Update release scripts (take 2)

.github/workflows/release.yml

@@ -21,11 +21,10 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@v3
-        with:
-          persist-credentials: false
       - uses: taiki-e/create-gh-release-action@v1
         with:
           changelog: CHANGELOG.md
           title: $version
           branch: 'main|v[0-9]+'
           token: ${{ secrets.GITHUB_TOKEN }}
+      - run: ci/publish.sh

ci/manifest.sh

@@ -3,6 +3,15 @@ set -euxo pipefail
 IFS=$'\n\t'
 cd "$(dirname "$0")"/..
 
+bail() {
+    echo >&2 "error: $*"
+    exit 1
+}
+
+if [[ -z "${CI:-}" ]]; then
+    bail "this script is intended to call from release workflow on CI"
+fi
+
 git config user.name "Taiki Endo"
 git config user.email "te316e89@gmail.com"
 

ci/publish.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+set -euo pipefail
+IFS=$'\n\t'
+cd "$(dirname "$0")"/..
+
+# shellcheck disable=SC2154
+trap 's=$?; echo >&2 "$0: Error on line "${LINENO}": ${BASH_COMMAND}"; exit ${s}' ERR
+
+bail() {
+    echo >&2 "error: $*"
+    exit 1
+}
+
+if [[ -z "${CI:-}" ]]; then
+    bail "this script is intended to call from release workflow on CI"
+fi
+ref="${GITHUB_REF:-}"
+if [[ "${ref}" != "refs/tags/"* ]]; then
+    bail "tag ref should start with 'refs/tags/'"
+fi
+tag="${ref#refs/tags/}"
+
+git config user.name "Taiki Endo"
+git config user.email "te316e89@gmail.com"
+
+version="${tag}"
+version="${version#v}"
+
+tools=()
+for tool in tools/codegen/base/*.json; do
+    tools+=("$(basename "${tool%.*}")")
+done
+# Aliases
+tools+=(nextest)
+# Not manifest-base
+tools+=(valgrind)
+
+(
+    set -x
+
+    major_version_tag="v${version%%.*}"
+    git checkout -b "${major_version_tag}"
+    git push origin refs/heads/"${major_version_tag}"
+    if git --no-pager tag | grep -Eq "^${major_version_tag}$"; then
+        git tag -d "${major_version_tag}"
+        git push --delete origin refs/tags/"${major_version_tag}"
+    fi
+    git tag "${major_version_tag}"
+    git checkout main
+    git branch -d "${major_version_tag}"
+)
+
+for tool in "${tools[@]}"; do
+    (
+        set -x
+        git checkout -b "${tool}"
+        sed -i -e "s/required: true/required: false/g" action.yml
+        sed -i -e "s/# default: #publish:tool/default: ${tool}/g" action.yml
+        git add action.yml
+        git commit -m "${tool}"
+        git push origin -f refs/heads/"${tool}"
+        if git --no-pager tag | grep -Eq "^${tool}$"; then
+            git tag -d "${tool}"
+            git push --delete origin refs/tags/"${tool}"
+        fi
+        git tag "${tool}"
+        git checkout main
+        git branch -D "${tool}"
+    )
+done
+
+set -x
+
+git push origin --tags

tools/publish.sh

@@ -14,6 +14,14 @@ trap 's=$?; echo >&2 "$0: Error on line "${LINENO}": ${BASH_COMMAND}"; exit ${s}
 # Note: This script requires the following tools:
 # - parse-changelog <https://github.com/taiki-e/parse-changelog>
 
+x() {
+    local cmd="$1"
+    shift
+    (
+        set -x
+        "${cmd}" "$@"
+    )
+}
 bail() {
     echo >&2 "error: $*"
     exit 1
@@ -40,6 +48,7 @@ if gh release view "${tag}" &>/dev/null; then
     bail "tag '${tag}' has already been created and pushed"
 fi
 
+# Make sure that the release was created from an allowed branch.
 if ! git branch | grep -q '\* main$'; then
     bail "current branch is not 'main'"
 fi
@@ -88,57 +97,11 @@ echo "======================================="
 
 if [[ -n "${tags}" ]]; then
     # Create a release commit.
-    git add "${changelog}"
-    git commit -m "Release ${version}"
+    x git add "${changelog}"
+    x git commit -m "Release ${version}"
 fi
 
-tools=()
-for tool in tools/codegen/base/*.json; do
-    tools+=("$(basename "${tool%.*}")")
-done
-# Aliases
-tools+=(nextest)
-# Not manifest-base
-tools+=(valgrind)
-
-(
-    set -x
-
-    git tag "${tag}"
-    git push origin main
-    git push origin --tags
-
-    major_version_tag="v${version%%.*}"
-    git checkout -b "${major_version_tag}"
-    git push origin refs/heads/"${major_version_tag}"
-    if git --no-pager tag | grep -Eq "^${major_version_tag}$"; then
-        git tag -d "${major_version_tag}"
-        git push --delete origin refs/tags/"${major_version_tag}"
-    fi
-    git tag "${major_version_tag}"
-    git checkout main
-    git branch -d "${major_version_tag}"
-)
-
-for tool in "${tools[@]}"; do
-    (
-        set -x
-        git checkout -b "${tool}"
-        sed -i -e "s/required: true/required: false/g" action.yml
-        sed -i -e "s/# default: #publish:tool/default: ${tool}/g" action.yml
-        git add action.yml
-        git commit -m "${tool}"
-        git push origin -f refs/heads/"${tool}"
-        if git --no-pager tag | grep -Eq "^${tool}$"; then
-            git tag -d "${tool}"
-            git push --delete origin refs/tags/"${tool}"
-        fi
-        git tag "${tool}"
-        git checkout main
-        git branch -D "${tool}"
-    )
-done
-
-set -x
-
-git push origin --tags
+x git tag "${tag}"
+# TODO: the following still assumes admin permissions
+x git push origin main
+x git push origin --tags