nolimit-discounts/ci/publish-release.sh

#!/usr/bin/env bash
# Publish a release with the plugin zip attached, on whichever forge is running
# this, and then verify the result the way a shop will actually see it.
#
# Needs: TAG, GITHUB_REPOSITORY, GITHUB_API_URL, GITHUB_SERVER_URL, GH_TOKEN.
#
# The verification at the end is the part worth keeping. The update feed is
# read anonymously by every shop, and the two ways it breaks — a private
# repository and a release with no zip attached — both leave a release page
# that looks perfectly fine to whoever is logged in. Nobody would notice for
# months; what they would notice is that updates stopped arriving.
set -euo pipefail

cd "$(dirname "$0")/.."
. ci/lib.sh
ci_load_conf

: "${TAG:?TAG is not set}"
: "${GH_TOKEN:?GH_TOKEN is not set}"
: "${GITHUB_REPOSITORY:?}"
: "${GITHUB_API_URL:?}"

zip="build/$PLUGIN_SLUG.zip"
[ -f "$zip" ] || { echo "$zip does not exist — run ci/build-zip.sh first." >&2; exit 1; }

# RELEASE_REPO wins over the repository running the workflow: releases go to a
# separate public dist repo, so the source can be private while a shop still
# fetches its update anonymously. Falls back to the running repo, which is what
# a plugin without a split still wants.
target="${RELEASE_REPO:-$GITHUB_REPOSITORY}"
owner="${target%%/*}"
repo="${target#*/}"
echo "Publishing $TAG to $owner/$repo" >&2

# The tag message is the announcement, so it has to survive the checkout.
#
# actions/checkout fetches every tag correctly and then overwrites this one ref
# with the commit SHA — `fetch-depth: 0` does not save you. The annotated tag
# becomes a lightweight one pointing at the commit, and reading its message
# returns the COMMIT message instead: on a merge commit, "Merge pull request
# #12 from ...". Nothing fails. The release is simply published with the wrong
# text, and only the page shows it.
git fetch --force origin "refs/tags/$TAG:refs/tags/$TAG"

[ "$(git cat-file -t "$TAG")" = tag ] || {
  echo "$TAG is not an annotated tag. Its message is what gets published, so create it with 'git tag -a'." >&2
  exit 1
}

notes=$(git tag -l --format='%(contents)' "$TAG")
first_line=$(printf '%s\n' "$notes" | head -1)

case "$first_line" in
  'Merge pull request'*|'Merge branch'*|'')
    echo "The release notes read '$first_line'." >&2
    echo "That is a commit message, not the tag message — the annotated tag did not survive the checkout." >&2
    exit 1
    ;;
esac

ci_step "release notes"
printf '%s\n' "$notes" | sed 's/^/  /'

# The updater reads this line out of the release body, so wp-admin can show
# what this version was tested against rather than what the last one claimed.
readme=
for f in readme.txt README.txt; do [ -f "$f" ] && readme=$f && break; done
tested_wp=$([ -n "$readme" ] && sed -n -E 's/^Tested up to:[[:space:]]*([^[:space:]]+).*/\1/p' "$readme" | head -1)
tested_wc=$(ci_plugin_header 'WC tested up to')

body=$(printf '%s\n\n---\n\nTested up to: %s\nWC tested up to: %s\n' \
  "$notes" "${tested_wp:-unknown}" "${tested_wc:-unknown}")

# Read one top-level field out of a JSON response.
#
# Not sed. A greedy `.*"id":([0-9]+)` matches the LAST id in the payload, and a
# Gitea release carries both an embedded "author" object and, once anything is
# attached, an "assets" array — each with an id of its own. Measured on this
# repo: the four published releases have ids 416/417/419/421, and the greedy
# pattern returns 1/2/3/4, which are the asset ids.
#
# Those four releases were nonetheless published correctly, and only by luck:
# the author id on this instance is **-1**, and the minus sign stops `[0-9]+`
# from matching, so on a create response — which has no assets yet — the last
# numeric id happened to be the release's. A real author id, or a re-run
# against a release that already has its zip, and it picks the wrong number.
#
# Found by the session porting this into subscriptions, where it picked the
# author id and the upload 404'd. python3 is already a required tool here.
json_field() { # field  (JSON on stdin)
  python3 -c '
import json, sys
try:
    data = json.load( sys.stdin )
except Exception:
    sys.exit( 0 )
value = data.get( sys.argv[1] )
if value is not None:
    print( value )
' "$1"
}

api() { # method path [data]
  curl -fsS -X "$1" \
    -H "Authorization: token $GH_TOKEN" \
    -H 'Accept: application/json' \
    -H 'Content-Type: application/json' \
    ${3:+-d "$3"} \
    "$2"
}

if [ "${GITHUB_SERVER_URL:-}" = 'https://github.com' ]; then
  ci_step "publishing to GitHub"
  gh release create "$TAG" "$zip" --title "$TAG" --notes "$body" 2>/dev/null \
    || gh release upload "$TAG" "$zip" --clobber
  release_api="$GITHUB_API_URL/repos/$owner/$repo/releases/tags/$TAG"
else
  ci_step "publishing to $GITHUB_SERVER_URL"
  payload=$(printf '%s' "$body" | python3 -c '
import json, sys, os
print(json.dumps({
  "tag_name": os.environ["TAG"],
  "name": os.environ["TAG"],
  "body": sys.stdin.read(),
  "draft": False,
  "prerelease": False,
}))')

  # A re-run of a release must not fail on "already exists".
  existing=$(curl -fsS -H "Authorization: token $GH_TOKEN" \
    "$GITHUB_API_URL/repos/$owner/$repo/releases/tags/$TAG" 2>/dev/null || true)
  id=$(printf '%s' "$existing" | json_field id)

  if [ -z "$id" ]; then
    created=$(api POST "$GITHUB_API_URL/repos/$owner/$repo/releases" "$payload")
    id=$(printf '%s' "$created" | json_field id)
  fi
  [ -n "$id" ] || { echo "Could not create or find the release for $TAG." >&2; exit 1; }
  echo "  release id $id"

  # Before uploading anything to it, confirm the id really is this tag's. The
  # failure being guarded against is not a 404 — that is loud — but an id that
  # exists and belongs to something else, which would attach this plugin's zip
  # to an unrelated release with every check still green.
  release=$(curl -fsS -H "Authorization: token $GH_TOKEN" \
    "$GITHUB_API_URL/repos/$owner/$repo/releases/$id")
  actual=$(printf '%s' "$release" | json_field tag_name)
  if [ "$actual" != "$TAG" ]; then
    echo "Release id $id is tagged '$actual', not '$TAG'. Refusing to upload the zip to it." >&2
    exit 1
  fi

  # A re-run must not fail on the half that already succeeded: the upload
  # rejects a duplicate asset name.
  if printf '%s' "$release" | python3 -c '
import json, sys
data = json.load( sys.stdin )
sys.exit( 0 if any( a.get( "name" ) == sys.argv[1] for a in data.get( "assets", [] ) ) else 1 )
' "$PLUGIN_SLUG.zip"; then
    echo "  $PLUGIN_SLUG.zip is already attached — leaving it alone"
  else
    curl -fsS -X POST \
      -H "Authorization: token $GH_TOKEN" \
      -F "attachment=@$zip" \
      "$GITHUB_API_URL/repos/$owner/$repo/releases/$id/assets?name=$PLUGIN_SLUG.zip" >/dev/null
    echo "  attached $PLUGIN_SLUG.zip"
  fi

  release_api="$GITHUB_API_URL/repos/$owner/$repo/releases/latest"
fi

ci_step "the feed, read the way a shop reads it"

# Only the forge named in "Update URI" actually serves shops. This script runs
# on both, and the other one is a mirror — requiring a mirror to be anonymously
# readable would fail every release for a repository that is private on purpose.
# (It did, on the first v1.4.0 run: GitHub is private and is not the feed.)
update_uri=$(sed -n -E 's/^[[:space:]]*\*[[:space:]]*Update URI:[[:space:]]*(.*)/\1/p' "$PLUGIN_MAIN" | head -1 | tr -d '[:space:]')
feed_host=$(printf '%s' "$update_uri" | sed -E 's|^[a-z]+://([^/]+).*|\1|')
this_host=$(printf '%s' "${GITHUB_SERVER_URL:-}" | sed -E 's|^[a-z]+://([^/]+).*|\1|')

if [ -z "$update_uri" ]; then
  echo "The plugin header has no Update URI, so there is no feed to check."
  exit 0
fi

if [ "$feed_host" != "$this_host" ]; then
  echo "  $this_host is a mirror; shops read $feed_host. Nothing to verify here."
  exit 0
fi

feed=$(curl -fsS --max-time 30 "$release_api" 2>/dev/null || true)

if [ -z "$feed" ]; then
  echo
  ci_fail "$release_api cannot be read without credentials, so no shop will ever be offered this update."
  echo "Either the repository is still private, or the release was not created."
  echo "For Gitea: Settings → make the repository public. The update feed is a public read by design;"
  echo "that is the whole mechanism, and there is nothing secret in a GPL plugin zip anyway."
  exit 1
fi

printf '%s' "$feed" | grep -q '"browser_download_url"' || {
  echo
  ci_fail "The release is readable, but it has no zip attached. WordPress would be offered an update it cannot download."
  exit 1
}

# Checked at the address the PLUGIN builds, not the one the API reports.
#
# A forge fills browser_download_url from its own configured root URL, which is
# not necessarily the address the outside world reaches it on: gitea.nolimit.dk
# returns http://57.129.89.117:25001/... there, a plain-HTTP raw IP that
# bypasses the Cloudflare tunnel. Verifying that address would be verifying a
# URL no shop ever uses — a green check on the wrong thing, which is worse than
# no check.
package="$update_uri/releases/download/$TAG/$PLUGIN_SLUG.zip"
code=$(curl -s -o /tmp/wpci-feed.zip -w '%{http_code}' -L --max-time 120 "$package")
echo "  $package -> HTTP $code"
[ "$code" = 200 ] || { ci_fail "The package URL the plugin will use is not anonymously downloadable."; exit 1; }

# And it has to be the plugin, not an error page with a 200 on it.
python3 -c '
import sys, zipfile
names = zipfile.ZipFile("/tmp/wpci-feed.zip").namelist()
main = sys.argv[1] + "/" + sys.argv[2]
if main not in names:
    sys.exit("The downloaded zip does not contain " + main)
print("  it is the plugin: %d entries, %s present" % (len(names), main))
' "$PLUGIN_SLUG" "$PLUGIN_MAIN"
rm -f /tmp/wpci-feed.zip

echo
echo "Published $TAG. A shop running this plugin will be offered it within twelve hours,"
echo "or immediately on Dashboard → Updates → Check again."