plusplusjiajia commented on code in PR #34:
URL:
https://github.com/apache/terraform-provider-paimon/pull/34#discussion_r4236832014
##########
dev/release/release.sh:
##########
@@ -26,28 +39,102 @@ tag="v${version}"
rc_tag="${tag}-rc${rc}"
repository="apache/terraform-provider-paimon"
release_id="paimon-terraform-${version}"
+binary_sums="terraform-provider-paimon_${version}_SHA256SUMS"
dist_dev="https://dist.apache.org/repos/dist/dev/paimon";
dist_release="https://dist.apache.org/repos/dist/release/paimon";
+: "${RELEASE_REMOTE:=origin}"
+
+tag_args=(-s)
+if [[ -n "${GPG_LOCAL_USER:-}" ]]; then
+ tag_args=(-u "${GPG_LOCAL_USER}")
+fi
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "${repo_root}"
+
+# Check every fetch and push URL, since a remote can push somewhere other than
+# where it fetches from. URLs are never printed: they may embed credentials.
+remote_urls="$(git remote get-url --all "${RELEASE_REMOTE}")"
+remote_urls+=$'\n'"$(git remote get-url --push --all "${RELEASE_REMOTE}")"
+while IFS= read -r remote_url; do
+ case "${remote_url}" in
+ "[email protected]:${repository}.git" | "https://github.com/${repository}"; |
"https://github.com/${repository}.git";) ;;
+ *)
+ echo "remote ${RELEASE_REMOTE} has a fetch or push URL that is not
${repository}" >&2
+ echo "set RELEASE_REMOTE to a remote whose URLs all point at the Apache
repository" >&2
+ exit 1
+ ;;
+ esac
+done <<<"${remote_urls}"
if [[ -n "$(git status --porcelain)" ]]; then
echo "final releases must be published from a clean checkout" >&2
exit 1
fi
+git fetch "${RELEASE_REMOTE}" "refs/tags/${rc_tag}:refs/tags/${rc_tag}"
rc_commit="$(git rev-parse "${rc_tag}^{commit}")"
-git tag -a "${tag}" "${rc_commit}" -m "Apache Paimon Terraform provider
${version}"
-git push origin "${tag}"
-
-svn mv "${dist_dev}/${release_id}-rc${rc}" "${dist_release}/${release_id}" \
- -m "Apache Paimon Terraform provider ${version}"
work_dir="$(mktemp -d -t paimon-provider-release.XXXXXX)"
trap 'rm -rf "${work_dir}"' EXIT
-svn export "${dist_release}/${release_id}" "${work_dir}/source"
+
+# The registries reject a release without the signed checksums, so check the
+# voted assets before anything public changes.
gh release download "${rc_tag}" --repo "${repository}" --dir
"${work_dir}/assets" \
--pattern 'terraform-provider-paimon_*'
+for required in "${binary_sums}" "${binary_sums}.sig"
"terraform-provider-paimon_${version}_manifest.json"; do
+ [[ -f "${work_dir}/assets/${required}" ]] || { echo "RC prerelease is
missing ${required}" >&2; exit 1; }
+done
+gpg --verify "${work_dir}/assets/${binary_sums}.sig"
"${work_dir}/assets/${binary_sums}"
+
+git tag "${tag_args[@]}" "${tag}" "${rc_commit}" -m "Apache Paimon Terraform
${version}"
+git tag -v "${tag}"
+git push "${RELEASE_REMOTE}" "${tag}"
+
+svn mv "${dist_dev}/${release_id}-rc${rc}" "${dist_release}/${release_id}" \
+ -m "Apache Paimon Terraform provider ${version}"
+
+svn export "${dist_release}/${release_id}" "${work_dir}/source"
cp "${work_dir}/source/"* "${work_dir}/assets/"
gh release create "${tag}" --repo "${repository}" --title "Apache Paimon
Terraform provider ${version}" \
--generate-notes --verify-tag "${work_dir}/assets/"*
-echo "Published ${tag}: https://github.com/${repository}/releases/tag/${tag}";
-echo "Remember to record the release at
https://reporter.apache.org/addrelease.html?paimon";
+echo "Published ${tag}:"
+echo " ${dist_release}/${release_id}"
+echo " https://github.com/${repository}/releases/tag/${tag}";
+echo
+echo "Record the release at https://reporter.apache.org/addrelease.html?paimon";
+
+# ASF policy keeps only current releases in dist/release; older ones remain on
+# archive.apache.org. Only Terraform provider directories are listed here.
+superseded="$(svn ls "${dist_release}" | sed 's|/$||' | grep -E
'^paimon-terraform-[0-9]' |
+ grep -vx "${release_id}" || true)"
Review Comment:
Thanks, good catch. Fixed in ba878b1: release.sh now only lists older patch
releases of the same major.minor line (publishing 0.1.1 lists 0.1.0 and keeps
0.2.0), and step 5 of the guide says another line's last release is removed
only after the community agrees that line is no longer maintained. Verified
with a mocked `svn ls` covering your scenario, a new minor release, and
multi-digit patch numbers.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
