makiolaj
881f6b1286
Brings the workflows, scripts and fastlane setup up to Agendula's
v1.1.0-beta.1 state:
- beta.yaml: a release/** branch carrying X.Y.Z-beta.N publishes a
Gitea + Codeberg pre-release with the signed APK. Never F-Droid or Play.
- scripts/version_info.sh derives versionCode from versionName for every
workflow and CI step. Clockula has no shipped 1.0.x codes, so it uses one
scheme: X*1000000 + Y*10000 + Z*100 + (beta N, or 99 for stable).
- CI checks the committed versionCode, blocks a beta from reaching main,
enforces the 500-char What's New and validates the store listing.
- Shared publish_gitea_release.sh / publish_codeberg_release.sh /
release_notes.sh replace the inline steps in release.yaml.
- Renovate also runs on every push to main to rebase conflicted PRs.
- jniLibs keepDebugSymbols, which the reproducibility guard now requires.
Fixes a bug present in Agendula too: the Codeberg tag lookups used
/git/refs/tags/{tag}, which matches by prefix, so v1.0.0 would have
"existed" as soon as v1.0.0-beta.1 did. That would have refused every
later beta and skipped the stable release. Both now use /tags/{tag}.
97 lines
4.3 KiB
Bash
Executable File
97 lines
4.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Publish TAG on Codeberg, which is canonical for tags and releases, with the
|
|
# signed APK and its SHA-256 checksum attached: the direct-download channel
|
|
# that Obtainium follows. Shared by .gitea/workflows/release.yaml (stable) and
|
|
# beta.yaml (pre-release). Run from the repo checkout: it pushes the tag.
|
|
#
|
|
# Codeberg push-mirrors branches and tags to Gitea, but releases aren't git
|
|
# objects and don't sync in either direction, so this pushes the tag straight
|
|
# to Codeberg and creates the release over the API. Skips cleanly when TOKEN is
|
|
# unset; fails loudly on anything else (see release.yaml for why).
|
|
#
|
|
# Env:
|
|
# TOKEN CODEBERG_RELEASE_TOKEN (write:repository); empty = skip
|
|
# API https://codeberg.org/api/v1/repos/<owner>/<repo>
|
|
# TAG, SHA vX.Y.Z[-beta.N] and the commit it marks
|
|
# PRERELEASE true | false
|
|
# NOTES_FILE release notes (scripts/release_notes.sh)
|
|
# APK the signed release APK
|
|
set -euo pipefail
|
|
if [ -z "${TOKEN:-}" ]; then
|
|
echo "CODEBERG_RELEASE_TOKEN not set — skipping Codeberg publish."
|
|
exit 0
|
|
fi
|
|
: "${API:?}" "${TAG:?}" "${SHA:?}" "${PRERELEASE:?}" "${NOTES_FILE:?}" "${APK:?}"
|
|
if [ ! -f "$APK" ]; then echo "No release APK at $APK." >&2; exit 1; fi
|
|
|
|
WORK=$(mktemp -d)
|
|
trap 'rm -rf "$WORK"' EXIT
|
|
|
|
ASSET_APK="clockula_${TAG}.apk"
|
|
ASSET_SUM="${ASSET_APK}.sha256"
|
|
cp "$APK" "$WORK/$ASSET_APK"
|
|
( cd "$WORK" && sha256sum "$ASSET_APK" > "$ASSET_SUM" )
|
|
|
|
# Push the tag to Codeberg ourselves. Under Codeberg-canonical the mirror runs
|
|
# Codeberg -> Gitea, so waiting for a tag to arrive from Gitea (what 0.3.2 did)
|
|
# would wait forever. The tag minted on Gitea is in fact *deleted* by the next
|
|
# mirror sync until Codeberg has it, so pushing it here is what makes it
|
|
# durable on both forges.
|
|
#
|
|
# Pushing the ref first and creating the release with NO target_commitish is
|
|
# deliberate: a release POST carrying a target_commitish for a commit or tag
|
|
# Codeberg hasn't received yet is what produced the empty-bodied 500s.
|
|
# Attaching to a ref that already exists doesn't need the API to write one.
|
|
HOST=${API#https://}; HOST=${HOST%%/*}
|
|
REPO=${API#*/repos/}
|
|
git tag -f "$TAG" "$SHA"
|
|
git push -f "https://${REPO%%/*}:${TOKEN}@${HOST}/${REPO}.git" "refs/tags/$TAG"
|
|
|
|
python3 - "$TAG" "$PRERELEASE" "$NOTES_FILE" <<'PY' > "$WORK/payload.json"
|
|
import json, sys
|
|
tag, pre, notes = sys.argv[1:4]
|
|
print(json.dumps({
|
|
"tag_name": tag,
|
|
"name": tag,
|
|
"body": open(notes).read(),
|
|
"draft": False,
|
|
"prerelease": pre == "true",
|
|
}))
|
|
PY
|
|
|
|
# Create (or update) the release. Codeberg 500s on a POST/GET against a tag it
|
|
# has only just received (the release request outruns the indexing of the ref
|
|
# pushed a moment ago), so a single attempt can fail even though the very same
|
|
# call succeeds seconds later. Retry with backoff, and PATCH in place if a
|
|
# release already exists (re-run safe). A 5xx body still exits curl 0, so the
|
|
# loop, not `set -e`, controls the flow.
|
|
ID=""
|
|
for attempt in 1 2 3 4 5 6; do
|
|
EXIST=$(curl -s -H "Authorization: token $TOKEN" "$API/releases/tags/$TAG" | jq -r '.id // empty' 2>/dev/null || true)
|
|
if [ -n "$EXIST" ]; then
|
|
curl -s -o /dev/null -w "release PATCH HTTP %{http_code}\n" -X PATCH \
|
|
-H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
|
|
-d @"$WORK/payload.json" "$API/releases/$EXIST"
|
|
ID="$EXIST"; break
|
|
fi
|
|
CODE=$(curl -s -o "$WORK/response.json" -w "%{http_code}" -X POST \
|
|
-H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
|
|
-d @"$WORK/payload.json" "$API/releases")
|
|
echo "release POST attempt $attempt HTTP $CODE"
|
|
ID=$(jq -r '.id // empty' "$WORK/response.json" 2>/dev/null || true)
|
|
[ -n "$ID" ] && break
|
|
sleep $((attempt * 10))
|
|
done
|
|
if [ -z "$ID" ]; then echo "Could not resolve Codeberg release id after retries." >&2; exit 1; fi
|
|
|
|
# Attach APK + checksum, replacing any prior asset of the same name.
|
|
for A in "$ASSET_APK" "$ASSET_SUM"; do
|
|
OLD=$(curl -s -H "Authorization: token $TOKEN" "$API/releases/$ID/assets" \
|
|
| jq -r --arg n "$A" '.[] | select(.name==$n) | .id')
|
|
[ -n "$OLD" ] && curl -s -X DELETE -H "Authorization: token $TOKEN" "$API/releases/$ID/assets/$OLD" >/dev/null || true
|
|
curl -s -X POST -H "Authorization: token $TOKEN" \
|
|
-F "attachment=@$WORK/$A" \
|
|
"$API/releases/$ID/assets?name=$A" -o /dev/null -w "asset $A HTTP %{http_code}\n"
|
|
done
|
|
echo "Published $TAG to Codeberg."
|