53 lines
2.9 KiB
Bash
Executable File
53 lines
2.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Build unsigned pending artifacts from an already reviewed, versioned,
|
|
# annotated source tag. Never change source after recording BUILD-INFO.
|
|
set -euo pipefail
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
|
|
if [ "${1:-}" = --backend-only ]; then
|
|
[ "$#" = 2 ] && [[ "$2" =~ ^[0-9a-f]{64}$ ]] || { echo 'Exact Cargo.lock SHA256 required' >&2; exit 1; }
|
|
cd "$PROJECT_ROOT/core"
|
|
[ -f Cargo.lock ] && [ ! -L Cargo.lock ] || exit 1
|
|
ACTUAL=$(sha256sum Cargo.lock)
|
|
[ "${ACTUAL%% *}" = "$2" ] || { echo 'Cargo.lock mismatch' >&2; exit 1; }
|
|
exec cargo build --release -p archipelago --locked --offline
|
|
fi
|
|
|
|
VERSION="${1:-}"
|
|
DRY_RUN="${2:-}"
|
|
[[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]] \
|
|
&& [ "$#" -le 2 ] && [[ "$DRY_RUN" = '' || "$DRY_RUN" = --dry-run ]] \
|
|
|| { echo "Usage: $0 VERSION [--dry-run]" >&2; exit 1; }
|
|
[ "${SKIP_RELEASE_TESTS:-0}" = 0 ] || { echo 'Release gate bypass is forbidden' >&2; exit 1; }
|
|
SOURCE_COMMIT=$(python3 "$SCRIPT_DIR/release_payload.py" source --version "$VERSION")
|
|
OS_PLAN=${ARCHIPELAGO_OS_RELEASE_PLAN:?Set ARCHIPELAGO_OS_RELEASE_PLAN to the reviewed exact OS transaction JSON}
|
|
[ -f "$OS_PLAN" ] && [ ! -L "$OS_PLAN" ] || { echo 'OS release plan must be a regular file' >&2; exit 1; }
|
|
OS_PLAN=$(realpath "$OS_PLAN")
|
|
PENDING="$PROJECT_ROOT/releases/pending/v$VERSION/manifest.json"
|
|
ARTIFACTS="$PROJECT_ROOT/releases/v$VERSION"
|
|
[ ! -e "$PENDING" ] && [ ! -e "$ARTIFACTS" ] || { echo 'Existing candidate retained; use its verification/signing steps rather than rebuilding over it' >&2; exit 1; }
|
|
if [ "$DRY_RUN" = --dry-run ]; then
|
|
echo "Build backend/UI/AIUI/radio from $SOURCE_COMMIT; stage unsigned $PENDING."
|
|
echo 'Run under flock /tmp/opencode/release-heavy.lock. Source/tag creation and signing are separate operator steps.'
|
|
exit 0
|
|
fi
|
|
cd "$PROJECT_ROOT"
|
|
bash tests/release/run.sh
|
|
python3 scripts/release_payload.py companion
|
|
(cd core && cargo build --release -p archipelago --locked --offline)
|
|
(cd neode-ui && npm ci && npm run build)
|
|
bash scripts/build-aiui.sh
|
|
rm -rf web/dist/neode-ui/aiui
|
|
cp -r aiui/packages/app/dist web/dist/neode-ui/aiui
|
|
(cd reticulum-daemon && ./build.sh)
|
|
test "$SOURCE_COMMIT" = "$(python3 scripts/release_payload.py source --version "$VERSION")"
|
|
mkdir -p "$(dirname "$PENDING")" "$ARTIFACTS"
|
|
install -m 0644 "$OS_PLAN" "$ARTIFACTS/os-update-plan.json"
|
|
bash scripts/create-release-manifest.sh --version "$VERSION" --output "$PENDING" --os-plan "$ARTIFACTS/os-update-plan.json"
|
|
install -m 0755 core/target/release/archipelago "$ARTIFACTS/archipelago"
|
|
install -m 0644 "/tmp/archipelago-frontend-$VERSION.tar.gz" "$ARTIFACTS/archipelago-frontend-$VERSION.tar.gz"
|
|
bash scripts/check-release-manifest.sh "$PENDING"
|
|
echo "Unsigned candidate staged from $SOURCE_COMMIT; no commit, tag, signature or feed promotion performed."
|
|
echo "Operator signing command (inputs now exist): bash scripts/sign-manifest.sh '$PENDING'"
|