54 lines
1.7 KiB
Bash
Executable File
54 lines
1.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
VERSION="${1:?version required, e.g. V2R1C4}"
|
|
TARGET_OID="${2:?target_oid required}"
|
|
EVIDENCE_CLOSURE_OID="${3:?evidence_closure_oid required}"
|
|
APPROVAL_PLAN_ID="${4:?approval_plan_id required}"
|
|
WORKSPACE="${AIOS_GITOPS_WORKSPACE:-/data/aios-gitops/workspace}"
|
|
TAG_REMOTE="${AIOS_GITOPS_GITEA_REMOTE:-gitea}"
|
|
BRANCH_REMOTE="${AIOS_GITOPS_BRANCH_REMOTE:-gitea}"
|
|
|
|
case "$VERSION" in
|
|
V[0-9]*R[0-9]*C[0-9]*) ;;
|
|
*) echo "ERROR: version must match VxRxCx" >&2; exit 64 ;;
|
|
esac
|
|
|
|
for value in "$TARGET_OID" "$EVIDENCE_CLOSURE_OID"; do
|
|
[[ "$value" =~ ^[0-9a-f]{40}$ ]] || {
|
|
echo "ERROR: target and evidence OIDs must be full lowercase 40-character OIDs" >&2
|
|
exit 64
|
|
}
|
|
done
|
|
|
|
[[ -n "$APPROVAL_PLAN_ID" ]] || {
|
|
echo "ERROR: approval_plan_id is required" >&2
|
|
exit 64
|
|
}
|
|
|
|
cd "$WORKSPACE"
|
|
BRANCH="$(git symbolic-ref --quiet --short HEAD)" || {
|
|
echo "ERROR: release must run on an isolated branch, not detached HEAD" >&2
|
|
exit 65
|
|
}
|
|
case "$BRANCH" in
|
|
main|master) echo "ERROR: direct main/master release writes are forbidden" >&2; exit 65 ;;
|
|
esac
|
|
|
|
python3 "$WORKSPACE/active-runtime/app/gitea_tag_publication.py" publish \
|
|
--workspace "$WORKSPACE" \
|
|
--remote "$TAG_REMOTE" \
|
|
--version "$VERSION" \
|
|
--target-oid "$TARGET_OID" \
|
|
--evidence-closure-oid "$EVIDENCE_CLOSURE_OID" \
|
|
--approval-plan-id "$APPROVAL_PLAN_ID"
|
|
|
|
git add -- "baseline/current.json" "versions/$VERSION.json"
|
|
if ! git diff --cached --quiet; then
|
|
git commit -m "release($VERSION): record Gitea-confirmed baseline"
|
|
fi
|
|
|
|
# No force, no main push, and no ignored failure.
|
|
git push "$BRANCH_REMOTE" "HEAD:refs/heads/$BRANCH"
|
|
echo "RELEASE_BASELINE_UPDATED $VERSION branch=$BRANCH"
|