coder/scripts/release/publish.sh

#!/usr/bin/env bash

# This script generates release notes and publishes all of the given assets to
# GitHub releases. Depends on GitHub CLI.
#
# THIS IS NOT INTENDED TO BE CALLED BY DEVELOPERS! This is called by the release
# pipeline to do the final publish step. If you want to create a release use:
#   git tag -a -m "$ver" "$ver" && git push origin "$ver"
#
# Usage: ./publish.sh [--version 1.2.3] [--dry-run] path/to/asset1 path/to/asset2 ...
#
# The supplied images must already be pushed to the registry or this will fail.
# Also, the source images cannot be in a different registry than the target
# image generated by ./image_tag.sh.
# The supplied assets will be uploaded to the GitHub release as-is, as well as a
# file containing checksums.
#
# If no version is specified, defaults to the version from ./version.sh. The
# script will exit early if the branch is not tagged with the provided version
# (plus the "v" prefix) unless run with --dry-run.
#
# If the --dry-run parameter is supplied, the release will not be published to
# GitHub at all.
#
# Returns the link to the created GitHub release (unless --dry-run was
# specified).

set -euo pipefail
# shellcheck source=scripts/lib.sh
source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/lib.sh"

if [[ "${CI:-}" == "" ]]; then
	error "This script must be run in CI"
fi

version=""
release_notes_file=""
dry_run=0

args="$(getopt -o "" -l version:,release-notes-file:,dry-run -- "$@")"
eval set -- "$args"
while true; do
	case "$1" in
	--version)
		version="$2"
		shift 2
		;;
	--release-notes-file)
		release_notes_file="$2"
		shift 2
		;;
	--dry-run)
		dry_run=1
		shift
		;;
	--)
		shift
		break
		;;
	*)
		error "Unrecognized option: $1"
		;;
	esac
done

# Check dependencies
dependencies gh

# Remove the "v" prefix.
version="${version#v}"
if [[ "$version" == "" ]]; then
	version="$(execrelative ./version.sh)"
fi

if [[ -z $release_notes_file ]]; then
	error "No release notes files specified, use --release-notes-file."
fi

# realpath-ify all input files so we can cdroot below.
files=()
for f in "$@"; do
	if [[ ! -e "$f" ]]; then
		error "File not found: $f"
	fi
	files+=("$(realpath "$f")")
done
if [[ "${#files[@]}" == 0 ]]; then
	error "No files supplied"
fi

if [[ "$dry_run" == 0 ]] && [[ "$version" == *dev* ]]; then
	error "Cannot publish a dev version to GitHub"
fi

# The git commands need to be executed from within the repository.
cdroot

# Verify that we're currently checked out on the supplied tag.
new_tag="v$version"
if [[ "$(git describe --always)" != "$new_tag" ]]; then
	if [[ "$dry_run" == 0 ]]; then
		error "The provided version '$new_tag' does not match the current git describe output '$(git describe --always)'"
	fi

	log "The provided version does not match the current git tag, but --dry-run was supplied so continuing..."
fi

# Create temporary release folder so we can generate checksums. Both the
# sha256sum and gh binaries support symlinks as input files so this works well.
temp_dir="$(mktemp -d)"
for f in "${files[@]}"; do
	ln -s "$f" "$temp_dir/"
done

# Generate checksums file which will be uploaded to the GitHub release.
pushd "$temp_dir"
checksum_file="coder_${version}_checksums.txt"
sha256sum ./* | sed -e 's/\.\///' - >"$checksum_file"
popd

# Sign the checksums file if we have a GPG key. We skip this step in dry-run
# because we don't want to sign a fake release with our real key.
if [[ "$dry_run" == 0 ]] && [[ "${CODER_GPG_RELEASE_KEY_BASE64:-}" != "" ]]; then
	log "--- Signing checksums file"
	log

	# Import the GPG key.
	old_gnupg_home="${GNUPGHOME:-}"
	gnupg_home_temp="$(mktemp -d)"
	export GNUPGHOME="$gnupg_home_temp"
	echo "$CODER_GPG_RELEASE_KEY_BASE64" | base64 -d | gpg --import 1>&2

	# Sign the checksums file. This generates a file in the same directory and
	# with the same name as the checksums file but ending in ".asc".
	#
	# We pipe `true` into `gpg` so that it never tries to be interactive (i.e.
	# ask for a passphrase). The key we import above is not password protected.
	true | gpg --detach-sign --armor "${temp_dir}/${checksum_file}" 1>&2

	rm -rf "$gnupg_home_temp"
	unset GNUPGHOME
	if [[ "$old_gnupg_home" != "" ]]; then
		export GNUPGHOME="$old_gnupg_home"
	fi

	signed_checksum_path="${temp_dir}/${checksum_file}.asc"
	if [[ ! -e "$signed_checksum_path" ]]; then
		log "Signed checksum file not found: ${signed_checksum_path}"
		log
		log "Files in ${temp_dir}:"
		ls -l "$temp_dir"
		log
		error "Failed to sign checksums file. See above for more details."
	fi

	log
	log
fi

log "--- Publishing release $new_tag on GitHub"
log
log "Description:"
sed -e 's/^/\t/' - <"$release_notes_file" 1>&2
log
log "Contents:"
pushd "$temp_dir"
find ./* 2>&1 | sed -e 's/^/\t/;s/\.\///' - 1>&2
popd
log
log

# We pipe `true` into `gh` so that it never tries to be interactive.
true |
	maybedryrun "$dry_run" gh release create \
		--title "$new_tag" \
		--notes-file "$release_notes_file" \
		"$new_tag" \
		"$temp_dir"/*

rm -rf "$temp_dir"
rm -rf "$release_notes_file"