From f27b5970fa40f40f0c8a9287aebffabf34d2a162 Mon Sep 17 00:00:00 2001 From: npub1sv749mw8zcmld4ygjx2mx2aqcn3zvtuj2nlmgatxgad3t9uweu9q5marze <833d52edc71637f6d4889195b32ba0c4e2262f9254ffb47566475b15978ecf0a@sprout-oss.stage.blox.sqprod.co> Date: Tue, 21 Jul 2026 15:07:08 -0700 Subject: [PATCH 1/5] Simplify mobile releases to immutable candidates Co-authored-by: npub1sv749mw8zcmld4ygjx2mx2aqcn3zvtuj2nlmgatxgad3t9uweu9q5marze <833d52edc71637f6d4889195b32ba0c4e2262f9254ffb47566475b15978ecf0a@sprout-oss.stage.blox.sqprod.co> Signed-off-by: npub1sv749mw8zcmld4ygjx2mx2aqcn3zvtuj2nlmgatxgad3t9uweu9q5marze <833d52edc71637f6d4889195b32ba0c4e2262f9254ffb47566475b15978ecf0a@sprout-oss.stage.blox.sqprod.co> --- .../auto-tag-on-release-pr-merge.yml | 19 +- .github/workflows/ci.yml | 4 + AGENTS.md | 2 +- Justfile | 47 +--- RELEASING.md | 255 ++++++++---------- mobile/pubspec.yaml | 2 +- scripts/mobile-release.sh | 95 +++++++ scripts/test-mobile-release-contract.sh | 174 ++++++++++++ scripts/test-release-ref-contract.sh | 4 +- 9 files changed, 407 insertions(+), 195 deletions(-) create mode 100755 scripts/mobile-release.sh create mode 100755 scripts/test-mobile-release-contract.sh diff --git a/.github/workflows/auto-tag-on-release-pr-merge.yml b/.github/workflows/auto-tag-on-release-pr-merge.yml index 05bcceca59..db34fddc2c 100644 --- a/.github/workflows/auto-tag-on-release-pr-merge.yml +++ b/.github/workflows/auto-tag-on-release-pr-merge.yml @@ -1,6 +1,6 @@ name: Auto-tag on Release PR Merge -# Five release lanes share this one workflow. Four use an explicit branch +# Four PR-driven release lanes share this workflow. Each uses an explicit branch # prefix; the main chart lane also auto-detects a Chart.yaml version bump so # a chart feature PR can publish its own new version when merged: # @@ -10,18 +10,20 @@ name: Auto-tag on Release PR Merge # push-chart-release/ → tag push-chart-v → push-gateway-helm-chart.yml # any internal PR that bumps deploy/charts/buzz/Chart.yaml `version` # → tag chart-v → helm-chart.yml (helm chart) -# mobile-release/ → tag mobile-v → (manual sprout_ref for buzz-releases build — see below) +# +# Mobile candidate tags do not come from merged PRs. Operators create immutable +# mobile-v-rc.N tags directly from remote main with scripts/mobile-release.sh, +# then hand the exact tag to buzz-releases. # # Release tags are created with a short-lived token from the dedicated # buzz-release-bot GitHub App. GitHub attributes the ref creation to that # App, so the consumer's `on.push.tags` trigger runs normally. The workflow's # default GITHUB_TOKEN remains read-only and is never used to create a tag. # -# The mobile lane is push-only by infosec necessity: OSS `block/buzz` CI must -# not trigger CI in the private `buzz-releases` repo, so auto-dispatch across -# that boundary is deliberately disallowed. The mobile-v* tag is consumed -# manually instead — a human feeds it as the `sprout_ref` input to the -# `buzz-releases` Buildkite pipeline, which builds and ships mobile. +# Mobile is manual-only by infosec necessity: OSS `block/buzz` CI must +# not trigger CI in the private `buzz-releases` repo. A human feeds the exact +# mobile candidate tag to the private Buildkite pipeline, which builds and +# ships mobile. on: pull_request: @@ -65,9 +67,6 @@ jobs: push-chart-release/*) VERSION="${BRANCH#push-chart-release/}" TAG_PREFIX="push-chart-v" ;; - mobile-release/*) - VERSION="${BRANCH#mobile-release/}" - TAG_PREFIX="mobile-v" ;; *) parent_sha="$(git rev-parse HEAD^)" old_version="$(git show "${parent_sha}:deploy/charts/buzz/Chart.yaml" 2>/dev/null | awk '/^version:/ {print $2}')" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8d2dc79a3f..f1bec6bb7f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -58,9 +58,13 @@ jobs: - 'pnpm-lock.yaml' mobile: - 'mobile/**' + - 'scripts/mobile-release.sh' + - 'scripts/test-mobile-release-contract.sh' - '.github/workflows/ci.yml' - name: Release workflow source contract run: scripts/test-release-ref-contract.sh + - name: Mobile release contract + run: scripts/test-mobile-release-contract.sh rust-lint: name: Rust Lint diff --git a/AGENTS.md b/AGENTS.md index c94ba3881e..c2b6711f8b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -566,5 +566,5 @@ just mobile-dev - [CONTRIBUTING.md](CONTRIBUTING.md) — setup, code style, PR process, how to add event kinds / CLI subcommands / HTTP endpoints - [TESTING.md](TESTING.md) — multi-agent E2E test guide - [ARCHITECTURE.md](ARCHITECTURE.md) — system design and component relationships -- [RELEASING.md](RELEASING.md) — release process: `release-desktop`, `release-relay`, `release-mobile`, auto-tag, internal builds +- [RELEASING.md](RELEASING.md) — release process: `release-desktop`, `release-relay`, `scripts/mobile-release.sh`, candidate tags, internal builds - [README.md](README.md) — project overview and quick start diff --git a/Justfile b/Justfile index 317541e2f4..aa81fbae41 100644 --- a/Justfile +++ b/Justfile @@ -639,14 +639,6 @@ get-next-patch-version: get-next-relay-patch-version: @python3 -c "v='$(just get-current-relay-version)'.split('.'); print(f'{v[0]}.{v[1]}.{int(v[2])+1}')" -# Read the current mobile version from pubspec.yaml (strips the +build suffix) -get-current-mobile-version: - @grep -m1 '^version: ' mobile/pubspec.yaml | sed -E 's/version: ([^+]*).*/\1/' - -# Compute next mobile patch version (e.g., 0.3.0 → 0.3.1) -get-next-mobile-patch-version: - @python3 -c "v='$(just get-current-mobile-version)'.split('.'); print(f'{v[0]}.{v[1]}.{int(v[2])+1}')" - # Update version in desktop package manifests and regenerate lockfiles bump-desktop-version version: #!/usr/bin/env bash @@ -686,16 +678,6 @@ bump-relay-version version: cargo update -p buzz-relay echo "Bumped buzz-relay to {{ version }} and regenerated Cargo.lock" -# Bump the mobile pubspec version and regenerate the lockfile -bump-mobile-version version: - #!/usr/bin/env bash - set -euo pipefail - # pubspec carries a `version: X.Y.Z+build`; preserve the `+build` convention - # (a literal `+1`, matching the desktop lane's prior behavior). - perl -i -pe 's/^version: .*/version: {{ version }}+1/' mobile/pubspec.yaml - (unset GIT_DIR GIT_WORK_TREE; cd mobile && flutter pub get) - echo "Bumped mobile to {{ version }} and regenerated pubspec.lock" - # Open or update the desktop release PR (signed desktop app) release-desktop *ARGS: #!/usr/bin/env bash @@ -720,22 +702,8 @@ release-relay *ARGS: fi just _release-pr relay "$VERSION" -# Open or update the mobile release PR (Buzz mobile app) -release-mobile *ARGS: - #!/usr/bin/env bash - set -euo pipefail - ARG="{{ ARGS }}" - if [[ -z "$ARG" || "$ARG" == "patch" ]]; then - VERSION=$(just get-next-mobile-patch-version) - else - VERSION="$ARG" - fi - just _release-pr mobile "$VERSION" - -# Shared release-PR engine. One body, three lanes — the only lane-specific steps -# are the version-bump command and the file/tag/changelog identifiers selected -# in the `case` below. Everything else (git preflight, branch reset, changelog -# generation, commit, push, PR open/edit) is identical across lanes. +# Shared release-PR engine for desktop and relay. Mobile publishes immutable +# candidate tags directly from remote main instead of using metadata-only PRs. _release-pr lane version: #!/usr/bin/env bash set -euo pipefail @@ -766,16 +734,6 @@ _release-pr lane version: ADD_FILES=(crates/buzz-relay/Cargo.toml Cargo.lock crates/buzz-relay/CHANGELOG.md) LOG_PATHS=(crates/buzz-relay/ crates/buzz-core/ crates/buzz-db/ crates/buzz-auth/ crates/buzz-pubsub/ crates/buzz-search/ crates/buzz-audit/ crates/buzz-media/ crates/buzz-sdk/ crates/buzz-workflow/ crates/buzz-conformance/ migrations/) ARTIFACT="Buzz Relay" ;; - mobile) - BRANCH_PREFIX="mobile-release" - TAG_FETCH='mobile-v*' - TAG_MATCH='mobile-v[0-9]*' - TAG_EXCLUDE='mobile-v*-*' - TAG_PREFIX="mobile-v" - CHANGELOG="mobile/CHANGELOG.md" - ADD_FILES=(mobile/pubspec.yaml mobile/pubspec.lock mobile/CHANGELOG.md) - LOG_PATHS=(mobile/) - ARTIFACT="Buzz Mobile" ;; *) echo "Error: unknown release lane '{{ lane }}'" exit 1 ;; @@ -816,7 +774,6 @@ _release-pr lane version: case "{{ lane }}" in desktop) just bump-desktop-version "$VERSION" ;; relay) just bump-relay-version "$VERSION" ;; - mobile) just bump-mobile-version "$VERSION" ;; esac # Generate the changelog from commits since this lane's last release tag. LAST_TAG=$(git describe --tags --abbrev=0 --match "$TAG_MATCH" --exclude "$TAG_EXCLUDE" 2>/dev/null || echo "") diff --git a/RELEASING.md b/RELEASING.md index 890f0f5fff..7925ca9bdd 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -1,25 +1,18 @@ # Releasing Buzz -Buzz has three independent release lanes, each driven by a release PR — no human -ever pushes a git tag: +Buzz has three independent release lanes. Desktop and relay use release PRs. +Mobile uses immutable release-candidate tags cut directly from remote `main`: -| Lane | Recipe | Artifact | -|------|--------|----------| +| Lane | Entry point | Artifact | +|------|-------------|----------| | Desktop | `just release-desktop` | Signed desktop app (macOS/Linux) | | Relay | `just release-relay` | `ghcr.io/block/buzz` container image | -| Mobile | `just release-mobile` | Buzz mobile app (tag is the `sprout_ref` for the internal build) | +| Mobile | `scripts/mobile-release.sh candidate X.Y.Z` | Exact `mobile-vX.Y.Z-rc.N` source identity | -The three lanes version independently: the desktop version lives in -`desktop/package.json`, the relay version in `crates/buzz-relay/Cargo.toml`, and -the mobile version in `mobile/pubspec.yaml`. - -The mobile lane publishes a `mobile-v` tag that is consumed -**manually**, cross-repo, as the `sprout_ref` input to the internal -`buzz-releases` Buildkite pipeline (iOS dogfood → Block Comp Portal, App Store → -TestFlight — see [Internal Releases](#internal-releases)). The OSS lane is -tag-only **by design**: OSS `block/buzz` CI cannot trigger CI in the private -`buzz-releases` repo (infosec), so a human cuts the internal build from the tag -rather than auto-dispatching across that boundary. +The lanes version independently. Desktop reads its manifests, relay reads its +crate manifest, and mobile derives both source and marketing version from the +exact candidate tag. The mobile handoff to the private `buzz-releases` pipeline +remains manual because OSS CI cannot trigger private CI. ## Quick Start @@ -27,173 +20,142 @@ rather than auto-dispatching across that boundary. # Desktop release (next patch version) just release-desktop -# Desktop patch / minor / explicit -just release-desktop patch +# Desktop explicit version just release-desktop 0.4.0 -just release-desktop 1.0.0 -# Relay release (same argument forms) +# Relay release just release-relay just release-relay 0.4.0 -# Mobile release (same argument forms) -just release-mobile -just release-mobile 0.4.0 +# Publish the next mobile candidate from the exact current remote main commit +scripts/mobile-release.sh candidate 0.5.0 ``` -`just release-desktop` creates a `version-bump/` PR; `just -release-relay` creates a `relay-release/` PR; `just release-mobile` -creates a `mobile-release/` PR. Each bumps its own version manifest, -regenerates lockfiles, and appends a changelog entry. Merge the PR to trigger -the build automatically (the mobile tag is instead the `sprout_ref` a human -feeds the internal build — see above). - -Re-running any of these recipes with the same version is safe — it detects the -existing branch and PR, resets to current `main`, regenerates the changelog -with any new commits, and updates the PR in place. +Desktop and relay releases use metadata PRs. Mobile does not. Each +`mobile-vX.Y.Z-rc.N` tag is an immutable candidate and the artifact of record. +There is no mobile release branch, stable mobile tag alias, finalization step, +or mobile GitHub Release. --- ## How It Works -All three lanes share one engine; they differ only in which version manifest -they bump, which branch prefix they use, and what the merge triggers. - -The merge workflow creates tags with a short-lived installation token from the -dedicated `buzz-release-bot` GitHub App. Release-tag rules allow that App to -create matching tags and prevent other actors from creating, moving, or -deleting them. The workflow's default `GITHUB_TOKEN` is read-only. - ### Desktop -1. **`just release-desktop`** runs locally on `main` — computes the next - version, creates (or reuses) a `version-bump/` branch, bumps the - desktop manifests, regenerates lockfiles, generates a changelog - entry in `CHANGELOG.md`, commits, pushes, and opens (or updates) a PR. -2. **Merge the PR** — the `auto-tag-on-release-pr-merge` workflow detects the - `version-bump/*` branch merge and pushes a `v` tag. -3. **Tag triggers `release.yml`** — builds, signs, notarizes, and publishes the - desktop app for macOS and Linux. +1. **`just release-desktop`** runs locally on `main`, creates or updates a + `version-bump/` PR, bumps the desktop manifests, regenerates + lockfiles, and updates `CHANGELOG.md`. +2. **Merge the PR.** `auto-tag-on-release-pr-merge` pushes `v`. +3. **The tag triggers `release.yml`.** It builds, signs, notarizes, and + publishes the desktop app for macOS and Linux. ### Relay -1. **`just release-relay`** runs locally on `main` — computes the next relay - version, creates (or reuses) a `relay-release/` branch, bumps - `crates/buzz-relay/Cargo.toml`, regenerates `Cargo.lock`, generates a - changelog entry in `crates/buzz-relay/CHANGELOG.md`, commits, pushes, and - opens (or updates) a PR. -2. **Merge the PR** — the `auto-tag-on-release-pr-merge` workflow detects the - `relay-release/*` branch merge and pushes a `relay-v` tag. -3. **Tag triggers `docker.yml`** — the `relay-v` push triggers - `docker.yml`, which builds the multi-arch relay - image and publishes `ghcr.io/block/buzz:` (plus `:.`, - `:`, and `:latest` for stable releases). Prereleases - (`relay-v-rc.1`) publish only the prerelease tag and do **not** - move `:latest`. GitHub runs the tag trigger because the tag is created by - the dedicated GitHub App rather than the workflow's `GITHUB_TOKEN`. - -Every push to `main` continues to build and publish `:main` + `:sha-<7>` tags -(the rolling development image). The `:latest` tag tracks the latest **stable** -relay release only — it does not move on main pushes or prereleases. +1. **`just release-relay`** runs locally on `main`, creates or updates a + `relay-release/` PR, bumps `crates/buzz-relay/Cargo.toml`, + regenerates `Cargo.lock`, and updates the relay changelog. +2. **Merge the PR.** `auto-tag-on-release-pr-merge` pushes + `relay-v`. +3. **The tag triggers `docker.yml`.** Stable releases update the version + aliases and `latest`; prereleases do not. + +Every push to `main` continues to publish the rolling relay `:main` and +`:sha-<7>` tags. ### Mobile -1. **`just release-mobile`** runs locally on `main` — computes the next mobile - version, creates (or reuses) a `mobile-release/` branch, bumps - `mobile/pubspec.yaml` (preserving the `+build` number), regenerates - `mobile/pubspec.lock`, generates a changelog entry in `mobile/CHANGELOG.md`, - commits, pushes, and opens (or updates) a PR. -2. **Merge the PR** — the `auto-tag-on-release-pr-merge` workflow detects the - `mobile-release/*` branch merge and pushes a `mobile-v` tag. -3. **The tag is consumed manually, cross-repo** — nothing in OSS `block/buzz` - builds on the tag (OSS CI must not trigger CI in the private `buzz-releases` - repo — infosec). A human feeds the `mobile-v` tag as the - `sprout_ref` input to the internal `buzz-releases` Buildkite pipeline, which - builds and ships iOS to Block Comp Portal (dogfood) and TestFlight (App - Store, opt-in). See [Internal Releases](#internal-releases). +1. **Publish a candidate.** From a clean checkout whose `origin` is the + canonical `block/buzz` repository, run + `scripts/mobile-release.sh candidate X.Y.Z`. The script resolves and fetches + the exact current `origin/main` commit, derives the next number from exact + remote tags for that marketing version, and publishes an annotated + `mobile-vX.Y.Z-rc.N` tag there. It never uses the operator's checked-out + commit and never moves an existing candidate. +2. **Build the exact tag.** Enter the candidate tag as `mobile_ref` in the + private Buzz mobile Buildkite pipeline. OSS CI deliberately cannot trigger + that private pipeline. The tag supplies both source commit and release + version. Flutter receives clean marketing version `X.Y.Z`; Buildkite's + monotonically increasing build number supplies the platform build number. +3. **Promote tested artifacts.** Promote the already-built signed artifact for + each platform through its store workflow. Record the exact tag with the + build or rollout record. No source ref is changed and no final build is cut. + +The iOS and Android artifacts for one marketing version may come from different +RC tags. For example, iOS can ship `mobile-v0.5.0-rc.2` while Android ships +`mobile-v0.5.0-rc.3`. Each platform's exact candidate tag is its source record. +There is intentionally no single selected or final candidate for the marketing +version. + +`mobile/pubspec.yaml` keeps `0.0.0+1` only as a valid, visibly non-release +fallback for local development and validation builds. Release jobs always +inject both version fields. `mobile/CHANGELOG.md` is retained as historical +release data. It is not a release ledger for this flow. --- -## Release Types +## Version Sources -The argument forms below apply to `release-desktop`, `release-relay`, and -`release-mobile`: +| Lane | Release version authority | +|------|---------------------------| +| Desktop | `desktop/package.json` and synchronized desktop manifests | +| Relay | `crates/buzz-relay/Cargo.toml` | +| Mobile | Exact `mobile-vX.Y.Z-rc.N` remote tag | -| Command | Version | Example | -|---------|---------|---------| -| `just release-desktop` | Next patch | `0.3.0` → `0.3.1` | -| `just release-desktop patch` | Next patch | `0.3.0` → `0.3.1` | -| `just release-desktop 0.4.0` | Explicit minor | `0.3.1` → `0.4.0` | -| `just release-desktop 1.0.0` | Explicit | `1.0.0` | - ---- - -## Version Files - -`just bump-desktop-version ` (desktop lane) updates these files: - -| File | Field | -|------|-------| -| `desktop/package.json` | `"version"` | -| `desktop/src-tauri/tauri.conf.json` | `"version"` | -| `desktop/src-tauri/Cargo.toml` | `version` (under `[package]`) | - -It also regenerates `pnpm-lock.yaml` and `desktop/src-tauri/Cargo.lock`. - -`just bump-relay-version ` (relay lane) updates -`crates/buzz-relay/Cargo.toml` (`version` under `[package]`) and regenerates the -workspace `Cargo.lock`. - -`just bump-mobile-version ` (mobile lane) updates -`mobile/pubspec.yaml` (`version:`, preserving the `+build` number) and -regenerates `mobile/pubspec.lock`. +`just bump-desktop-version ` updates the desktop manifests and +regenerates their lockfiles. `just bump-relay-version ` updates the +relay crate and regenerates `Cargo.lock`. Mobile has no bump recipe or +release-metadata PR. --- ## Manual Fallback -If the automated flow isn't suitable (e.g., building from a non-main ref): +Desktop supports the manual GitHub Actions fallback: -1. Go to **Actions > Release** in the GitHub UI -2. Click **Run workflow** -3. Provide the semver version (no `v` prefix) and the ref to build from +1. Go to **Actions > Release** in the GitHub UI. +2. Click **Run workflow**. +3. Provide the semver version and the immutable tag ref to build. + +Mobile intentionally has no branch or arbitrary-ref fallback. The private +Buildkite pipeline accepts only an exact candidate tag. --- ## Internal Releases -After the OSS release ships, trigger an internal build via the -[sprout-releases Buildkite pipeline](https://buildkite.com/runway/sprout-releases). -See the [buzz-releases README](https://github.com/squareup/buzz-releases#cutting-a-release) -for the full step-by-step instructions and input field reference. +For mobile, trigger the private +[Release Mobile pipeline](https://buildkite.com/runway/buzz-mobile-releases) with +an exact RC tag for the platform build being cut. For desktop, use +[Release Desktop](https://buildkite.com/runway/sprout-releases). See the +[buzz-releases README](https://github.com/squareup/buzz-releases#cutting-a-release) +for the private pipeline contract. --- ## What Gets Published -Each release produces two GitHub releases: +Desktop publishes two GitHub releases: -1. **`v`** — the user-facing release with the `.dmg` installer - (macOS). +1. **`v`**: the user-facing release with installers. +2. **`buzz-desktop-latest`**: the rolling auto-updater release. -2. **`buzz-desktop-latest`** — a rolling pre-release for the Tauri - auto-updater containing `latest.json` and each platform's signed - updater artifact plus its `.sig` signature (`.tar.gz` on macOS, - `.AppImage` on Linux, and `_alpha-unsigned.exe` on Windows). +Mobile publishes only annotated `mobile-vX.Y.Z-rc.N` git tags. Store artifacts +and rollout records retain the exact tag they used. Mobile does not publish a +GitHub Release or a stable `mobile-vX.Y.Z` alias. --- ## Platform Support -The release workflow builds **two separate macOS DMGs** — Apple +The release workflow builds **two separate macOS DMGs**: Apple Silicon (`darwin-aarch64`, the `release` job) and Intel -(`darwin-x86_64`, the `release-macos-x64` job) — plus Linux `.deb` and +(`darwin-x86_64`, the `release-macos-x64` job), plus Linux `.deb` and `.AppImage`. Both macOS DMGs are codesigned, notarized, and attached to the same `v` release. Intel users download the `_x64.dmg`. The Linux AppImage is post-processed by `desktop/scripts/fix-appimage.sh`, which strips infra libraries over-bundled by linuxdeploy (they crash on -Mesa 25+ / GLib 2.88 distros — see +Mesa 25+ / GLib 2.88 distros; see [tauri-apps/tauri#15665](https://github.com/tauri-apps/tauri/issues/15665)) and re-signs the artifact. As a result the AppImage relies on the host's Wayland/GStreamer/graphics stack and requires GLib >= 2.72 @@ -205,8 +167,12 @@ host's Wayland/GStreamer/graphics stack and requires GLib >= 2.72 ## Prerequisites - **Write access** to the `block/buzz` GitHub repository -- **`gh` CLI** authenticated (`gh auth status`) -- The following **GitHub Actions secrets** must be configured: +- An `origin` remote whose configured URL is the canonical `block/buzz` + repository +- Repository tag rules that make `mobile-v*` immutable while allowing the + intended release operator to create a new candidate tag +- The following **GitHub Actions secrets** must be configured for the desktop + release lane: | Secret | Purpose | |--------|---------| @@ -214,6 +180,10 @@ host's Wayland/GStreamer/graphics stack and requires GLib >= 2.72 | `TAURI_SIGNING_PRIVATE_KEY` | Tauri updater private key | | `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` | Password for the private key | +The mobile candidate command uses `git` directly. It does not need the `gh` CLI, +GitHub workflow dispatch permissions, GitHub Releases permissions, or a mobile +release-branch ruleset. + --- ## Troubleshooting @@ -224,15 +194,28 @@ Switch to `main` and pull latest before running the release recipe. ### `just release-desktop` fails with "working tree is dirty" Commit or stash your changes before running the release recipe. -### New commits merged after creating the release PR -Re-run the release recipe (`just release-desktop`, `just release-relay`, or `just release-mobile`) from an up-to-date `main`. It resets the branch to current `main`, regenerates the changelog and PR body to include the new commits, and force-pushes the updated branch. +### New commits land after publishing a mobile candidate + +Run `scripts/mobile-release.sh candidate ` again after the intended +fix reaches remote `main`. It publishes a new immutable RC tag at the new exact +remote commit. Continue referring to each tested or shipped platform artifact by +its own exact tag. + +### A mobile candidate command selects the wrong RC number + +Do not retry by moving or deleting a tag. Inspect the exact remote `mobile-v*` +tags and resolve the unexpected state. Candidate numbers are monotonically +increasing remote identities. + +### A mobile candidate push is rejected by repository rules -### Build fails at "Validate version" -The version string must be valid semver: `MAJOR.MINOR.PATCH` with an optional pre-release suffix. Do not include a `v` prefix. +Confirm the intended operator is allowed to create `mobile-v*` tags. Do not +weaken update or deletion protection. Existing candidate tags must remain +immutable. ### Auto-updater reports "no update available" Verify that the `buzz-desktop-latest` release exists and contains a valid `latest.json`. The manifest covers all four platform keys (`darwin-aarch64`, `darwin-x86_64`, `linux-x86_64`, `windows-x86_64`); a missing entry usually means that platform's -release job failed — check the workflow run. +release job failed. Check the workflow run. diff --git a/mobile/pubspec.yaml b/mobile/pubspec.yaml index 3e2e1f83c4..d6f25eb004 100644 --- a/mobile/pubspec.yaml +++ b/mobile/pubspec.yaml @@ -1,7 +1,7 @@ name: buzz description: Buzz mobile client publish_to: 'none' -version: 0.4.11+1 +version: 0.0.0+1 environment: sdk: ^3.11.4 diff --git a/scripts/mobile-release.sh b/scripts/mobile-release.sh new file mode 100755 index 0000000000..3cfa21f009 --- /dev/null +++ b/scripts/mobile-release.sh @@ -0,0 +1,95 @@ +#!/usr/bin/env bash +set -euo pipefail + +usage() { + cat >&2 <<'USAGE' +usage: + scripts/mobile-release.sh candidate X.Y.Z + +candidate Publish the next immutable mobile-vX.Y.Z-rc.N candidate tag at the + exact current commit of block/buzz's remote main branch. +USAGE + exit 2 +} + +fail() { + echo "Error: $*" >&2 + exit 1 +} + +require_clean_semver() { + [[ "$1" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || \ + fail "'$1' is not a mobile release version (expected X.Y.Z)" +} + +require_clean_tree() { + git diff --quiet && git diff --cached --quiet && \ + [[ -z "$(git status --short --untracked-files=normal)" ]] || \ + fail "working tree is dirty; commit or stash changes first" +} + +require_canonical_origin() { + local origin_url + origin_url="$(git config --get remote.origin.url || true)" + case "$origin_url" in + git@github.com:block/buzz.git|https://github.com/block/buzz.git|https://github.com/block/buzz) + ;; + *) + fail "origin must be the canonical block/buzz repository (found '${origin_url:-}')" ;; + esac +} + +remote_ref_oid() { + local ref="$1" line + line="$(git ls-remote --refs origin "$ref")" + [[ -n "$line" && "$line" != *$'\n'* ]] || return 1 + printf '%s' "${line%%$'\t'*}" +} + +remote_main_commit_sha() { + local ref="refs/heads/main" advertised_oid fetched_oid commit + advertised_oid="$(remote_ref_oid "$ref")" || return 1 + git fetch -q --no-tags origin "$ref" + fetched_oid="$(git rev-parse --verify FETCH_HEAD)" + [[ "$fetched_oid" == "$advertised_oid" ]] || \ + fail "origin/main moved while it was being resolved" + commit="$(git rev-parse --verify 'FETCH_HEAD^{commit}')" || return 1 + [[ "$commit" == "$advertised_oid" ]] || \ + fail "origin/main did not resolve directly to a commit" + printf '%s' "$commit" +} + +command="${1:-}" +case "$command" in + candidate) + [[ "$#" -eq 2 ]] || usage + version="$2" + require_clean_semver "$version" + require_clean_tree + require_canonical_origin + + main_sha="$(remote_main_commit_sha)" || fail "origin/main does not exist" + next=1 + while IFS=$'\t' read -r _ ref; do + [[ "$ref" =~ ^refs/tags/mobile-v${version//./\.}-rc\.([1-9][0-9]*)$ ]] || continue + number="${BASH_REMATCH[1]}" + (( number >= next )) && next=$((number + 1)) + done < <(git ls-remote --refs --tags origin "refs/tags/mobile-v${version}-rc.*") + + tag="mobile-v${version}-rc.${next}" + if git show-ref --verify --quiet "refs/tags/$tag"; then + fail "local tag $tag already exists; remove or rename it before retrying" + fi + git -c tag.gpgSign=false tag -a -m "Buzz Mobile $version release candidate $next" \ + "$tag" "$main_sha" + if ! git push origin "refs/tags/$tag"; then + git tag -d "$tag" >/dev/null + fail "could not publish $tag" + fi + git tag -d "$tag" >/dev/null + printf 'Published %s at origin/main commit %s. Use this exact tag in Release Mobile.\n' \ + "$tag" "$main_sha" + ;; + + *) usage ;; +esac diff --git a/scripts/test-mobile-release-contract.sh b/scripts/test-mobile-release-contract.sh new file mode 100755 index 0000000000..f8415037d2 --- /dev/null +++ b/scripts/test-mobile-release-contract.sh @@ -0,0 +1,174 @@ +#!/usr/bin/env bash +set -euo pipefail + +repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +script="$repo_root/scripts/mobile-release.sh" +tmp="$(mktemp -d)" +trap 'rm -rf "$tmp"' EXIT +remote="$tmp/remote.git" +work="$tmp/work" +operator="$tmp/operator" +canonical_origin="git@github.com:block/buzz.git" + +run_release() { + local repo="$1" + shift + ( + cd "$repo" + git config "url.file://$remote.insteadOf" "$canonical_origin" + git config protocol.file.allow always + "$script" "$@" + ) +} + +fail() { + echo "$*" >&2 + exit 1 +} + +git init -q --bare "$remote" +git init -q "$work" +git -C "$work" config user.name test +git -C "$work" config user.email test@example.com +git -C "$work" remote add origin "$canonical_origin" +echo first > "$work/file" +git -C "$work" add file +git -C "$work" commit -qm first +git -C "$work" branch -M main +git -C "$work" -c "url.file://$remote.insteadOf=$canonical_origin" \ + -c protocol.file.allow=always push -q -u origin main + +# Candidate publication must work from a stale operator clone and tag the exact +# current remote main commit, never the operator's checkout. +git -c "url.file://$remote.insteadOf=$canonical_origin" \ + -c protocol.file.allow=always clone -q "$canonical_origin" "$operator" +git -C "$operator" config user.name test +git -C "$operator" config user.email test@example.com +echo remote-only >> "$work/file" +git -C "$work" commit -qam remote-only +git -C "$work" -c "url.file://$remote.insteadOf=$canonical_origin" \ + -c protocol.file.allow=always push -q origin main +remote_main_sha="$(git --git-dir="$remote" rev-parse refs/heads/main)" +if git -C "$operator" cat-file -e "$remote_main_sha^{commit}" 2>/dev/null; then + fail "stale-clone fixture already contains the remote-only commit" +fi +run_release "$operator" candidate 1.2.3 +[[ "$(git --git-dir="$remote" rev-parse 'refs/tags/mobile-v1.2.3-rc.1^{commit}')" == \ + "$remote_main_sha" ]] +[[ "$(git --git-dir="$remote" cat-file -t refs/tags/mobile-v1.2.3-rc.1)" == tag ]] +if git -C "$operator" show-ref --verify --quiet refs/tags/mobile-v1.2.3-rc.1; then + fail "successful candidate publication stranded a local tag" +fi + +# Existing remote identities are immutable and candidate numbers increase +# monotonically. A later candidate for the same marketing version may point at +# a newer main commit, while the prior candidate never moves. +rc1_tag_oid="$(git --git-dir="$remote" rev-parse refs/tags/mobile-v1.2.3-rc.1)" +echo newer >> "$work/file" +git -C "$work" commit -qam newer +git -C "$work" -c "url.file://$remote.insteadOf=$canonical_origin" \ + -c protocol.file.allow=always push -q origin main +new_main_sha="$(git --git-dir="$remote" rev-parse refs/heads/main)" +run_release "$operator" candidate 1.2.3 +[[ "$(git --git-dir="$remote" rev-parse refs/tags/mobile-v1.2.3-rc.1)" == "$rc1_tag_oid" ]] +[[ "$(git --git-dir="$remote" rev-parse 'refs/tags/mobile-v1.2.3-rc.2^{commit}')" == \ + "$new_main_sha" ]] +[[ "$(git --git-dir="$remote" cat-file -t refs/tags/mobile-v1.2.3-rc.2)" == tag ]] + +# Sequence from the highest exact remote RC even if there are gaps, and ignore +# malformed or other-version tags. +git -C "$work" -c tag.gpgSign=false tag -a -m gap mobile-v1.2.3-rc.7 "$new_main_sha" +git -C "$work" -c tag.gpgSign=false tag -a -m malformed mobile-v1.2.3-rc.08 "$new_main_sha" +git -C "$work" -c tag.gpgSign=false tag -a -m other mobile-v1.2.4-rc.99 "$new_main_sha" +git -C "$work" -c "url.file://$remote.insteadOf=$canonical_origin" \ + -c protocol.file.allow=always push -q origin \ + refs/tags/mobile-v1.2.3-rc.7 refs/tags/mobile-v1.2.3-rc.08 \ + refs/tags/mobile-v1.2.4-rc.99 +run_release "$operator" candidate 1.2.3 +[[ "$(git --git-dir="$remote" rev-parse 'refs/tags/mobile-v1.2.3-rc.8^{commit}')" == \ + "$new_main_sha" ]] + +# A rejected publication must remove its temporary local tag and leave no +# remote identity behind. +failing_operator="$tmp/failing-operator" +git -c "url.file://$remote.insteadOf=$canonical_origin" \ + -c protocol.file.allow=always clone -q "$canonical_origin" "$failing_operator" +git -C "$failing_operator" config user.name test +git -C "$failing_operator" config user.email test@example.com +mkdir -p "$failing_operator/.git/hooks" +cat > "$failing_operator/.git/hooks/pre-push" <<'HOOK' +#!/usr/bin/env bash +exit 1 +HOOK +chmod +x "$failing_operator/.git/hooks/pre-push" +git -C "$failing_operator" config core.hooksPath .git/hooks +if run_release "$failing_operator" candidate 9.9.9 >/dev/null 2>&1; then + fail "candidate succeeded despite a rejected push" +fi +if git -C "$failing_operator" show-ref --verify --quiet refs/tags/mobile-v9.9.9-rc.1; then + fail "failed candidate publication stranded a local tag" +fi +if git --git-dir="$remote" show-ref --verify --quiet refs/tags/mobile-v9.9.9-rc.1; then + fail "failed candidate publication created a remote tag" +fi + +# Publishing through a fork or an origin with no canonical identity is rejected. +fork_operator="$tmp/fork-operator" +git clone -q "$remote" "$fork_operator" +git -C "$fork_operator" config user.name test +git -C "$fork_operator" config user.email test@example.com +if (cd "$fork_operator" && "$script" candidate 2.0.0 >/dev/null 2>&1); then + fail "noncanonical origin was accepted" +fi +if git --git-dir="$remote" show-ref --verify --quiet refs/tags/mobile-v2.0.0-rc.1; then + fail "noncanonical origin published a candidate" +fi + +# A colliding local tag is never overwritten or removed. +local_collision_oid="$(git -C "$operator" rev-parse HEAD)" +git -C "$operator" -c tag.gpgSign=false tag -a -m local-collision \ + mobile-v3.0.0-rc.1 "$local_collision_oid" +if run_release "$operator" candidate 3.0.0 >/dev/null 2>&1; then + fail "colliding local tag was overwritten" +fi +[[ "$(git -C "$operator" rev-parse 'refs/tags/mobile-v3.0.0-rc.1^{commit}')" == \ + "$local_collision_oid" ]] +if git --git-dir="$remote" show-ref --verify --quiet refs/tags/mobile-v3.0.0-rc.1; then + fail "colliding local tag was published" +fi + +# Dirty trees and invalid marketing versions fail before publication. +echo dirty > "$operator/untracked" +if run_release "$operator" candidate 2.0.0 >/dev/null 2>&1; then + fail "dirty operator tree was accepted" +fi +rm "$operator/untracked" +if run_release "$operator" candidate 1.2 >/dev/null 2>&1; then + fail "invalid marketing version was accepted" +fi + +# Mobile no longer has release branches, a finalization command, a stable alias, +# a GitHub Release call, or metadata-only release recipes. +if run_release "$operator" start 2.0.0 >/dev/null 2>&1; then + fail "removed start command was accepted" +fi +if run_release "$operator" finalize 1.2.3-rc.2 >/dev/null 2>&1; then + fail "removed finalize command was accepted" +fi +if git --git-dir="$remote" for-each-ref --format='%(refname)' refs/heads/mobile-release/ | grep -q .; then + fail "mobile release branch was created" +fi +if git --git-dir="$remote" show-ref --verify --quiet refs/tags/mobile-v1.2.3; then + fail "stable mobile tag alias was created" +fi +if grep -qE '(^|[^[:alnum:]_])(gh[[:space:]]+release|mobile-release/|finalize)([^[:alnum:]_]|$)' \ + "$script"; then + fail "removed branch/finalization/GitHub Release behavior remains in script" +fi + +grep -Fq 'version: 0.0.0+1' "$repo_root/mobile/pubspec.yaml" +if grep -qE 'release-mobile|bump-mobile-version|get-current-mobile-version' "$repo_root/Justfile"; then + fail "metadata-only mobile release recipe remains in Justfile" +fi + +echo "mobile release contract passed" diff --git a/scripts/test-release-ref-contract.sh b/scripts/test-release-ref-contract.sh index 5d420695c2..9de7505b2d 100755 --- a/scripts/test-release-ref-contract.sh +++ b/scripts/test-release-ref-contract.sh @@ -12,7 +12,7 @@ git -C "$tmp" config user.email test@example.com echo first >"$tmp/file" git -C "$tmp" add file git -C "$tmp" commit -qm first -git -C "$tmp" tag v1.2.3 +git -C "$tmp" tag -m "desktop release" v1.2.3 ( cd "$tmp" @@ -37,7 +37,7 @@ if ( exit 1 fi -git -C "$tmp" tag relay-v2.0.0 +git -C "$tmp" tag -m "relay release" relay-v2.0.0 ( cd "$tmp" GITHUB_REF=refs/tags/relay-v2.0.0 "$verify" relay-v 2.0.0 From 23700b674f5b62b575943ab934030573faf6171d Mon Sep 17 00:00:00 2001 From: npub1sv749mw8zcmld4ygjx2mx2aqcn3zvtuj2nlmgatxgad3t9uweu9q5marze <833d52edc71637f6d4889195b32ba0c4e2262f9254ffb47566475b15978ecf0a@sprout-oss.stage.blox.sqprod.co> Date: Tue, 21 Jul 2026 15:11:10 -0700 Subject: [PATCH 2/5] Fix mobile release contract clone fixture Co-authored-by: npub1sv749mw8zcmld4ygjx2mx2aqcn3zvtuj2nlmgatxgad3t9uweu9q5marze <833d52edc71637f6d4889195b32ba0c4e2262f9254ffb47566475b15978ecf0a@sprout-oss.stage.blox.sqprod.co> Signed-off-by: npub1sv749mw8zcmld4ygjx2mx2aqcn3zvtuj2nlmgatxgad3t9uweu9q5marze <833d52edc71637f6d4889195b32ba0c4e2262f9254ffb47566475b15978ecf0a@sprout-oss.stage.blox.sqprod.co> --- scripts/test-mobile-release-contract.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/scripts/test-mobile-release-contract.sh b/scripts/test-mobile-release-contract.sh index f8415037d2..4df87c6d66 100755 --- a/scripts/test-mobile-release-contract.sh +++ b/scripts/test-mobile-release-contract.sh @@ -35,6 +35,7 @@ echo first > "$work/file" git -C "$work" add file git -C "$work" commit -qm first git -C "$work" branch -M main +git --git-dir="$remote" symbolic-ref HEAD refs/heads/main git -C "$work" -c "url.file://$remote.insteadOf=$canonical_origin" \ -c protocol.file.allow=always push -q -u origin main From eda53c382389070cadad463b211b55f9986bb509 Mon Sep 17 00:00:00 2001 From: npub1ux8n2yfs8qfvgd75s7kyhar2mztac355v6vmrz4juc9l3msw4pgstums9e Date: Tue, 21 Jul 2026 15:40:36 -0700 Subject: [PATCH 3/5] fix(release): publish mobile candidates through release app Co-authored-by: npub1ux8n2yfs8qfvgd75s7kyhar2mztac355v6vmrz4juc9l3msw4pgstums9e Signed-off-by: npub1ux8n2yfs8qfvgd75s7kyhar2mztac355v6vmrz4juc9l3msw4pgstums9e --- .github/workflows/ci.yml | 8 +- .../workflows/mobile-release-candidate.yml | 69 ++++++ RELEASING.md | 51 +++- scripts/mobile-release.sh | 128 +++++++--- scripts/publish-mobile-release-candidate.sh | 80 +++++++ scripts/release-rulesets.sh | 54 +++++ ...test-mobile-release-candidate-publisher.sh | 157 ++++++++++++ scripts/test-mobile-release-contract.sh | 225 +++++++++++++----- 8 files changed, 674 insertions(+), 98 deletions(-) create mode 100644 .github/workflows/mobile-release-candidate.yml create mode 100755 scripts/publish-mobile-release-candidate.sh create mode 100755 scripts/release-rulesets.sh create mode 100755 scripts/test-mobile-release-candidate-publisher.sh diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f1bec6bb7f..fa688cc3fd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -59,12 +59,18 @@ jobs: mobile: - 'mobile/**' - 'scripts/mobile-release.sh' + - 'scripts/publish-mobile-release-candidate.sh' + - 'scripts/release-rulesets.sh' - 'scripts/test-mobile-release-contract.sh' + - 'scripts/test-mobile-release-candidate-publisher.sh' + - '.github/workflows/mobile-release-candidate.yml' - '.github/workflows/ci.yml' - name: Release workflow source contract run: scripts/test-release-ref-contract.sh - name: Mobile release contract - run: scripts/test-mobile-release-contract.sh + run: | + scripts/test-mobile-release-contract.sh + scripts/test-mobile-release-candidate-publisher.sh rust-lint: name: Rust Lint diff --git a/.github/workflows/mobile-release-candidate.yml b/.github/workflows/mobile-release-candidate.yml new file mode 100644 index 0000000000..e1f1c1c918 --- /dev/null +++ b/.github/workflows/mobile-release-candidate.yml @@ -0,0 +1,69 @@ +name: Publish Mobile Release Candidate +run-name: Publish mobile-v${{ inputs.version }}-rc.${{ inputs.candidate_number }} + +on: + workflow_dispatch: + inputs: + version: + description: Mobile marketing version (X.Y.Z) + required: true + type: string + candidate_number: + description: Expected next release-candidate number + required: true + type: string + target_sha: + description: Exact current block/buzz main commit + required: true + type: string + +concurrency: + group: mobile-release-candidate-${{ inputs.version }} + cancel-in-progress: false + +permissions: + contents: read + +jobs: + publish: + runs-on: ubuntu-latest + timeout-minutes: 5 + steps: + - name: Require the reviewed workflow from main + env: + DISPATCH_REF: ${{ github.ref }} + run: | + if [ "$DISPATCH_REF" != "refs/heads/main" ]; then + echo "::error::Mobile candidates must be dispatched from main, not $DISPATCH_REF" + exit 1 + fi + + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + ref: ${{ github.sha }} + persist-credentials: false + + - name: Require canonical repository + env: + REPOSITORY: ${{ github.repository }} + run: | + if [ "$REPOSITORY" != "block/buzz" ]; then + echo "::error::Mobile candidate publication is restricted to block/buzz" + exit 1 + fi + + - name: Create release tagger token + id: release-tagger + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.BUZZ_RELEASE_TAGGER_CLIENT_ID }} + private-key: ${{ secrets.BUZZ_RELEASE_TAGGER_PRIVATE_KEY }} + permission-contents: write + + - name: Publish annotated candidate tag + env: + GH_TOKEN: ${{ steps.release-tagger.outputs.token }} + MOBILE_VERSION: ${{ inputs.version }} + CANDIDATE_NUMBER: ${{ inputs.candidate_number }} + TARGET_SHA: ${{ inputs.target_sha }} + run: scripts/publish-mobile-release-candidate.sh "$MOBILE_VERSION" "$CANDIDATE_NUMBER" "$TARGET_SHA" diff --git a/RELEASING.md b/RELEASING.md index 7925ca9bdd..03eb47fa22 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -69,8 +69,9 @@ Every push to `main` continues to publish the rolling relay `:main` and `scripts/mobile-release.sh candidate X.Y.Z`. The script resolves and fetches the exact current `origin/main` commit, derives the next number from exact remote tags for that marketing version, and publishes an annotated - `mobile-vX.Y.Z-rc.N` tag there. It never uses the operator's checked-out - commit and never moves an existing candidate. + `mobile-vX.Y.Z-rc.N` tag there through the dedicated `buzz-release-bot` + GitHub App. It never uses the operator's checked-out commit and never moves + an existing candidate. 2. **Build the exact tag.** Enter the candidate tag as `mobile_ref` in the private Buzz mobile Buildkite pipeline. OSS CI deliberately cannot trigger that private pipeline. The tag supplies both source commit and release @@ -86,6 +87,11 @@ RC tags. For example, iOS can ship `mobile-v0.5.0-rc.2` while Android ships There is intentionally no single selected or final candidate for the marketing version. +The simplification trades away a separate stabilization line. Unrelated commits +that reach `main` become part of every later candidate, and there is no retained +hotfix branch or branch-ancestry history. Add a dedicated hotfix flow later if a +release actually needs isolation from `main`. + `mobile/pubspec.yaml` keeps `0.0.0+1` only as a valid, visibly non-release fallback for local development and validation builds. Release jobs always inject both version fields. `mobile/CHANGELOG.md` is retained as historical @@ -169,10 +175,14 @@ host's Wayland/GStreamer/graphics stack and requires GLib >= 2.72 - **Write access** to the `block/buzz` GitHub repository - An `origin` remote whose configured URL is the canonical `block/buzz` repository -- Repository tag rules that make `mobile-v*` immutable while allowing the - intended release operator to create a new candidate tag -- The following **GitHub Actions secrets** must be configured for the desktop - release lane: +- `gh` CLI version 2.87.0 or newer, authenticated with permission to dispatch + the candidate workflow +- Release tag ruleset [`14378754`](https://github.com/block/buzz/rules/14378754) + active for `mobile-v*`, with creation, update, deletion, and non-fast-forward + protections and `buzz-release-bot` as its sole always-bypass actor +- The `buzz-release-bot` App credentials configured for GitHub Actions +- The following **GitHub Actions secrets** must also be configured for the + desktop release lane: | Secret | Purpose | |--------|---------| @@ -180,9 +190,14 @@ host's Wayland/GStreamer/graphics stack and requires GLib >= 2.72 | `TAURI_SIGNING_PRIVATE_KEY` | Tauri updater private key | | `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` | Password for the private key | -The mobile candidate command uses `git` directly. It does not need the `gh` CLI, -GitHub workflow dispatch permissions, GitHub Releases permissions, or a mobile -release-branch ruleset. +Mobile candidate publication requires workflow-dispatch access and the existing +release App because strict tag protection denies direct human creation. The App +must be installed on `block/buzz`, have Contents write and Metadata read, and +retain an `always` bypass on the immutable `mobile-v*` tag rules. It does not +require GitHub Releases permissions, repository Administration permission, or a +mobile release-branch ruleset. The publisher validates the App token's effective +`current_user_can_bypass` value rather than reading the ruleset's hidden bypass +actor list. --- @@ -201,17 +216,27 @@ fix reaches remote `main`. It publishes a new immutable RC tag at the new exact remote commit. Continue referring to each tested or shipped platform artifact by its own exact tag. +### `scripts/mobile-release.sh candidate` fails because `main` moved during publication + +The App-backed workflow may already have published the requested immutable RC +at the prior `main` tip before the operator command detects the race. Do not +move or delete that tag, and do not treat it as the candidate for current +`main`. Inspect the run URL from the command output, then rerun +`scripts/mobile-release.sh candidate ` to publish the next RC from the +new current `main` tip. + ### A mobile candidate command selects the wrong RC number Do not retry by moving or deleting a tag. Inspect the exact remote `mobile-v*` tags and resolve the unexpected state. Candidate numbers are monotonically increasing remote identities. -### A mobile candidate push is rejected by repository rules +### A mobile candidate publication is rejected by repository rules -Confirm the intended operator is allowed to create `mobile-v*` tags. Do not -weaken update or deletion protection. Existing candidate tags must remain -immutable. +Confirm `buzz-release-bot` remains the sole always-bypass actor for the active +`mobile-v*` ruleset and that its Actions credentials are available. Do not grant +direct human creation or weaken update or deletion protection. Existing +candidate tags must remain immutable. ### Auto-updater reports "no update available" Verify that the `buzz-desktop-latest` release exists and contains a diff --git a/scripts/mobile-release.sh b/scripts/mobile-release.sh index 3cfa21f009..5702281700 100755 --- a/scripts/mobile-release.sh +++ b/scripts/mobile-release.sh @@ -17,8 +17,34 @@ fail() { exit 1 } +# shellcheck source=scripts/release-rulesets.sh +source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/release-rulesets.sh" + +require_gh_minimum_version() { + local minimum="2.87.0" version + + command -v gh >/dev/null 2>&1 || fail "gh >= $minimum is required" + version="$(gh --version 2>/dev/null | awk 'NR == 1 { print $3 }')" || \ + fail "could not determine gh version (gh >= $minimum is required)" + [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || \ + fail "gh returned invalid version '$version'" + if ! awk -v current="$version" -v minimum="$minimum" ' + BEGIN { + split(current, c, ".") + split(minimum, m, ".") + for (i = 1; i <= 3; i++) { + if ((c[i] + 0) > (m[i] + 0)) exit 0 + if ((c[i] + 0) < (m[i] + 0)) exit 1 + } + exit 0 + } + '; then + fail "gh $version is too old; gh >= $minimum is required" + fi +} + require_clean_semver() { - [[ "$1" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || \ + [[ "$1" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]] || \ fail "'$1' is not a mobile release version (expected X.Y.Z)" } @@ -28,27 +54,48 @@ require_clean_tree() { fail "working tree is dirty; commit or stash changes first" } -require_canonical_origin() { - local origin_url - origin_url="$(git config --get remote.origin.url || true)" - case "$origin_url" in - git@github.com:block/buzz.git|https://github.com/block/buzz.git|https://github.com/block/buzz) - ;; - *) - fail "origin must be the canonical block/buzz repository (found '${origin_url:-}')" ;; - esac +require_annotated_tag() { + local git_dir="$1" object="$2" label="$3" + if [[ "$(git -C "$git_dir" cat-file -t "$object" 2>/dev/null || true)" != "tag" ]]; then + echo "$label must be an annotated tag" >&2 + return 1 + fi } -remote_ref_oid() { - local ref="$1" line - line="$(git ls-remote --refs origin "$ref")" +remote_tag_commit_sha() { + local ref="$1" line advertised_oid tmp fetched_oid commit + line="$(git ls-remote --refs origin "$ref")" || return 1 [[ -n "$line" && "$line" != *$'\n'* ]] || return 1 - printf '%s' "${line%%$'\t'*}" + advertised_oid="${line%%$'\t'*}" + tmp="$(mktemp -d)" + git -C "$tmp" init -q + git -C "$tmp" remote add origin "$(git remote get-url origin)" + if ! git -C "$tmp" fetch -q --depth 1 origin "$ref"; then + rm -rf "$tmp" + return 1 + fi + fetched_oid="$(git -C "$tmp" rev-parse --verify FETCH_HEAD)" + if [[ "$fetched_oid" != "$advertised_oid" ]]; then + rm -rf "$tmp" + fail "$ref moved while it was being resolved" + fi + if ! require_annotated_tag "$tmp" FETCH_HEAD "$ref"; then + rm -rf "$tmp" + return 1 + fi + if ! commit="$(git -C "$tmp" rev-parse --verify 'FETCH_HEAD^{commit}')"; then + rm -rf "$tmp" + return 1 + fi + rm -rf "$tmp" + printf '%s' "$commit" } remote_main_commit_sha() { - local ref="refs/heads/main" advertised_oid fetched_oid commit - advertised_oid="$(remote_ref_oid "$ref")" || return 1 + local ref="refs/heads/main" line advertised_oid fetched_oid commit + line="$(git ls-remote --refs origin "$ref")" || return 1 + [[ -n "$line" && "$line" != *$'\n'* ]] || return 1 + advertised_oid="${line%%$'\t'*}" git fetch -q --no-tags origin "$ref" fetched_oid="$(git rev-parse --verify FETCH_HEAD)" [[ "$fetched_oid" == "$advertised_oid" ]] || \ @@ -66,28 +113,55 @@ case "$command" in version="$2" require_clean_semver "$version" require_clean_tree - require_canonical_origin + require_canonical_repository || exit 1 + require_gh_minimum_version + local_head_sha="$(git rev-parse --verify 'HEAD^{commit}')" || fail "HEAD is not a commit" main_sha="$(remote_main_commit_sha)" || fail "origin/main does not exist" next=1 + if ! remote_tags="$(git ls-remote --refs --tags origin "refs/tags/mobile-v${version}-rc.*")"; then + fail "could not list existing candidates for $version" + fi while IFS=$'\t' read -r _ ref; do [[ "$ref" =~ ^refs/tags/mobile-v${version//./\.}-rc\.([1-9][0-9]*)$ ]] || continue number="${BASH_REMATCH[1]}" (( number >= next )) && next=$((number + 1)) - done < <(git ls-remote --refs --tags origin "refs/tags/mobile-v${version}-rc.*") + done <<< "$remote_tags" tag="mobile-v${version}-rc.${next}" - if git show-ref --verify --quiet "refs/tags/$tag"; then - fail "local tag $tag already exists; remove or rename it before retrying" + workflow="mobile-release-candidate.yml" + if dispatch_output="$(gh workflow run "$workflow" \ + --repo block/buzz \ + --ref main \ + -f "version=$version" \ + -f "candidate_number=$next" \ + -f "target_sha=$main_sha" 2>&1)"; then + : + else + if [[ "$dispatch_output" == *"does not have 'workflow_dispatch' trigger"* ]]; then + fail "$workflow is not available on main yet; merge the release-process change before publishing a candidate" + fi + fail "could not dispatch App-backed publication for $tag: $dispatch_output" fi - git -c tag.gpgSign=false tag -a -m "Buzz Mobile $version release candidate $next" \ - "$tag" "$main_sha" - if ! git push origin "refs/tags/$tag"; then - git tag -d "$tag" >/dev/null - fail "could not publish $tag" + run_url="$(printf '%s\n' "$dispatch_output" | awk '/^https:\/\/github\.com\/block\/buzz\/actions\/runs\/[0-9]+$/ { if (found) exit 2; found = $0 } END { if (found) print found }')" || \ + fail "GitHub returned multiple workflow run URLs for one candidate dispatch" + [[ -n "$run_url" ]] || \ + fail "GitHub accepted the candidate dispatch but returned no workflow run URL" + run_id="${run_url##*/}" + gh run watch "$run_id" --repo block/buzz --exit-status --compact || \ + fail "App-backed publication failed: $run_url" + + current_main_sha="$(remote_main_commit_sha)" || fail "origin/main does not exist after publication" + [[ "$current_main_sha" == "$main_sha" ]] || \ + fail "origin/main moved from requested commit $main_sha to $current_main_sha during publication" + published_sha="$(remote_tag_commit_sha "refs/tags/$tag")" || \ + fail "publication completed without exact annotated candidate tag $tag" + [[ "$published_sha" == "$main_sha" ]] || \ + fail "$tag resolved to $published_sha instead of requested commit $main_sha" + if [[ "$local_head_sha" != "$main_sha" ]]; then + echo "Note: local HEAD is $local_head_sha; candidate source is current origin/main $main_sha." >&2 fi - git tag -d "$tag" >/dev/null - printf 'Published %s at origin/main commit %s. Use this exact tag in Release Mobile.\n' \ + printf 'Published %s at origin/main commit %s through buzz-release-bot. Use this exact tag in Release Mobile.\n' \ "$tag" "$main_sha" ;; diff --git a/scripts/publish-mobile-release-candidate.sh b/scripts/publish-mobile-release-candidate.sh new file mode 100755 index 0000000000..6b0ee65b21 --- /dev/null +++ b/scripts/publish-mobile-release-candidate.sh @@ -0,0 +1,80 @@ +#!/usr/bin/env bash +set -euo pipefail + +fail() { + echo "Error: $*" >&2 + exit 1 +} + +# shellcheck source=scripts/release-rulesets.sh +source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/release-rulesets.sh" + +[[ "$#" -eq 3 ]] || fail "usage: $0 X.Y.Z N COMMIT_SHA" +version="$1" +candidate_number="$2" +target_sha="$3" +repo="${GITHUB_REPOSITORY:-}" + +[[ "$repo" == "block/buzz" ]] || fail "candidate publishing is restricted to block/buzz" +[[ "$version" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]] || \ + fail "'$version' is not a mobile release version (expected X.Y.Z)" +[[ "$candidate_number" =~ ^[1-9][0-9]*$ ]] || \ + fail "'$candidate_number' is not a candidate number (expected N >= 1)" +[[ "$target_sha" =~ ^[0-9a-f]{40}$ ]] || fail "'$target_sha' is not a full commit SHA" +command -v gh >/dev/null 2>&1 || fail "gh is required" +require_release_tag_ruleset || exit 1 + +main_sha="$(gh api "repos/$repo/git/ref/heads/main" --jq .object.sha)" || \ + fail "could not resolve $repo main" +[[ "$main_sha" == "$target_sha" ]] || \ + fail "$repo main moved from requested commit $target_sha to $main_sha" +commit_sha="$(gh api "repos/$repo/commits/$target_sha" --jq .sha)" || \ + fail "$target_sha is not a commit in $repo" +[[ "$commit_sha" == "$target_sha" ]] || \ + fail "GitHub resolved requested commit $target_sha as $commit_sha" + +refs="$( + gh api --paginate "repos/$repo/git/matching-refs/tags/mobile-v${version}-rc." --jq '.[].ref' +)" || fail "could not list existing candidates for $version" +next=1 +while IFS= read -r ref; do + [[ -n "$ref" ]] || continue + [[ "$ref" =~ ^refs/tags/mobile-v${version//./\.}-rc\.([1-9][0-9]*)$ ]] || continue + number="${BASH_REMATCH[1]}" + (( number >= next )) && next=$((number + 1)) +done <<< "$refs" +[[ "$candidate_number" -eq "$next" ]] || \ + fail "candidate sequence changed; expected rc.$candidate_number but next is rc.$next" + +tag="mobile-v${version}-rc.${candidate_number}" +message="Buzz Mobile $version release candidate $candidate_number" +tag_object_sha="$( + gh api --method POST "repos/$repo/git/tags" \ + -f tag="$tag" \ + -f message="$message" \ + -f object="$target_sha" \ + -f type=commit \ + --jq .sha +)" || fail "could not create annotated tag object for $tag" +[[ "$tag_object_sha" =~ ^[0-9a-f]{40}$ ]] || fail "GitHub returned an invalid tag object SHA" + +gh api --method POST "repos/$repo/git/refs" \ + -f ref="refs/tags/$tag" \ + -f sha="$tag_object_sha" \ + --silent || fail "could not publish $tag" + +published_type="$(gh api "repos/$repo/git/ref/tags/$tag" --jq .object.type)" || \ + fail "could not verify published tag $tag" +published_object="$(gh api "repos/$repo/git/ref/tags/$tag" --jq .object.sha)" || \ + fail "could not verify published tag $tag" +[[ "$published_type" == "tag" && "$published_object" == "$tag_object_sha" ]] || \ + fail "$tag does not reference the expected annotated tag object" + +direct_type="$(gh api "repos/$repo/git/tags/$tag_object_sha" --jq .object.type)" || \ + fail "could not verify annotated tag object $tag_object_sha" +direct_sha="$(gh api "repos/$repo/git/tags/$tag_object_sha" --jq .object.sha)" || \ + fail "could not verify annotated tag object $tag_object_sha" +[[ "$direct_type" == "commit" && "$direct_sha" == "$target_sha" ]] || \ + fail "$tag does not point directly to requested commit $target_sha" + +printf 'Published %s at %s through buzz-release-bot.\n' "$tag" "$target_sha" diff --git a/scripts/release-rulesets.sh b/scripts/release-rulesets.sh new file mode 100755 index 0000000000..bd0ac1fdf8 --- /dev/null +++ b/scripts/release-rulesets.sh @@ -0,0 +1,54 @@ +#!/usr/bin/env bash + +readonly RELEASE_TAG_RULESET_ID=14378754 + +fail_release_ruleset() { + echo "Error: $*" >&2 + return 1 +} + +require_canonical_repository() { + local origin_url + + origin_url="$(git config --get remote.origin.url 2>/dev/null)" || \ + fail_release_ruleset "origin is required and must point to block/buzz" || return 1 + case "$origin_url" in + git@github.com:block/buzz.git|ssh://git@github.com/block/buzz.git|https://github.com/block/buzz.git|https://github.com/block/buzz) + ;; + *) + fail_release_ruleset "origin must point to canonical block/buzz, not '$origin_url'" || return 1 + ;; + esac +} + +require_release_tag_ruleset() { + local ruleset_endpoint state can_bypass rule_types includes excludes + + command -v gh >/dev/null 2>&1 || fail_release_ruleset "gh is required" || return 1 + ruleset_endpoint="repos/block/buzz/rulesets/$RELEASE_TAG_RULESET_ID" + + state="$(gh api "$ruleset_endpoint" --jq .enforcement)" || \ + fail_release_ruleset "could not verify Release tag ruleset $RELEASE_TAG_RULESET_ID" || return 1 + [[ "$state" == "active" ]] || \ + fail_release_ruleset "Release tag ruleset $RELEASE_TAG_RULESET_ID is '$state'" || return 1 + + can_bypass="$(gh api "$ruleset_endpoint" --jq .current_user_can_bypass)" || \ + fail_release_ruleset "could not verify the release App's tag-ruleset bypass" || return 1 + [[ "$can_bypass" == "always" ]] || \ + fail_release_ruleset "release App cannot always bypass Release tag ruleset $RELEASE_TAG_RULESET_ID (reported '$can_bypass')" || return 1 + + rule_types="$(gh api "$ruleset_endpoint" --jq '[.rules[].type] | sort | join(",")')" || \ + fail_release_ruleset "could not verify Release tag ruleset $RELEASE_TAG_RULESET_ID rules" || return 1 + [[ "$rule_types" == "creation,deletion,non_fast_forward,update" ]] || \ + fail_release_ruleset "Release tag ruleset $RELEASE_TAG_RULESET_ID has unexpected rules: '$rule_types'" || return 1 + + includes="$(gh api "$ruleset_endpoint" --jq '[.conditions.ref_name.include[]] | sort | join(",")')" || \ + fail_release_ruleset "could not verify Release tag ruleset $RELEASE_TAG_RULESET_ID scope" || return 1 + [[ ",$includes," == *",refs/tags/mobile-v*,"* ]] || \ + fail_release_ruleset "Release tag ruleset $RELEASE_TAG_RULESET_ID does not include refs/tags/mobile-v*" || return 1 + + excludes="$(gh api "$ruleset_endpoint" --jq '[.conditions.ref_name.exclude[]] | sort | join(",")')" || \ + fail_release_ruleset "could not verify Release tag ruleset $RELEASE_TAG_RULESET_ID exclusions" || return 1 + [[ -z "$excludes" ]] || \ + fail_release_ruleset "Release tag ruleset $RELEASE_TAG_RULESET_ID has unexpected exclusions: '$excludes'" || return 1 +} diff --git a/scripts/test-mobile-release-candidate-publisher.sh b/scripts/test-mobile-release-candidate-publisher.sh new file mode 100755 index 0000000000..92cfc69d84 --- /dev/null +++ b/scripts/test-mobile-release-candidate-publisher.sh @@ -0,0 +1,157 @@ +#!/usr/bin/env bash +set -euo pipefail + +repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +publisher="$repo_root/scripts/publish-mobile-release-candidate.sh" +tmp="$(mktemp -d)" +trap 'rm -rf "$tmp"' EXIT + +bin="$tmp/bin" +mkdir -p "$bin" +cat > "$bin/gh" <<'GH' +#!/usr/bin/env bash +set -euo pipefail + +record() { + printf '%s\n' "$*" >> "$GH_CALLS" +} + +case "${1:-}:${2:-}" in + api:repos/block/buzz/rulesets/14378754) + case "$*" in + *'.enforcement'*) printf '%s\n' "${GH_TAG_RULESET_STATE:-active}" ;; + *'.current_user_can_bypass'*) printf '%s\n' "${GH_CURRENT_USER_CAN_BYPASS-always}" ;; + *'[.rules[].type]'*) printf '%s\n' "${GH_TAG_RULE_TYPES:-creation,deletion,non_fast_forward,update}" ;; + *'.conditions.ref_name.include[]'*) printf '%s\n' "${GH_TAG_INCLUDES:-refs/tags/mobile-v*}" ;; + *'.conditions.ref_name.exclude[]'*) printf '%s\n' "${GH_TAG_EXCLUDES:-}" ;; + *) exit 2 ;; + esac + ;; + api:repos/block/buzz/git/ref/heads/main) printf '%s\n' "$GH_TARGET_SHA" ;; + api:repos/block/buzz/commits/*) printf '%s\n' "$GH_TARGET_SHA" ;; + api:--paginate) + [[ "$3" == "repos/block/buzz/git/matching-refs/tags/mobile-v1.2.3-rc." ]] + printf '%s' "${GH_EXISTING_REFS:-}" + ;; + api:--method) + endpoint="$4" + case "$endpoint" in + repos/block/buzz/git/tags) + record "$*" + printf '%s\n' "$GH_TAG_OBJECT_SHA" + ;; + repos/block/buzz/git/refs) + record "$*" + ;; + *) exit 2 ;; + esac + ;; + api:repos/block/buzz/git/ref/tags/mobile-v1.2.3-rc.*) + if [[ "$*" == *'.object.type'* ]]; then + printf '%s\n' "${GH_PUBLISHED_REF_TYPE:-tag}" + else + printf '%s\n' "${GH_PUBLISHED_REF_SHA:-$GH_TAG_OBJECT_SHA}" + fi + ;; + api:repos/block/buzz/git/tags/*) + if [[ "$*" == *'.object.type'* ]]; then + printf '%s\n' "${GH_ANNOTATED_TARGET_TYPE:-commit}" + else + printf '%s\n' "${GH_ANNOTATED_TARGET_SHA:-$GH_TARGET_SHA}" + fi + ;; + *) + echo "unexpected gh call: $*" >&2 + exit 2 + ;; +esac +GH +chmod +x "$bin/gh" + +export PATH="$bin:$PATH" +export GH_CALLS="$tmp/calls" +export GITHUB_REPOSITORY=block/buzz +export GH_TARGET_SHA=1111111111111111111111111111111111111111 +export GH_TAG_OBJECT_SHA=2222222222222222222222222222222222222222 + +"$publisher" 1.2.3 1 "$GH_TARGET_SHA" +grep -Fq -- '-f tag=mobile-v1.2.3-rc.1' "$GH_CALLS" +grep -Fq -- '-f message=Buzz Mobile 1.2.3 release candidate 1' "$GH_CALLS" +grep -Fq -- "-f object=$GH_TARGET_SHA" "$GH_CALLS" +grep -Fq -- '-f type=commit' "$GH_CALLS" +grep -Fq -- '-f ref=refs/tags/mobile-v1.2.3-rc.1' "$GH_CALLS" +grep -Fq -- "-f sha=$GH_TAG_OBJECT_SHA" "$GH_CALLS" + +if GH_CURRENT_USER_CAN_BYPASS=never "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then + echo "publisher accepted an App token without an always bypass" >&2 + exit 1 +fi +if GH_CURRENT_USER_CAN_BYPASS='' "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then + echo "publisher accepted a ruleset response without an effective bypass" >&2 + exit 1 +fi +if GH_TAG_RULESET_STATE=disabled "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then + echo "publisher accepted disabled tag protection" >&2 + exit 1 +fi +if GH_TAG_RULE_TYPES=creation "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then + echo "publisher accepted incomplete tag protection" >&2 + exit 1 +fi +if GH_TAG_INCLUDES=refs/tags/v\* "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then + echo "publisher accepted a tag ruleset that excludes mobile candidates" >&2 + exit 1 +fi +if GH_TAG_EXCLUDES=refs/tags/mobile-v0.0.0 "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then + echo "publisher accepted tag ruleset exclusions" >&2 + exit 1 +fi +if GH_TARGET_SHA=3333333333333333333333333333333333333333 \ + "$publisher" 1.2.3 1 1111111111111111111111111111111111111111 >/dev/null 2>&1; then + echo "publisher accepted a moved main branch" >&2 + exit 1 +fi +if GH_EXISTING_REFS=$'refs/tags/mobile-v1.2.3-rc.1\n' \ + "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then + echo "publisher accepted a stale candidate number" >&2 + exit 1 +fi +if GH_PUBLISHED_REF_TYPE=commit "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then + echo "publisher accepted a lightweight published tag" >&2 + exit 1 +fi +if GH_PUBLISHED_REF_SHA=3333333333333333333333333333333333333333 \ + "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then + echo "publisher accepted the wrong annotated tag object" >&2 + exit 1 +fi +if GH_ANNOTATED_TARGET_TYPE=tag "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then + echo "publisher accepted a nested annotated tag" >&2 + exit 1 +fi +if GH_ANNOTATED_TARGET_SHA=3333333333333333333333333333333333333333 \ + "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then + echo "publisher accepted an annotated tag on the wrong commit" >&2 + exit 1 +fi +if "$publisher" 01.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then + echo "publisher accepted a marketing version with a leading zero" >&2 + exit 1 +fi +if "$publisher" 1.2.3 01 "$GH_TARGET_SHA" >/dev/null 2>&1; then + echo "publisher accepted a candidate number with a leading zero" >&2 + exit 1 +fi +if GH_EXISTING_REFS=$'refs/tags/mobile-v1.2.3-rc.1\nrefs/tags/mobile-v1.2.3-rc.7\nrefs/tags/mobile-v1.2.3-rc.08\nrefs/tags/mobile-v1.2.4-rc.99\n' \ + "$publisher" 1.2.3 8 "$GH_TARGET_SHA" >/dev/null; then + : +else + echo "publisher did not sequence from the highest exact candidate" >&2 + exit 1 +fi +if GITHUB_REPOSITORY=attacker/buzz "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then + echo "publisher accepted the wrong repository" >&2 + exit 1 +fi + +echo "mobile release candidate publisher contract passed" diff --git a/scripts/test-mobile-release-contract.sh b/scripts/test-mobile-release-contract.sh index 4df87c6d66..6c1de75f9d 100755 --- a/scripts/test-mobile-release-contract.sh +++ b/scripts/test-mobile-release-contract.sh @@ -8,7 +8,84 @@ trap 'rm -rf "$tmp"' EXIT remote="$tmp/remote.git" work="$tmp/work" operator="$tmp/operator" +bin="$tmp/bin" canonical_origin="git@github.com:block/buzz.git" +mkdir -p "$bin" + +cat > "$bin/gh" <<'GH' +#!/usr/bin/env bash +set -euo pipefail +case "${1:-}:${2:-}" in + --version:*) printf 'gh version %s (test)\n' "${GH_VERSION:-2.94.0}" ;; + api:repos/block/buzz/rulesets/14378754) + case "$*" in + *'.enforcement'*) printf '%s\n' "${GH_TAG_RULESET_STATE:-active}" ;; + *'.current_user_can_bypass'*) printf '%s\n' "${GH_CURRENT_USER_CAN_BYPASS-always}" ;; + *'[.rules[].type]'*) printf '%s\n' "${GH_TAG_RULE_TYPES:-creation,deletion,non_fast_forward,update}" ;; + *'.conditions.ref_name.include[]'*) printf '%s\n' "${GH_TAG_INCLUDES:-refs/tags/mobile-v*}" ;; + *'.conditions.ref_name.exclude[]'*) printf '%s\n' "${GH_TAG_EXCLUDES:-}" ;; + *) exit 2 ;; + esac + ;; + workflow:run) + if [[ "${GH_WORKFLOW_DISPATCH_FAIL:-}" == "1" ]]; then + printf '%s\n' "${GH_WORKFLOW_DISPATCH_ERROR:-dispatch failed}" >&2 + exit 1 + fi + if [[ "${GH_WORKFLOW_WRONG_URL:-}" == "1" ]]; then + printf '%s\n' 'https://github.com/attacker/buzz/actions/runs/999' + exit 0 + fi + if [[ "${GH_WORKFLOW_EXTRA_URL:-}" == "1" ]]; then + printf '%s\n' 'https://github.com/block/buzz/actions/runs/998' + fi + version="" + number="" + sha="" + while [[ "$#" -gt 0 ]]; do + case "$1" in + version=*) version="${1#version=}" ;; + candidate_number=*) number="${1#candidate_number=}" ;; + target_sha=*) sha="${1#target_sha=}" ;; + esac + shift + done + [[ -n "$version" && -n "$number" && -n "$sha" ]] + printf '%s\t%s\t%s\n' "$version" "$number" "$sha" >> "$GH_WORKFLOW_CAPTURE" + if [[ "${GH_WORKFLOW_NO_URL:-}" == "1" ]]; then + exit 0 + fi + printf 'https://github.com/block/buzz/actions/runs/%s\n' "$number" + ;; + run:watch) + [[ "${GH_WORKFLOW_FAIL:-}" != "1" ]] || exit 1 + number="$3" + IFS=$'\t' read -r version expected sha < <(tail -n 1 "$GH_WORKFLOW_CAPTURE") + [[ "$number" == "$expected" ]] + if [[ "${GH_MAIN_MOVE_DURING_WORKFLOW:-}" == "1" ]]; then + printf '%s\n' moved >> "$GH_WORKTREE/file" + git -C "$GH_WORKTREE" commit -qam moved-during-publication + git -C "$GH_WORKTREE" push -q origin main + fi + if [[ "${GH_TAG_VERIFY_LIGHTWEIGHT:-}" == "1" ]]; then + git -C "$GH_WORKTREE" -c tag.gpgSign=false tag \ + "mobile-v${version}-rc.${expected}" "$sha" + else + git -C "$GH_WORKTREE" -c tag.gpgSign=false tag -a \ + -m "Buzz Mobile $version release candidate $expected" \ + "mobile-v${version}-rc.${expected}" "$sha" + fi + git -C "$GH_WORKTREE" -c core.hooksPath=/dev/null push -q \ + origin "refs/tags/mobile-v${version}-rc.${expected}" + ;; + *) exit 2 ;; +esac +GH +chmod +x "$bin/gh" + +export PATH="$bin:$PATH" +export GH_WORKFLOW_CAPTURE="$tmp/workflow-dispatches" +export GH_WORKTREE="$work" run_release() { local repo="$1" @@ -31,89 +108,126 @@ git init -q "$work" git -C "$work" config user.name test git -C "$work" config user.email test@example.com git -C "$work" remote add origin "$canonical_origin" +git -C "$work" config "url.file://$remote.insteadOf" "$canonical_origin" +git -C "$work" config protocol.file.allow always echo first > "$work/file" git -C "$work" add file git -C "$work" commit -qm first git -C "$work" branch -M main git --git-dir="$remote" symbolic-ref HEAD refs/heads/main -git -C "$work" -c "url.file://$remote.insteadOf=$canonical_origin" \ - -c protocol.file.allow=always push -q -u origin main +git -C "$work" push -q -u origin main -# Candidate publication must work from a stale operator clone and tag the exact -# current remote main commit, never the operator's checkout. +# Candidate publication must work from a stale operator clone, warn about the +# stale checkout, and target the exact current remote main commit. git -c "url.file://$remote.insteadOf=$canonical_origin" \ -c protocol.file.allow=always clone -q "$canonical_origin" "$operator" git -C "$operator" config user.name test git -C "$operator" config user.email test@example.com echo remote-only >> "$work/file" git -C "$work" commit -qam remote-only -git -C "$work" -c "url.file://$remote.insteadOf=$canonical_origin" \ - -c protocol.file.allow=always push -q origin main +git -C "$work" push -q origin main remote_main_sha="$(git --git-dir="$remote" rev-parse refs/heads/main)" if git -C "$operator" cat-file -e "$remote_main_sha^{commit}" 2>/dev/null; then fail "stale-clone fixture already contains the remote-only commit" fi -run_release "$operator" candidate 1.2.3 +run_release "$operator" candidate 1.2.3 > "$tmp/stale-output" 2> "$tmp/stale-error" +grep -Fq "Note: local HEAD is $(git -C "$operator" rev-parse HEAD); candidate source is current origin/main $remote_main_sha." \ + "$tmp/stale-error" +cat "$tmp/stale-output" [[ "$(git --git-dir="$remote" rev-parse 'refs/tags/mobile-v1.2.3-rc.1^{commit}')" == \ "$remote_main_sha" ]] [[ "$(git --git-dir="$remote" cat-file -t refs/tags/mobile-v1.2.3-rc.1)" == tag ]] -if git -C "$operator" show-ref --verify --quiet refs/tags/mobile-v1.2.3-rc.1; then - fail "successful candidate publication stranded a local tag" -fi +grep -Fq $'1.2.3\t1\t' "$GH_WORKFLOW_CAPTURE" -# Existing remote identities are immutable and candidate numbers increase -# monotonically. A later candidate for the same marketing version may point at -# a newer main commit, while the prior candidate never moves. +# Existing remote identities remain unchanged. Later candidates sequence +# monotonically and target the then-current remote main commit. rc1_tag_oid="$(git --git-dir="$remote" rev-parse refs/tags/mobile-v1.2.3-rc.1)" echo newer >> "$work/file" git -C "$work" commit -qam newer -git -C "$work" -c "url.file://$remote.insteadOf=$canonical_origin" \ - -c protocol.file.allow=always push -q origin main +git -C "$work" push -q origin main new_main_sha="$(git --git-dir="$remote" rev-parse refs/heads/main)" run_release "$operator" candidate 1.2.3 [[ "$(git --git-dir="$remote" rev-parse refs/tags/mobile-v1.2.3-rc.1)" == "$rc1_tag_oid" ]] [[ "$(git --git-dir="$remote" rev-parse 'refs/tags/mobile-v1.2.3-rc.2^{commit}')" == \ "$new_main_sha" ]] [[ "$(git --git-dir="$remote" cat-file -t refs/tags/mobile-v1.2.3-rc.2)" == tag ]] +grep -Fq $'1.2.3\t2\t' "$GH_WORKFLOW_CAPTURE" # Sequence from the highest exact remote RC even if there are gaps, and ignore # malformed or other-version tags. git -C "$work" -c tag.gpgSign=false tag -a -m gap mobile-v1.2.3-rc.7 "$new_main_sha" git -C "$work" -c tag.gpgSign=false tag -a -m malformed mobile-v1.2.3-rc.08 "$new_main_sha" git -C "$work" -c tag.gpgSign=false tag -a -m other mobile-v1.2.4-rc.99 "$new_main_sha" -git -C "$work" -c "url.file://$remote.insteadOf=$canonical_origin" \ - -c protocol.file.allow=always push -q origin \ +git -C "$work" push -q origin \ refs/tags/mobile-v1.2.3-rc.7 refs/tags/mobile-v1.2.3-rc.08 \ refs/tags/mobile-v1.2.4-rc.99 run_release "$operator" candidate 1.2.3 [[ "$(git --git-dir="$remote" rev-parse 'refs/tags/mobile-v1.2.3-rc.8^{commit}')" == \ "$new_main_sha" ]] -# A rejected publication must remove its temporary local tag and leave no -# remote identity behind. -failing_operator="$tmp/failing-operator" -git -c "url.file://$remote.insteadOf=$canonical_origin" \ - -c protocol.file.allow=always clone -q "$canonical_origin" "$failing_operator" -git -C "$failing_operator" config user.name test -git -C "$failing_operator" config user.email test@example.com -mkdir -p "$failing_operator/.git/hooks" -cat > "$failing_operator/.git/hooks/pre-push" <<'HOOK' -#!/usr/bin/env bash -exit 1 -HOOK -chmod +x "$failing_operator/.git/hooks/pre-push" -git -C "$failing_operator" config core.hooksPath .git/hooks -if run_release "$failing_operator" candidate 9.9.9 >/dev/null 2>&1; then - fail "candidate succeeded despite a rejected push" +# Failed or unattributable App-backed publication fails closed without creating +# the expected candidate tag. +if GH_WORKFLOW_DISPATCH_FAIL=1 run_release "$operator" candidate 9.9.7 >/dev/null 2>&1; then + fail "candidate succeeded despite a rejected workflow dispatch" +fi +if git --git-dir="$remote" show-ref --verify --quiet refs/tags/mobile-v9.9.7-rc.1; then + fail "rejected workflow dispatch created a candidate tag" fi -if git -C "$failing_operator" show-ref --verify --quiet refs/tags/mobile-v9.9.9-rc.1; then - fail "failed candidate publication stranded a local tag" +if GH_WORKFLOW_DISPATCH_FAIL=1 \ + GH_WORKFLOW_DISPATCH_ERROR="does not have 'workflow_dispatch' trigger" \ + run_release "$operator" candidate 9.9.6 > "$tmp/missing-workflow-output" 2>&1; then + fail "candidate succeeded without the publication workflow on main" +fi +grep -Fq 'merge the release-process change before publishing a candidate' \ + "$tmp/missing-workflow-output" +if git --git-dir="$remote" show-ref --verify --quiet refs/tags/mobile-v9.9.6-rc.1; then + fail "missing publication workflow created a candidate tag" +fi +if GH_WORKFLOW_FAIL=1 run_release "$operator" candidate 9.9.9 >/dev/null 2>&1; then + fail "candidate succeeded despite a failed App-backed workflow" fi if git --git-dir="$remote" show-ref --verify --quiet refs/tags/mobile-v9.9.9-rc.1; then - fail "failed candidate publication created a remote tag" + fail "failed App-backed workflow created a candidate tag" +fi +if GH_WORKFLOW_NO_URL=1 run_release "$operator" candidate 9.9.8 >/dev/null 2>&1; then + fail "candidate succeeded without a workflow run URL" fi +if git --git-dir="$remote" show-ref --verify --quiet refs/tags/mobile-v9.9.8-rc.1; then + fail "URL-less dispatch created a candidate tag" +fi +if GH_WORKFLOW_WRONG_URL=1 run_release "$operator" candidate 9.9.5 >/dev/null 2>&1; then + fail "candidate accepted a workflow run URL from another repository" +fi +if git --git-dir="$remote" show-ref --verify --quiet refs/tags/mobile-v9.9.5-rc.1; then + fail "wrong-repository workflow URL created a candidate tag" +fi +if GH_WORKFLOW_EXTRA_URL=1 run_release "$operator" candidate 9.9.4 >/dev/null 2>&1; then + fail "candidate accepted multiple workflow run URLs" +fi +if git --git-dir="$remote" show-ref --verify --quiet refs/tags/mobile-v9.9.4-rc.1; then + fail "ambiguous workflow URLs created a candidate tag" +fi +if GH_TAG_VERIFY_LIGHTWEIGHT=1 run_release "$operator" candidate 9.9.2 >/dev/null 2>&1; then + fail "candidate accepted a lightweight published tag" +fi +[[ "$(git --git-dir="$remote" cat-file -t refs/tags/mobile-v9.9.2-rc.1)" == commit ]] -# Publishing through a fork or an origin with no canonical identity is rejected. +# The publisher and operator both reject a main-tip race. The immutable tag may +# already exist at the prior tip, but the operator must not report it as a +# current-main candidate. +pre_race_main_sha="$(git --git-dir="$remote" rev-parse refs/heads/main)" +if GH_MAIN_MOVE_DURING_WORKFLOW=1 run_release "$operator" candidate 9.9.3 > "$tmp/main-race-output" 2>&1; then + fail "candidate succeeded after main moved during publication" +fi +post_race_main_sha="$(git --git-dir="$remote" rev-parse refs/heads/main)" +[[ "$pre_race_main_sha" != "$post_race_main_sha" ]] +[[ "$(git --git-dir="$remote" rev-parse 'refs/tags/mobile-v9.9.3-rc.1^{commit}')" == \ + "$pre_race_main_sha" ]] +grep -Fq "origin/main moved from requested commit $pre_race_main_sha to $post_race_main_sha during publication" \ + "$tmp/main-race-output" + +# Publishing through a fork is rejected and unsupported gh versions fail before +# dispatching any candidate publication. fork_operator="$tmp/fork-operator" git clone -q "$remote" "$fork_operator" git -C "$fork_operator" config user.name test @@ -121,22 +235,14 @@ git -C "$fork_operator" config user.email test@example.com if (cd "$fork_operator" && "$script" candidate 2.0.0 >/dev/null 2>&1); then fail "noncanonical origin was accepted" fi -if git --git-dir="$remote" show-ref --verify --quiet refs/tags/mobile-v2.0.0-rc.1; then - fail "noncanonical origin published a candidate" +before_dispatches="$(wc -l < "$GH_WORKFLOW_CAPTURE")" +if GH_VERSION=2.86.0 run_release "$operator" candidate 2.0.0 >/dev/null 2>&1; then + fail "gh older than 2.87.0 was accepted" fi - -# A colliding local tag is never overwritten or removed. -local_collision_oid="$(git -C "$operator" rev-parse HEAD)" -git -C "$operator" -c tag.gpgSign=false tag -a -m local-collision \ - mobile-v3.0.0-rc.1 "$local_collision_oid" -if run_release "$operator" candidate 3.0.0 >/dev/null 2>&1; then - fail "colliding local tag was overwritten" -fi -[[ "$(git -C "$operator" rev-parse 'refs/tags/mobile-v3.0.0-rc.1^{commit}')" == \ - "$local_collision_oid" ]] -if git --git-dir="$remote" show-ref --verify --quiet refs/tags/mobile-v3.0.0-rc.1; then - fail "colliding local tag was published" +if GH_VERSION=2.9.0 run_release "$operator" candidate 2.0.0 >/dev/null 2>&1; then + fail "numeric gh version comparison accepted 2.9.0 as at least 2.87.0" fi +[[ "$(wc -l < "$GH_WORKFLOW_CAPTURE")" == "$before_dispatches" ]] # Dirty trees and invalid marketing versions fail before publication. echo dirty > "$operator/untracked" @@ -147,9 +253,13 @@ rm "$operator/untracked" if run_release "$operator" candidate 1.2 >/dev/null 2>&1; then fail "invalid marketing version was accepted" fi +if run_release "$operator" candidate 01.2.3 >/dev/null 2>&1; then + fail "marketing version with a leading zero was accepted" +fi -# Mobile no longer has release branches, a finalization command, a stable alias, -# a GitHub Release call, or metadata-only release recipes. +# Mobile no longer has release branches, finalization, a stable alias, or a +# GitHub Release call. Publication remains App-backed because the strict tag +# ruleset denies direct human creation. if run_release "$operator" start 2.0.0 >/dev/null 2>&1; then fail "removed start command was accepted" fi @@ -162,11 +272,12 @@ fi if git --git-dir="$remote" show-ref --verify --quiet refs/tags/mobile-v1.2.3; then fail "stable mobile tag alias was created" fi -if grep -qE '(^|[^[:alnum:]_])(gh[[:space:]]+release|mobile-release/|finalize)([^[:alnum:]_]|$)' \ - "$script"; then - fail "removed branch/finalization/GitHub Release behavior remains in script" +if rg -q 'gh[[:space:]]+release|mobile-release/|finalize' \ + "$repo_root/scripts/mobile-release.sh" \ + "$repo_root/scripts/publish-mobile-release-candidate.sh" \ + "$repo_root/.github/workflows/mobile-release-candidate.yml"; then + fail "removed branch/finalization/GitHub Release behavior remains" fi - grep -Fq 'version: 0.0.0+1' "$repo_root/mobile/pubspec.yaml" if grep -qE 'release-mobile|bump-mobile-version|get-current-mobile-version' "$repo_root/Justfile"; then fail "metadata-only mobile release recipe remains in Justfile" From 1a10a09b38ecd422b9b5c5747f75e7b341e09f2c Mon Sep 17 00:00:00 2001 From: npub1sv749mw8zcmld4ygjx2mx2aqcn3zvtuj2nlmgatxgad3t9uweu9q5marze <833d52edc71637f6d4889195b32ba0c4e2262f9254ffb47566475b15978ecf0a@sprout-oss.stage.blox.sqprod.co> Date: Wed, 22 Jul 2026 15:53:10 -0700 Subject: [PATCH 4/5] test(release): make removed behavior check discriminating Co-authored-by: npub1sv749mw8zcmld4ygjx2mx2aqcn3zvtuj2nlmgatxgad3t9uweu9q5marze <833d52edc71637f6d4889195b32ba0c4e2262f9254ffb47566475b15978ecf0a@sprout-oss.stage.blox.sqprod.co> Signed-off-by: npub1sv749mw8zcmld4ygjx2mx2aqcn3zvtuj2nlmgatxgad3t9uweu9q5marze <833d52edc71637f6d4889195b32ba0c4e2262f9254ffb47566475b15978ecf0a@sprout-oss.stage.blox.sqprod.co> --- scripts/test-mobile-release-contract.sh | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/scripts/test-mobile-release-contract.sh b/scripts/test-mobile-release-contract.sh index 6c1de75f9d..531590a585 100755 --- a/scripts/test-mobile-release-contract.sh +++ b/scripts/test-mobile-release-contract.sh @@ -103,6 +103,16 @@ fail() { exit 1 } +assert_no_removed_mobile_release_behavior() { + local status + + grep -Eq 'gh[[:space:]]+release|mobile-release/|finalize' "$@" && \ + fail "removed branch/finalization/GitHub Release behavior remains" + status="$?" + [[ "$status" -eq 1 ]] || \ + fail "could not scan for removed branch/finalization/GitHub Release behavior" +} + git init -q --bare "$remote" git init -q "$work" git -C "$work" config user.name test @@ -272,11 +282,16 @@ fi if git --git-dir="$remote" show-ref --verify --quiet refs/tags/mobile-v1.2.3; then fail "stable mobile tag alias was created" fi -if rg -q 'gh[[:space:]]+release|mobile-release/|finalize' \ - "$repo_root/scripts/mobile-release.sh" \ - "$repo_root/scripts/publish-mobile-release-candidate.sh" \ - "$repo_root/.github/workflows/mobile-release-candidate.yml"; then - fail "removed branch/finalization/GitHub Release behavior remains" +assert_no_removed_mobile_release_behavior \ + "$repo_root/scripts/mobile-release.sh" \ + "$repo_root/scripts/publish-mobile-release-candidate.sh" \ + "$repo_root/.github/workflows/mobile-release-candidate.yml" +# Prove the negative contract itself is discriminating rather than merely +# accepting a missing or broken search tool as "not found." +printf '%s\n' 'gh release create forbidden' > "$tmp/forbidden-mobile-release-behavior" +if (assert_no_removed_mobile_release_behavior "$tmp/forbidden-mobile-release-behavior") \ + >/dev/null 2>&1; then + fail "removed-behavior assertion did not reject a forbidden GitHub Release call" fi grep -Fq 'version: 0.0.0+1' "$repo_root/mobile/pubspec.yaml" if grep -qE 'release-mobile|bump-mobile-version|get-current-mobile-version' "$repo_root/Justfile"; then From 169d3e43f83fc151aef98ea3ef5ce6543163a484 Mon Sep 17 00:00:00 2001 From: "7a9c8f0147a0755c5d499320bda5535cd5014715e52fb7757dfe3dadde1cef09@buzz.block.builderlab.xyz" <7a9c8f0147a0755c5d499320bda5535cd5014715e52fb7757dfe3dadde1cef09@buzz.block.builderlab.xyz> Date: Thu, 23 Jul 2026 13:47:39 -0700 Subject: [PATCH 5/5] fix(release): verify sole ruleset bypass actor Co-authored-by: npub102wg7q285p64ch2fjvstmf2ntn2sz3c4u5hmwatalc76mhsuauysftjtfj <7a9c8f0147a0755c5d499320bda5535cd5014715e52fb7757dfe3dadde1cef09@buzz.block.builderlab.xyz> Signed-off-by: npub102wg7q285p64ch2fjvstmf2ntn2sz3c4u5hmwatalc76mhsuauysftjtfj <7a9c8f0147a0755c5d499320bda5535cd5014715e52fb7757dfe3dadde1cef09@buzz.block.builderlab.xyz> --- RELEASING.md | 5 ++--- scripts/release-rulesets.sh | 7 ++++++- .../test-mobile-release-candidate-publisher.sh | 16 ++++++++++++++++ 3 files changed, 24 insertions(+), 4 deletions(-) diff --git a/RELEASING.md b/RELEASING.md index 9785122aad..7dfeebc6be 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -221,9 +221,8 @@ release App because strict tag protection denies direct human creation. The App must be installed on `block/buzz`, have Contents write and Metadata read, and retain an `always` bypass on the immutable `mobile-v*` tag rules. It does not require GitHub Releases permissions, repository Administration permission, or a -mobile release-branch ruleset. The publisher validates the App token's effective -`current_user_can_bypass` value rather than reading the ruleset's hidden bypass -actor list. +mobile release-branch ruleset. The publisher validates both the App token's +effective `current_user_can_bypass` value and the exact ruleset bypass actor set. --- diff --git a/scripts/release-rulesets.sh b/scripts/release-rulesets.sh index bd0ac1fdf8..3c1cfe0777 100755 --- a/scripts/release-rulesets.sh +++ b/scripts/release-rulesets.sh @@ -22,7 +22,7 @@ require_canonical_repository() { } require_release_tag_ruleset() { - local ruleset_endpoint state can_bypass rule_types includes excludes + local ruleset_endpoint state can_bypass bypass_actors rule_types includes excludes command -v gh >/dev/null 2>&1 || fail_release_ruleset "gh is required" || return 1 ruleset_endpoint="repos/block/buzz/rulesets/$RELEASE_TAG_RULESET_ID" @@ -37,6 +37,11 @@ require_release_tag_ruleset() { [[ "$can_bypass" == "always" ]] || \ fail_release_ruleset "release App cannot always bypass Release tag ruleset $RELEASE_TAG_RULESET_ID (reported '$can_bypass')" || return 1 + bypass_actors="$(gh api "$ruleset_endpoint" --jq '[.bypass_actors[] | [.actor_type, (.actor_id | tostring), .bypass_mode] | join(":")] | sort | join(",")')" || \ + fail_release_ruleset "could not verify Release tag ruleset $RELEASE_TAG_RULESET_ID bypass actors" || return 1 + [[ "$bypass_actors" == "Integration:4349119:always" ]] || \ + fail_release_ruleset "Release tag ruleset $RELEASE_TAG_RULESET_ID has unexpected bypass actors: '$bypass_actors'" || return 1 + rule_types="$(gh api "$ruleset_endpoint" --jq '[.rules[].type] | sort | join(",")')" || \ fail_release_ruleset "could not verify Release tag ruleset $RELEASE_TAG_RULESET_ID rules" || return 1 [[ "$rule_types" == "creation,deletion,non_fast_forward,update" ]] || \ diff --git a/scripts/test-mobile-release-candidate-publisher.sh b/scripts/test-mobile-release-candidate-publisher.sh index 92cfc69d84..f5c5e6f9e6 100755 --- a/scripts/test-mobile-release-candidate-publisher.sh +++ b/scripts/test-mobile-release-candidate-publisher.sh @@ -21,6 +21,7 @@ case "${1:-}:${2:-}" in case "$*" in *'.enforcement'*) printf '%s\n' "${GH_TAG_RULESET_STATE:-active}" ;; *'.current_user_can_bypass'*) printf '%s\n' "${GH_CURRENT_USER_CAN_BYPASS-always}" ;; + *'.bypass_actors[]'*) printf '%s\n' "${GH_BYPASS_ACTORS:-Integration:4349119:always}" ;; *'[.rules[].type]'*) printf '%s\n' "${GH_TAG_RULE_TYPES:-creation,deletion,non_fast_forward,update}" ;; *'.conditions.ref_name.include[]'*) printf '%s\n' "${GH_TAG_INCLUDES:-refs/tags/mobile-v*}" ;; *'.conditions.ref_name.exclude[]'*) printf '%s\n' "${GH_TAG_EXCLUDES:-}" ;; @@ -90,6 +91,21 @@ if GH_CURRENT_USER_CAN_BYPASS='' "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/nul echo "publisher accepted a ruleset response without an effective bypass" >&2 exit 1 fi +if GH_BYPASS_ACTORS='Integration:4349119:always,Integration:9876543:always' \ + "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then + echo "publisher accepted an extra ruleset bypass actor" >&2 + exit 1 +fi +if GH_BYPASS_ACTORS='Integration:9876543:always' \ + "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then + echo "publisher accepted a substituted ruleset bypass actor" >&2 + exit 1 +fi +if GH_BYPASS_ACTORS='Integration:4349119:pull_request' \ + "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then + echo "publisher accepted a ruleset bypass actor with the wrong mode" >&2 + exit 1 +fi if GH_TAG_RULESET_STATE=disabled "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then echo "publisher accepted disabled tag protection" >&2 exit 1