs, and
 4# publishes to crates.io.
 5#
 6# The two darwin tarballs are not built here: this runner is Linux, and gitbay's
 7# `runner next` claims the oldest pending build with no platform targeting, so a
 8# Mac runner could not be aimed at them. .githooks/pre-push builds them on a Mac
 9# before the tag is pushed and uploads them to this release once it exists.
10#
11# crates.io is the one step that cannot be undone — a version can be yanked but
12# never replaced — so it runs last, after the release exists and the binaries are
13# attached. CARGO_REGISTRY_TOKEN is a repository secret (`gitbay repo secret set`).
14set -eu
15
16tag="${GITBAY_REF:?no tag in GITBAY_REF}"
17repo="${GITBAY_REPO:?no repository in GITBAY_REPO}"
18: "${CARGO_REGISTRY_TOKEN:?CARGO_REGISTRY_TOKEN secret is not set}"
19
20# The tag is the source of truth for the version, checked rather than trusted: a
21# release tagged v0.18.0 whose binary reports 0.17.0 is the kind of thing nobody
22# notices for months.
23version=$(cargo pkgid | sed 's/.*[#@]//')
24if [ "$tag" != "v$version" ]; then
25	echo "tag $tag does not match Cargo.toml version $version" >&2
26	exit 1
27fi
28
29. .gitbay/bot-ssh.sh
30
31dist=dist
32mkdir -p "$dist"
33
34# glibc for ordinary distributions, musl for containers and anything older than
35# the runner's glibc — a dynamically linked binary is the usual reason a download
36# does not run.
37for target in x86_64-unknown-linux-gnu x86_64-unknown-linux-musl; do
38	cargo build --release --locked --target "$target"
39	# A tarball rather than a bare binary: it keeps the executable bit through the
40	# download path, and carries the licence with the thing it licenses.
41	staging="orgo-$tag-$target"
42	rm -rf "$staging"
43	mkdir "$staging"
44	cp "target/$target/release/orgo" README.md LICENSE "$staging/"
45	tar czf "$dist/$staging.tar.gz" "$staging"
46	rm -rf "$staging"
47	(cd "$dist" && sha256sum "$staging.tar.gz" >"$staging.tar.gz.sha256")
48done
49
50# Notes come from the annotated tag, so the person cutting the release writes
51# them at the moment they decide to cut it (`git tag -a "$tag" -F notes.md`).
52git tag -l --format='%(contents)' "$tag" |
53	$SSH "$GITBAY_SSH" release create "$repo" "$tag" --title "${tag#v}" --file -
54
55for f in "$dist"/*; do
56	$SSH "$GITBAY_SSH" release asset add "$repo" "$tag" "$(basename "$f")" <"$f"
57	echo "attached $(basename "$f")"
58done
59
60# --locked publishes exactly the dependency versions the tests ran against,
61# rather than whatever resolves at publish time.
62cargo publish --locked
63echo "published $tag to crates.io"