ac5ad39515
- Dependency job is now 16 days (service env + script default); a separate weekly scan-only timer reports npm/OSV findings without changing the lockfile. - TimeoutStartSec=30min on the deps job and 20min on the deploy job (systemd's 90s default could kill a legitimate run); both scripts resolve the newest nvm Node instead of hardcoding v22.23.1. - npm override pins @tanstack/query-core to $@tanstack/react-query so a blanket npm update cannot create a second copy (the Oct 26 tsc failure). - Failed runs keep test/smoke logs + attempted package files in failures/ (rotated, 8 kept) and a last-failure marker; reports rotate (12 kept). - scripts/release.sh: notes check -> npm test -> bump -> Android build -> zsp publish -> relay verify -> commit/push + tag. - Deploy/deps systemd units are tracked under scripts/systemd/.
129 lines
4.6 KiB
Bash
Executable file
129 lines
4.6 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
#
|
|
# One-command SkateSpots release: bump → test → build APK → publish to
|
|
# Zapstore → verify → commit/push (+ optional git tag).
|
|
#
|
|
# Usage:
|
|
# scripts/release.sh patch|minor|major [--yes]
|
|
# scripts/release.sh 1.7.1 [--yes]
|
|
#
|
|
# Before running:
|
|
# 1. write the new section at the TOP of release-notes.txt (do not commit it —
|
|
# this script commits it with the version bump);
|
|
# 2. provide the release signer WITHOUT putting it in shell history:
|
|
# export SIGN_WITH=nsec1... # current shell only
|
|
# or point at a 0600 file:
|
|
# export SKATES_RELEASE_ENV=$HOME/.config/skatespots/release.env
|
|
# # file contains: SIGN_WITH=nsec1...
|
|
#
|
|
# What it does NOT do: deploy the web (the skatespots-deploy.timer does that
|
|
# within ~3 min, 24h throttle) or touch the relay.
|
|
set -euo pipefail
|
|
|
|
REPO="/home/sovereignsk8/SkateSpots"
|
|
ZSP="${ZSP:-$HOME/go/bin/zsp}"
|
|
export ANDROID_HOME="${ANDROID_HOME:-$HOME/Android/Sdk}"
|
|
SPEC="${1:-}"
|
|
YES=0
|
|
shift || true
|
|
for a in "$@"; do [ "$a" = "--yes" ] && YES=1; done
|
|
|
|
die() { echo "✗ $*" >&2; exit 1; }
|
|
log() { echo "• $*"; }
|
|
|
|
[ -n "$SPEC" ] || die "usage: scripts/release.sh patch|minor|major|<x.y.z> [--yes]"
|
|
[ -x "$ZSP" ] || die "zsp not found/executable at $ZSP (set ZSP=...)"
|
|
[ -d "$ANDROID_HOME" ] || die "Android SDK not found at $ANDROID_HOME (set ANDROID_HOME=...)"
|
|
|
|
# Optional protected env file (never commit it).
|
|
if [ -z "${SIGN_WITH:-}" ] && [ -n "${SKATES_RELEASE_ENV:-}" ]; then
|
|
[ -f "$SKATES_RELEASE_ENV" ] || die "SKATES_RELEASE_ENV does not exist: $SKATES_RELEASE_ENV"
|
|
set -a
|
|
# shellcheck disable=SC1090
|
|
. "$SKATES_RELEASE_ENV"
|
|
set +a
|
|
fi
|
|
[ -n "${SIGN_WITH:-}" ] || die "SIGN_WITH is not set (export it or use SKATES_RELEASE_ENV)"
|
|
|
|
# Resolve the newest nvm Node (the old hard-coded path breaks after upgrades).
|
|
if [ -d "$HOME/.nvm/versions/node" ]; then
|
|
NODE_BIN="$(ls -d "$HOME"/.nvm/versions/node/*/bin 2>/dev/null | sort -V | tail -1)"
|
|
[ -n "$NODE_BIN" ] && export PATH="$NODE_BIN:$PATH"
|
|
fi
|
|
export PATH="$HOME/go/bin:$PATH"
|
|
|
|
cd "$REPO"
|
|
|
|
CURRENT="$(node -p "require('./package.json').version")"
|
|
log "current version: $CURRENT"
|
|
|
|
# The notes must be the only uncommitted change, so the release commit is clean.
|
|
if git diff --quiet -- release-notes.txt; then
|
|
die "release-notes.txt is unchanged — write the new section first (and don't commit it)"
|
|
fi
|
|
DIRTY="$(git status --porcelain | grep -vE '^ M release-notes\.txt$' || true)"
|
|
[ -z "$DIRTY" ] || die "working tree has other changes:
|
|
$DIRTY"
|
|
|
|
git fetch --quiet origin main
|
|
[ "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)" ] || \
|
|
die "local main is not in sync with origin/main — push or pull first"
|
|
|
|
if [ "$YES" -eq 0 ]; then
|
|
[ -t 0 ] || die "non-interactive: pass --yes to confirm"
|
|
printf 'Release %s from %s? [y/N] ' "$SPEC" "$CURRENT"
|
|
read -r ans
|
|
case "$ans" in y|Y|yes|YES) ;; *) die "aborted" ;; esac
|
|
fi
|
|
|
|
log "running the full test gate (this also builds the web bundle)…"
|
|
npm test
|
|
|
|
log "bumping version ($SPEC)…"
|
|
npm version "$SPEC" --no-git-tag-version >/dev/null
|
|
VERSION="$(node -p "require('./package.json').version")"
|
|
[ "$VERSION" != "$CURRENT" ] || die "version did not change"
|
|
log "version: $VERSION"
|
|
|
|
log "building the signed release APK…"
|
|
npm run android:build
|
|
|
|
APK="android/app/build/outputs/apk/release/app-release.apk"
|
|
[ -f "$APK" ] || die "APK not found at $APK"
|
|
SHA="$(sha256sum "$APK" | awk '{print $1}')"
|
|
log "APK: $APK (sha256 ${SHA:0:16}…)"
|
|
|
|
log "publishing to Zapstore…"
|
|
# shellcheck disable=SC2086
|
|
"$ZSP" publish --quiet zapstore.yaml
|
|
|
|
log "verifying the Zapstore release event…"
|
|
FOUND=0
|
|
for _ in 1 2 3 4 5 6; do
|
|
if command -v nak >/dev/null 2>&1; then
|
|
OUT="$(timeout 15 nak req -k 30063 -d "org.skatespots.app@$VERSION" wss://relay.zapstore.dev 2>/dev/null || true)"
|
|
if printf '%s' "$OUT" | grep -q "\[\"version\",\"$VERSION\"\]"; then FOUND=1; break; fi
|
|
else
|
|
log "nak not installed — skipping relay verification"
|
|
FOUND=1
|
|
break
|
|
fi
|
|
sleep 4
|
|
done
|
|
[ "$FOUND" -eq 1 ] || log "warning: the release event did not appear on the relay yet (it usually propagates shortly)"
|
|
|
|
log "committing the release…"
|
|
git add package.json package-lock.json release-notes.txt
|
|
git commit -m "release: $VERSION" >/dev/null
|
|
git tag -a "v$VERSION" -m "SkateSpots $VERSION"
|
|
git push origin main
|
|
if ! git push origin "v$VERSION" 2>/dev/null; then
|
|
log "warning: tag v$VERSION was created locally but the push failed"
|
|
fi
|
|
|
|
echo
|
|
echo "✓ SkateSpots $VERSION published"
|
|
echo " APK: $APK"
|
|
echo " SHA256: $SHA"
|
|
echo " Web: the deploy timer picks up the commit within ~3 min (24h throttle)"
|
|
echo " Zapstore: https://zapstore.dev/apps/org.skatespots.app"
|