fix(release): verify release-please product tags (#83)

Author: f0rr0

.github/workflows/release.yml

@@ -492,6 +492,12 @@ jobs:
           manifest-file: .release-please-manifest.json
           skip-github-pull-request: true
 
+      - name: Verify release-please product tags
+        if: ${{ inputs.operation == 'publish' && steps.release_plan.outputs.has_release_changes == 'true' }}
+        env:
+          PRODUCTS_JSON: ${{ steps.release_plan.outputs.products_json }}
+        run: tools/dev/bun.sh tools/release/verify_product_tags.mjs --products-json "${PRODUCTS_JSON}" --target "$RELEASE_HEAD_SHA"
+
       - name: Remove release-please target branch
         if: ${{ always() && inputs.operation == 'publish' && steps.release_head.outputs.uses_temporary_target_branch == 'true' }}
         continue-on-error: true

release-please-config.json

@@ -3,7 +3,7 @@
   "include-v-in-tag": true,
   "tag-separator": "-",
   "pull-request-title-pattern": "chore${scope}: release${component} ${version}",
-  "group-pull-request-title-pattern": "chore(release): prepare product releases",
+  "group-pull-request-title-pattern": "chore(release): prepare ${branch} releases",
   "initial-version": "0.1.0",
   "bump-minor-pre-major": true,
   "bump-patch-for-minor-pre-major": true,

tools/policy/check-release-policy.mjs

@@ -1174,6 +1174,7 @@ function checkReleaseWorkflowPolicy() {
       "Validate selected release product dry-runs",
       "Create release-please target branch",
       "Create release-please GitHub releases",
+      "Verify release-please product tags",
       "Remove release-please target branch",
       "Publish liboliphaunt GitHub release assets",
     ],
@@ -1192,6 +1193,8 @@ function checkReleaseWorkflowPolicy() {
     "--artifact liboliphaunt-native-release-assets",
     '--artifact "$artifact"',
     "PRODUCTS_JSON: ${{ steps.release_plan.outputs.products_json }}",
+    "Verify release-please product tags",
+    'tools/dev/bun.sh tools/release/verify_product_tags.mjs --products-json "${PRODUCTS_JSON}" --target "$RELEASE_HEAD_SHA"',
     'tools/dev/bun.sh tools/release/release_graph_query.mjs ci-products --family sdk-package --products-json "$PRODUCTS_JSON" --format lines',
     'tools/dev/bun.sh tools/release/release_graph_query.mjs ci-artifact-names --product "$product" --family sdk-package --format lines',
     'tools/dev/bun.sh tools/release/release_graph_query.mjs ci-artifact-names --product "$product" --kind "$kind" --family release-assets --format lines',
@@ -1401,6 +1404,7 @@ function checkReleaseWorkflowPolicy() {
   const guardedPublishSteps = new Set([
     "Create release-please target branch",
     "Create release-please GitHub releases",
+    "Verify release-please product tags",
     "Remove release-please target branch",
     "Publish liboliphaunt GitHub release assets",
     "Publish selected extension GitHub release assets",

tools/release/check_release_please_config.mjs

@@ -7,6 +7,8 @@ const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '.
 const configPath = path.join(root, 'release-please-config.json');
 const manifestPath = path.join(root, '.release-please-manifest.json');
 const decoder = new TextDecoder();
+const RELEASE_PR_TITLE_PATTERN = 'chore${scope}: release${component} ${version}';
+const GROUP_RELEASE_PR_TITLE_PATTERN = 'chore(release): prepare ${branch} releases';
 
 function fail(message) {
   console.error(`check_release_please_config.mjs: ${message}`);
@@ -259,6 +261,39 @@ function validatePlugins(plugins, pathsById) {
     );
   }
 }
+
+function releasePleaseTitlePatternRegex(pattern) {
+  if (typeof pattern !== 'string' || !pattern) {
+    fail(`release-please title pattern must be a non-empty string: ${JSON.stringify(pattern)}`);
+  }
+  return new RegExp(
+    `^${pattern
+      .replace('[', '\\[')
+      .replace(']', '\\]')
+      .replace('(', '\\(')
+      .replace(')', '\\)')
+      .replace('${scope}', '(\\((?<branch>[\\w-./]+)\\))?')
+      .replace('${component}', ' ?(?<component>@?[\\w-./]*)?')
+      .replace('${version}', 'v?(?<version>[0-9].*)')
+      .replace('${branch}', '(?<branch>[\\w-./]+)?')}$`,
+  );
+}
+
+function assertParseableReleasePleaseTitle(pattern, title, context) {
+  const match = title.match(releasePleaseTitlePatternRegex(pattern));
+  if (!match?.groups) {
+    fail(`${context} must be parseable by release-please: ${JSON.stringify(title)}`);
+  }
+}
+
+function renderReleasePleaseTitle(pattern, { targetBranch }) {
+  return pattern
+    .replace('${scope}', targetBranch ? `(${targetBranch})` : '')
+    .replace('${component}', '')
+    .replace('${version}', '')
+    .replace('${branch}', targetBranch ?? '')
+    .trim();
+}
 if (actualPaths.size !== expectedPaths.size || sortedDifference(expectedPaths, actualPaths).length > 0) {
   fail(
     `release-please packages must match release products:\nmissing=${JSON.stringify(sortedDifference(expectedPaths, actualPaths))}\nextra=${JSON.stringify(sortedDifference(actualPaths, expectedPaths))}`,
@@ -276,9 +311,26 @@ if (config['tag-separator'] !== '-') {
 if (config['include-v-in-tag'] !== true) {
   fail('release-please must include v in tags');
 }
-if (config['pull-request-title-pattern'] !== 'chore${scope}: release${component} ${version}') {
+if (config['pull-request-title-pattern'] !== RELEASE_PR_TITLE_PATTERN) {
   fail("release-please pull-request-title-pattern must keep release-please's parseable default shape");
 }
+if (config['group-pull-request-title-pattern'] !== GROUP_RELEASE_PR_TITLE_PATTERN) {
+  fail('release-please group-pull-request-title-pattern must keep grouped release PRs parseable');
+}
+const generatedGroupTitle = renderReleasePleaseTitle(GROUP_RELEASE_PR_TITLE_PATTERN, { targetBranch: 'main' });
+if (generatedGroupTitle !== 'chore(release): prepare main releases') {
+  fail(`release-please grouped release PR title rendered unexpectedly: ${JSON.stringify(generatedGroupTitle)}`);
+}
+assertParseableReleasePleaseTitle(
+  GROUP_RELEASE_PR_TITLE_PATTERN,
+  generatedGroupTitle,
+  'generated grouped release PR title',
+);
+assertParseableReleasePleaseTitle(
+  GROUP_RELEASE_PR_TITLE_PATTERN,
+  'chore(release): prepare product releases',
+  'already-merged grouped release PR #80 title',
+);
 if (config['initial-version'] !== '0.1.0') {
   fail('release-please initial-version must bootstrap the first generated release PR to 0.1.0');
 }

tools/release/verify_product_tag.mjs

@@ -48,6 +48,7 @@ function git(args, { check = true } = {}) {
   return {
     exitCode: result.exitCode,
     stdout: decoder.decode(result.stdout).trim(),
+    stderr: decoder.decode(result.stderr).trim(),
   };
 }
 
@@ -62,6 +63,22 @@ function tagCommit(tag) {
   return result.exitCode === 0 ? result.stdout : null;
 }
 
+function refreshTagFromOrigin(tag) {
+  const remote = git(['remote', 'get-url', 'origin'], { check: false });
+  if (remote.exitCode !== 0) {
+    return;
+  }
+  const result = git(['fetch', '--force', '--no-tags', 'origin', `refs/tags/${tag}:refs/tags/${tag}`], {
+    check: false,
+  });
+  if (result.exitCode !== 0 && tagCommit(tag) === null) {
+    fail(`${tag} does not exist on origin. Run release-please before release publish steps.`);
+  }
+  if (result.exitCode !== 0) {
+    fail(`could not refresh ${tag} from origin before verification${result.stderr ? `: ${result.stderr}` : ''}`);
+  }
+}
+
 async function releasePleaseProduct(product) {
   const config = JSON.parse(await fs.readFile(path.join(root, 'release-please-config.json'), 'utf8'));
   if (config['include-v-in-tag'] !== true) {
@@ -144,9 +161,10 @@ const { product, target } = parseArgs(Bun.argv.slice(2));
 const version = await currentProductVersion(product);
 const tag = `${product}-v${version}`;
 const targetCommit = commitForRef(target);
+refreshTagFromOrigin(tag);
 const existing = tagCommit(tag);
 if (existing === null) {
-  fail(`${tag} does not exist. Run release-please before package-native publish steps.`);
+  fail(`${tag} does not exist. Run release-please before release publish steps.`);
 }
 if (existing !== targetCommit) {
   fail(`${tag} points at ${existing}, not release commit ${targetCommit}`);

tools/release/verify_product_tags.mjs

@@ -0,0 +1,66 @@
+#!/usr/bin/env bun
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const decoder = new TextDecoder();
+
+function fail(message) {
+  console.error(`verify_product_tags.mjs: ${message}`);
+  process.exit(1);
+}
+
+function parseArgs(argv) {
+  let productsJson = '';
+  let target = process.env.GITHUB_SHA || 'HEAD';
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === '--products-json') {
+      productsJson = argv[index + 1] ?? '';
+      index += 1;
+      continue;
+    }
+    if (arg === '--target') {
+      target = argv[index + 1] ?? '';
+      index += 1;
+      continue;
+    }
+    fail(`unknown argument: ${arg}`);
+  }
+  if (!productsJson || !target) {
+    fail('usage: tools/release/verify_product_tags.mjs --products-json <json-array> [--target <commitish>]');
+  }
+  return { productsJson, target };
+}
+
+function parseProducts(productsJson) {
+  let products;
+  try {
+    products = JSON.parse(productsJson);
+  } catch (error) {
+    fail(`--products-json must be valid JSON: ${error.message}`);
+  }
+  if (!Array.isArray(products) || products.length === 0 || !products.every((product) => typeof product === 'string' && product)) {
+    fail('--products-json must be a non-empty JSON string array');
+  }
+  return [...new Set(products)].sort((left, right) => left.localeCompare(right));
+}
+
+function runVerifyProductTag(product, target) {
+  const result = Bun.spawnSync(['tools/dev/bun.sh', 'tools/release/verify_product_tag.mjs', product, '--target', target], {
+    cwd: root,
+    stdout: 'inherit',
+    stderr: 'pipe',
+  });
+  if (result.exitCode !== 0) {
+    const stderr = decoder.decode(result.stderr).trim();
+    fail(`${product} release tag is not ready${stderr ? `: ${stderr}` : ''}`);
+  }
+}
+
+const { productsJson, target } = parseArgs(Bun.argv.slice(2));
+const products = parseProducts(productsJson);
+for (const product of products) {
+  runVerifyProductTag(product, target);
+}
+console.log(`verified ${products.length} release product tag(s) at ${target}`);