JingsongLi commented on code in PR #34:
URL:
https://github.com/apache/terraform-provider-paimon/pull/34#discussion_r4236820437
##########
dev/release/release.sh:
##########
@@ -26,28 +39,102 @@ tag="v${version}"
rc_tag="${tag}-rc${rc}"
repository="apache/terraform-provider-paimon"
release_id="paimon-terraform-${version}"
+binary_sums="terraform-provider-paimon_${version}_SHA256SUMS"
dist_dev="https://dist.apache.org/repos/dist/dev/paimon";
dist_release="https://dist.apache.org/repos/dist/release/paimon";
+: "${RELEASE_REMOTE:=origin}"
+
+tag_args=(-s)
+if [[ -n "${GPG_LOCAL_USER:-}" ]]; then
+ tag_args=(-u "${GPG_LOCAL_USER}")
+fi
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "${repo_root}"
+
+# Check every fetch and push URL, since a remote can push somewhere other than
+# where it fetches from. URLs are never printed: they may embed credentials.
+remote_urls="$(git remote get-url --all "${RELEASE_REMOTE}")"
+remote_urls+=$'\n'"$(git remote get-url --push --all "${RELEASE_REMOTE}")"
+while IFS= read -r remote_url; do
+ case "${remote_url}" in
+ "[email protected]:${repository}.git" | "https://github.com/${repository}"; |
"https://github.com/${repository}.git";) ;;
+ *)
+ echo "remote ${RELEASE_REMOTE} has a fetch or push URL that is not
${repository}" >&2
+ echo "set RELEASE_REMOTE to a remote whose URLs all point at the Apache
repository" >&2
+ exit 1
+ ;;
+ esac
+done <<<"${remote_urls}"
if [[ -n "$(git status --porcelain)" ]]; then
echo "final releases must be published from a clean checkout" >&2
exit 1
fi
+git fetch "${RELEASE_REMOTE}" "refs/tags/${rc_tag}:refs/tags/${rc_tag}"
rc_commit="$(git rev-parse "${rc_tag}^{commit}")"
-git tag -a "${tag}" "${rc_commit}" -m "Apache Paimon Terraform provider
${version}"
-git push origin "${tag}"
-
-svn mv "${dist_dev}/${release_id}-rc${rc}" "${dist_release}/${release_id}" \
- -m "Apache Paimon Terraform provider ${version}"
work_dir="$(mktemp -d -t paimon-provider-release.XXXXXX)"
trap 'rm -rf "${work_dir}"' EXIT
-svn export "${dist_release}/${release_id}" "${work_dir}/source"
+
+# The registries reject a release without the signed checksums, so check the
+# voted assets before anything public changes.
gh release download "${rc_tag}" --repo "${repository}" --dir
"${work_dir}/assets" \
--pattern 'terraform-provider-paimon_*'
+for required in "${binary_sums}" "${binary_sums}.sig"
"terraform-provider-paimon_${version}_manifest.json"; do
+ [[ -f "${work_dir}/assets/${required}" ]] || { echo "RC prerelease is
missing ${required}" >&2; exit 1; }
+done
+gpg --verify "${work_dir}/assets/${binary_sums}.sig"
"${work_dir}/assets/${binary_sums}"
+
+git tag "${tag_args[@]}" "${tag}" "${rc_commit}" -m "Apache Paimon Terraform
${version}"
+git tag -v "${tag}"
+git push "${RELEASE_REMOTE}" "${tag}"
+
+svn mv "${dist_dev}/${release_id}-rc${rc}" "${dist_release}/${release_id}" \
+ -m "Apache Paimon Terraform provider ${version}"
+
+svn export "${dist_release}/${release_id}" "${work_dir}/source"
cp "${work_dir}/source/"* "${work_dir}/assets/"
gh release create "${tag}" --repo "${repository}" --title "Apache Paimon
Terraform provider ${version}" \
--generate-notes --verify-tag "${work_dir}/assets/"*
-echo "Published ${tag}: https://github.com/${repository}/releases/tag/${tag}";
-echo "Remember to record the release at
https://reporter.apache.org/addrelease.html?paimon";
+echo "Published ${tag}:"
+echo " ${dist_release}/${release_id}"
+echo " https://github.com/${repository}/releases/tag/${tag}";
+echo
+echo "Record the release at https://reporter.apache.org/addrelease.html?paimon";
+
+# ASF policy keeps only current releases in dist/release; older ones remain on
+# archive.apache.org. Only Terraform provider directories are listed here.
+superseded="$(svn ls "${dist_release}" | sed 's|/$||' | grep -E
'^paimon-terraform-[0-9]' |
+ grep -vx "${release_id}" || true)"
Review Comment:
**[P2] Preserve current releases from other maintained branches**
This classifies every release directory except the one being published as
superseded. For example, after `0.2.0` has been released, publishing `0.1.1`
from the newly documented `0.1.x` maintenance branch prints an `svn delete`
command for `paimon-terraform-0.2.0`. Although the script only prints the
command, post-release step 5 in the updated guide instructs the release manager
to delete the listed releases, so following the guide would remove another
maintained branch's current release from the canonical download directory.
I reproduced this with a mocked listing containing `0.1.0`, `0.1.1`, and
`0.2.0`: publishing `0.1.1` lists both `0.1.0` and `0.2.0` for deletion. Please
limit cleanup suggestions to older versions actually superseded within the same
release line, or require an explicit decision about which branches have reached
end of maintenance. [ASF
policy](https://www.apache.org/legal/release-policy.html#when-should-an-old-release-be-archived)
calls for retaining the latest release of each branch still under development.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
