From 36db8ff3f4bee21b06f3208422be7cf91c7d3e40 Mon Sep 17 00:00:00 2001 From: Can Celik Date: Wed, 16 Sep 2026 18:25:59 +0300 Subject: ci: promote stable releases from protected previews (#4241) --- justfile | 53 +++++++++++++++++++++++++++-------------------------- 1 file changed, 27 insertions(+), 26 deletions(-) (limited to 'justfile') diff --git a/justfile b/justfile index 77bf48d5..88fc0315 100644 --- a/justfile +++ b/justfile @@ -13,7 +13,8 @@ test: # Run repository maintenance contract tests maintenance-test: - {{python}} -m unittest scripts.test_agent_detection_manifest_check scripts.test_changelog scripts.test_config_reference_check scripts.test_docs_translation_parity scripts.test_hermes_integration_asset scripts.test_package_windows_conpty scripts.test_preview scripts.test_unix_installer scripts.test_vendor_libghostty_vt scripts.test_vendor_portable_pty scripts.test_windows_cross + {{python}} -m unittest scripts.test_agent_detection_manifest_check scripts.test_changelog scripts.test_config_reference_check scripts.test_docs_translation_parity scripts.test_hermes_integration_asset scripts.test_package_windows_conpty scripts.test_preview scripts.test_release scripts.test_unix_installer scripts.test_vendor_libghostty_vt scripts.test_vendor_portable_pty scripts.test_windows_cross + bun test scripts/release-workflows.test.ts # Run one nextest filter, e.g. `just test-one codex_stale_working` test-one filter: @@ -151,8 +152,19 @@ pre-release-check: @echo "release review required: update skills/herdr/SKILL.md for this stable release so it matches the current CLI, IDs, agent lifecycle semantics, and safety guidance." @echo "release policy: do not update skills/herdr/SKILL.md between stable releases; preview builds keep the latest stable skill." -# Prepare the release commit without tagging or pushing (usage: just release-prepare 0.1.1) -release-prepare version: +# Publish a preview by pushing an admin-owned tag at the selected source commit. +preview ref='HEAD': + git fetch --prune origin '+refs/heads/master:refs/remotes/origin/master' '+refs/heads/release/*:refs/remotes/origin/release/*' --tags + @set -eu; \ + commit="$(python3 scripts/release.py preview-source --commit '{{ref}}')"; \ + day="$(git show -s --format=%cs "$commit")"; \ + short="$(git rev-parse --short=12 "$commit")"; \ + tag="preview-$day-$short"; \ + git tag -a "$tag" "$commit" -m "$tag"; \ + git push origin "refs/tags/$tag" + +# In a checkout based on the selected preview, prepare release-only metadata. +release-prepare version preview: @printf '%s\n' '{{version}}' | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$' || { \ echo "error: version must look like 0.6.6 without a v prefix"; \ exit 1; \ @@ -168,6 +180,7 @@ release-prepare version: echo "error: tag v{{version}} already exists"; \ exit 1; \ fi + python3 scripts/release.py check-source --preview '{{preview}}' just pre-release-check python3 scripts/changelog.py prepare --version {{version}} cp CHANGELOG.md docs/next/CHANGELOG.md @@ -176,10 +189,11 @@ release-prepare version: just check git add CHANGELOG.md docs/next/CHANGELOG.md Cargo.toml Cargo.lock skills/herdr/SKILL.md git diff --cached --quiet || git commit -m "release: v{{version}}" - @echo "v{{version}} release commit prepared. Review it, then run: just release-publish {{version}}" + python3 scripts/release.py check-source --preview '{{preview}}' + @echo "v{{version}} release commit prepared. Review it, then run: just release-publish {{version}} {{preview}}" -# Tag and push an already-prepared release commit (usage: just release-publish 0.1.1) -release-publish version: +# Tag a prepared preview-based release; never move master to the release candidate. +release-publish version preview: @printf '%s\n' '{{version}}' | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$' || { \ echo "error: version must look like 0.6.6 without a v prefix"; \ exit 1; \ @@ -188,11 +202,6 @@ release-publish version: echo "error: working tree must be clean before publishing"; \ exit 1; \ fi - @branch="$(git branch --show-current)"; \ - if [ "$branch" != "master" ]; then \ - echo "error: release-publish must run from master, got $branch"; \ - exit 1; \ - fi @git fetch origin master --tags @if git rev-parse "v{{version}}" >/dev/null 2>&1; then \ echo "error: tag v{{version}} already exists"; \ @@ -206,24 +215,16 @@ release-publish version: just release-docs-check python3 scripts/changelog.py extract --version {{version}} --output /tmp/herdr-release-notes-check.md rm -f /tmp/herdr-release-notes-check.md - @local_head="$(git rev-parse HEAD)"; \ - remote_head="$(git rev-parse origin/master)"; \ - if ! git merge-base --is-ancestor "$remote_head" "$local_head"; then \ - echo "error: origin/master is not an ancestor of HEAD; pull or rebase before publishing"; \ - exit 1; \ - fi; \ - if [ "$local_head" != "$remote_head" ]; then \ - echo "pushing release commit to origin/master"; \ - git push origin HEAD:master; \ - fi - git tag -a v{{version}} -m "v{{version}}" + @previous="$(git show origin/master:distribution/latest.json | python3 -c 'import json,sys; print("v" + json.load(sys.stdin)["version"])')"; \ + python3 scripts/release.py check --preview '{{preview}}' --version '{{version}}' --previous "$previous" && \ + git tag -a v{{version}} -m "v{{version}}" -m "Preview: {{preview}}" -m "Previous-Stable: $previous" git push origin v{{version}} @echo "v{{version}} released — GitHub Actions building binaries and updating distribution/latest.json" -# Prepare, verify, tag, push, and trigger the GitHub Release workflow (usage: just release 0.1.1) -release version: - just release-prepare {{version}} - just release-publish {{version}} +# Prepare and promote a published preview, not the latest master. +release version preview: + just release-prepare {{version}} {{preview}} + just release-publish {{version}} {{preview}} # Print default config default-config: -- cgit v1.2.3