Node / ReticulumProjects / MeshChatX.git / files / scripts / ci / github-draft-release-upload-assets.sh

Displaying Raw • Download

T8b949e#!/usr/bin/env bash

T8b949e# Create the GitHub release as a draft if missing, upload every file in DIR, then

T8b949e# publish nightly/preview tags as prereleases. Draft-first is required when the

T8b949e# repository has immutable releases enabled (assets cannot be added after publish).

T8b949e# Skips electron-builder builder-debug.yml (and cosign bundles), including collision-renamed

T8b949e# copies (e.g. win__builder-debug.yml). Requires: gh, GH_TOKEN. TAG from TAG or GITHUB_REF_NAME.

Tffa657set -euo pipefail

Te6edf3DIRTff7b72=Ta5d6ff"Tffd700${Te6edf31Tb4b4b4:Tb4b4b4?path to directory of files to uploadTffd700}Ta5d6ff"

Te6edf3TAGTff7b72=Ta5d6ff"Tffd700${Te6edf3TAGTff7b72:-Tffd700${Te6edf3GITHUB_REF_NAMETb4b4b4:Tb4b4b4?set TAG or GITHUB_REF_NAMETffd700}Tffd700}Ta5d6ff"

Tff7b72if ! Tffa657command -v gh >/dev/null T79c0ff2>Tb4b4b4&T79c0ff1Tb4b4b4; Tff7b72then

Tffa657echo Ta5d6ff"gh is required" >Tb4b4b4&T79c0ff2

Tffa657exit T79c0ff1

Tff7b72fi

Tff7b72if Tff7b72[ -z Ta5d6ff"Tffd700${Te6edf3GH_TOKENTff7b72:-Tffd700}Ta5d6ff" Tff7b72]Tb4b4b4; Tff7b72then

Tffa657echo Ta5d6ff"GH_TOKEN is required" >Tb4b4b4&T79c0ff2

Tffa657exit T79c0ff1

Tff7b72fi

Tffa657export GH_TOKEN

Tff7b72if Tff7b72[ -z Ta5d6ff"Tffd700${Te6edf3GH_REPOTff7b72:-Tffd700}Ta5d6ff" Tff7b72] Tff7b72&& Tff7b72[ -n Ta5d6ff"Tffd700${Te6edf3GITHUB_REPOSITORYTff7b72:-Tffd700}Ta5d6ff" Tff7b72]Tb4b4b4; Tff7b72then

Tffa657export Te6edf3GH_REPOTff7b72=Ta5d6ff"Te6edf3$GITHUB_REPOSITORYTa5d6ff"

Tff7b72fi

is_auto_prerelease_tagTff7b72(Tff7b72) Tff7b72{

Tff7b72[Tff7b72[ Ta5d6ff"Te6edf3$1Ta5d6ff" Tff7b72=Tff7b72= nightly-* Tff7b72|| Ta5d6ff"Te6edf3$1Ta5d6ff" Tff7b72=Tff7b72= preview-* Tff7b72]Tff7b72]

Tff7b72}

mapfile -d Ta5d6ff'' -t all < <Tff7b72(

find Ta5d6ff"Te6edf3$DIRTa5d6ff" -type f Tffea00\

! -path Ta5d6ff'*/win-unpacked/*' Tffea00\

! -path Ta5d6ff'*/linux-unpacked/*' Tffea00\

! -path Ta5d6ff'*/mac-universal/*' Tffea00\

! -path Ta5d6ff'*/mac-arm64/*' Tffea00\

! -path Ta5d6ff'*/mac-x64/*' Tffea00\

! -path Ta5d6ff'*/mac/*.app/*' Tffea00\

-print0

Tff7b72)

skip_noiseTff7b72(Tff7b72) Tff7b72{

Tffa657local Te6edf3baseTff7b72=Ta5d6ff"Te6edf3$1Ta5d6ff"

Tff7b72case Ta5d6ff"Te6edf3$baseTa5d6ff" Tff7b72in

builder-debug.yml Tb4b4b4| builder-debug.yml.cosign.bundleTff7b72) Tff7b72return T79c0ff0 Tb4b4b4;Tb4b4b4;

*__builder-debug.yml Tb4b4b4| *__builder-debug.yml.cosign.bundleTff7b72) Tff7b72return T79c0ff0 Tb4b4b4;Tb4b4b4;

library.zip Tb4b4b4| library.zip.cosign.bundleTff7b72) Tff7b72return T79c0ff0 Tb4b4b4;Tb4b4b4;

*__library.zip Tb4b4b4| *__library.zip.cosign.bundleTff7b72) Tff7b72return T79c0ff0 Tb4b4b4;Tb4b4b4;

*.so.yml Tb4b4b4| *.so.yml.cosign.bundleTff7b72) Tff7b72return T79c0ff0 Tb4b4b4;Tb4b4b4;

Tff7b72esac

Tff7b72return T79c0ff1

Tff7b72}

Te6edf3filteredTff7b72=Tff7b72(Tff7b72)

Tff7b72for f Tff7b72in Ta5d6ff"Tffd700${Te6edf3allTb4b4b4[@]Tffd700}Ta5d6ff"Tb4b4b4; Tff7b72do

Te6edf3bTff7b72=Tff7b72$(basename Ta5d6ff"Te6edf3$fTa5d6ff"Tff7b72)

Tff7b72if skip_noise Ta5d6ff"Te6edf3$bTa5d6ff"Tb4b4b4; Tff7b72then

Tff7b72continue

Tff7b72fi

Te6edf3filteredTff7b72+=Tff7b72(Ta5d6ff"Te6edf3$fTa5d6ff"Tff7b72)

Tff7b72done

Te6edf3allTff7b72=Tff7b72(Ta5d6ff"Tffd700${Te6edf3filteredTb4b4b4[@]Tffd700}Ta5d6ff"Tff7b72)

Tff7b72if Tff7b72[ Ta5d6ff"Tffd700${#Te6edf3allTb4b4b4[@]Tffd700}Ta5d6ff" -eq T79c0ff0 Tff7b72]Tb4b4b4; Tff7b72then

Tffa657echo Ta5d6ff"Ta5d6ffNo files under Tffd700${Te6edf3DIRTffd700}Ta5d6ff (after excluding electron-builder debug YAML)Ta5d6ff" >Tb4b4b4&T79c0ff2

Tffa657exit T79c0ff1

Tff7b72fi

Tffa657declare -A seen

Tff7b72for f Tff7b72in Ta5d6ff"Tffd700${Te6edf3allTb4b4b4[@]Tffd700}Ta5d6ff"Tb4b4b4; Tff7b72do

Te6edf3bTff7b72=Tff7b72$(basename Ta5d6ff"Te6edf3$fTa5d6ff"Tff7b72)

seenTff7b72[Te6edf3$bTff7b72]Tff7b72=Tff7b72$((Tffd700${Te6edf3seenTb4b4b4[Te6edf3$bTb4b4b4]Tff7b72:-Te6edf30Tffd700} Tff7b72+ T79c0ff1Tff7b72))

Tff7b72done

Te6edf3STAGETff7b72=Tff7b72$(mktemp -dTff7b72)

Te6edf3notes_fileTff7b72=Tff7b72$(mktempTff7b72)

Tffa657trap Ta5d6ff'rm -rf "$STAGE" "$notes_file"' EXIT

Tff7b72for f Tff7b72in Ta5d6ff"Tffd700${Te6edf3allTb4b4b4[@]Tffd700}Ta5d6ff"Tb4b4b4; Tff7b72do

Te6edf3bTff7b72=Tff7b72$(basename Ta5d6ff"Te6edf3$fTa5d6ff"Tff7b72)

Tff7b72if Tff7b72[ Ta5d6ff"Tffd700${Te6edf3seenTb4b4b4[Te6edf3$bTb4b4b4]Tffd700}Ta5d6ff" -gt T79c0ff1 Tff7b72]Tb4b4b4; Tff7b72then

Te6edf3relTff7b72=Ta5d6ff"Tffd700${Te6edf3fTb4b4b4#Ta5d6ff"Te6edf3$DIRTa5d6ff"Tb4b4b4/Tffd700}Ta5d6ff"

Te6edf3nameTff7b72=Ta5d6ff"Tffd700${Te6edf3relTb4b4b4//Tffea00\/Tb4b4b4/__Tffd700}Ta5d6ff"

Tff7b72else

Te6edf3nameTff7b72=Ta5d6ff"Te6edf3$bTa5d6ff"

Tff7b72fi

cp -- Ta5d6ff"Te6edf3$fTa5d6ff" Ta5d6ff"Te6edf3$STAGETa5d6ff/Te6edf3$nameTa5d6ff"

Tff7b72done

mapfile -t files < <Tff7b72(find Ta5d6ff"Te6edf3$STAGETa5d6ff" -type fTff7b72)

Tff7b72{

Tff7b72if Tff7b72[Tff7b72[ Ta5d6ff"Te6edf3$TAGTa5d6ff" Tff7b72=Tff7b72= nightly-* Tff7b72]Tff7b72]Tb4b4b4; Tff7b72then

Tffa657echo Ta5d6ff"**Nightly release** - automated daily snapshot from \`dev\`. Not a stable release, use tagged production releases for daily use."

Tffa657echo

Tffa657echo Ta5d6ff"Ta5d6ffCommit: \`Tffd700${Te6edf3GITHUB_SHATff7b72:-Te6edf3unknownTffd700}Ta5d6ff\`Ta5d6ff"

Tffa657echo

Tff7b72elif Tff7b72[Tff7b72[ Ta5d6ff"Te6edf3$TAGTa5d6ff" Tff7b72=Tff7b72= preview-dev-* Tff7b72]Tff7b72]Tb4b4b4; Tff7b72then

Tffa657echo Ta5d6ff"**Preview release (dev)** - automated snapshot from \`dev\`. Not a stable release, use tagged production releases for daily use."

Tffa657echo

Tffa657echo Ta5d6ff"Ta5d6ffCommit: \`Tffd700${Te6edf3GITHUB_SHATff7b72:-Te6edf3unknownTffd700}Ta5d6ff\`Ta5d6ff"

Tffa657echo

Tff7b72elif Tff7b72[Tff7b72[ Ta5d6ff"Te6edf3$TAGTa5d6ff" Tff7b72=Tff7b72= preview-* Tff7b72]Tff7b72]Tb4b4b4; Tff7b72then

Tffa657echo Ta5d6ff"**Preview release** - automated snapshot from \`master\`. Not a stable release, use tagged production releases for daily use."

Tffa657echo

Tffa657echo Ta5d6ff"Ta5d6ffCommit: \`Tffd700${Te6edf3GITHUB_SHATff7b72:-Te6edf3unknownTffd700}Ta5d6ff\`Ta5d6ff"

Tffa657echo

Tff7b72else

Tffa657echo Ta5d6ff"Automated draft release. Review assets and provenance before publishing."

Tffa657echo

Tff7b72fi

Tffa657echo Ta5d6ff"## SHA256 Checksums"

Tffa657echo

Tffa657echo Ta5d6ff"| Asset | SHA256 |"

Tffa657echo Ta5d6ff"|-------|--------|"

Tff7b72for f Tff7b72in Ta5d6ff"Tffd700${Te6edf3filesTb4b4b4[@]Tffd700}Ta5d6ff"Tb4b4b4; Tff7b72do

Te6edf3bTff7b72=Tff7b72$(basename Ta5d6ff"Te6edf3$fTa5d6ff"Tff7b72)

Te6edf3hashTff7b72=Tff7b72$(sha256sum Ta5d6ff"Te6edf3$fTa5d6ff" Tb4b4b4| awk Ta5d6ff'{print $1}'Tff7b72)

Tffa657printf Ta5d6ff"| %s | \`%s\` |\n" Ta5d6ff"Te6edf3$bTa5d6ff" Ta5d6ff"Te6edf3$hashTa5d6ff"

Tff7b72done

Tffa657echo

Tffa657echo Ta5d6ff"## Verification"

Tffa657echo

Tffa657echo Ta5d6ff"- **Cosign bundles** (\`.cosign.bundle\`) are attached for keyless sigstore verification."

Tffa657echo Ta5d6ff"- **SLSA provenance** (\`.intoto.jsonl\`) is available for supply-chain attestation."

Tffa657echo Ta5d6ff"- Or verify manually using the SHA256 table above."

Tff7b72} > Ta5d6ff"Te6edf3$notes_fileTa5d6ff"

Te6edf3release_existsTff7b72=Tffa657false

Te6edf3is_draftTff7b72=Tffa657true

Tff7b72if gh release view Ta5d6ff"Te6edf3$TAGTa5d6ff" >/dev/null T79c0ff2>Tb4b4b4&T79c0ff1Tb4b4b4; Tff7b72then

Te6edf3release_existsTff7b72=Tffa657true

Te6edf3is_draftTff7b72=Ta5d6ff"Tff7b72$(gh release view Ta5d6ff"Te6edf3$TAGTa5d6ff" --json isDraft --jq Ta5d6ff'.isDraft'Tff7b72)Ta5d6ff"

Tff7b72fi

Tff7b72if Tff7b72[ Ta5d6ff"Te6edf3$release_existsTa5d6ff" Tff7b72= Tffa657true Tff7b72] Tff7b72&& Tff7b72[ Ta5d6ff"Te6edf3$is_draftTa5d6ff" !Tff7b72= Ta5d6ff"true" Tff7b72]Tb4b4b4; Tff7b72then

Tffa657echo Ta5d6ff"Ta5d6ffRelease Tffd700${Te6edf3TAGTffd700}Ta5d6ff is already published.Ta5d6ff" >Tb4b4b4&T79c0ff2

Tffa657echo Ta5d6ff"Immutable releases cannot accept new assets after publish." >Tb4b4b4&T79c0ff2

Tffa657echo Ta5d6ff"Create a new tag, or delete this release (and its tag if allowed) and re-run." >Tb4b4b4&T79c0ff2

Tffa657exit T79c0ff1

Tff7b72fi

T8b949e# Always create/keep as draft while uploading. Immutable repos lock assets on publish.

Tff7b72if Tff7b72[ Ta5d6ff"Te6edf3$release_existsTa5d6ff" Tff7b72= Tffa657false Tff7b72]Tb4b4b4; Tff7b72then

gh release create Ta5d6ff"Te6edf3$TAGTa5d6ff" --draft --title Ta5d6ff"Te6edf3$TAGTa5d6ff" --notes-file Ta5d6ff"Te6edf3$notes_fileTa5d6ff"

Tff7b72else

gh release edit Ta5d6ff"Te6edf3$TAGTa5d6ff" --draft --title Ta5d6ff"Te6edf3$TAGTa5d6ff" --notes-file Ta5d6ff"Te6edf3$notes_fileTa5d6ff"

Tff7b72fi

Tff7b72for f Tff7b72in Ta5d6ff"Tffd700${Te6edf3filesTb4b4b4[@]Tffd700}Ta5d6ff"Tb4b4b4; Tff7b72do

gh release upload Ta5d6ff"Te6edf3$TAGTa5d6ff" Ta5d6ff"Te6edf3$fTa5d6ff" --clobber

Tff7b72done

T8b949e# Nightly/preview: publish as prerelease after all assets are attached.

T8b949e# Stable tags remain drafts for manual review.

Tff7b72if is_auto_prerelease_tag Ta5d6ff"Te6edf3$TAGTa5d6ff"Tb4b4b4; Tff7b72then

gh release edit Ta5d6ff"Te6edf3$TAGTa5d6ff" Tffea00\

--draftTff7b72=Tffa657false Tffea00\

--prerelease Tffea00\

--title Ta5d6ff"Te6edf3$TAGTa5d6ff" Tffea00\

--notes-file Ta5d6ff"Te6edf3$notes_fileTa5d6ff"

Tff7b72fi