kristianwindandClaude Opus 5
d121005c0a
Under `set -o pipefail` a grep that MATCHES can make the pipeline exit 141: grep closes the pipe on its first hit, the producer takes SIGPIPE, and pipefail reports that as failure. A match becomes an error. Security found the shape; measured here before believing it, because the earlier pipefail lesson went the other way and I did not want to carry a second claim I had not seen: yes hittet | grep -q hittet under pipefail -> exit 141 printf hittet | grep -q hittet -> exit 0 So it needs the producer to outrun the 64 KB pipe buffer, which is why it is invisible until it is not. Two of this repo's sites can get there, and both were converted. Neither is reachable today — that is the reason to do it now rather than an argument against: ci/publish-release.sh checked the release feed for a download URL. The feed is 3.5 KB in the new repo and 13.5 KB in the old one across seven releases, so about 1.9 KB each: it reaches 64 KB around release 34. That failure would land in the publishing path and say the feed has no zip attached while it plainly has one, and nothing about the commit that tripped it would have anything to do with it. A bug on a timer is worse than a bug. ci/static.sh checked whether each plugin-relative include is in the shipped list, once per include. Same growth, plus a fork per iteration. Both now use `case`, which has no pipe, no fork and no producer to signal, and cannot be reversed by a shell option. The static.sh one wraps both sides in newlines to keep the exact-line match `grep -qx` gave. Proven both ways: thirteen includes checked on a clean tree, and excluding one from the zip still names it. The remaining `| grep -q` sites were measured rather than assumed safe: zip_entries is 1.3 KB, the shipped list 478 bytes, static.sh's own output 1.6 KB, and site-test.sh and update-smoke.sh grep a single line of wp-cli output. Left alone; converting those would be churn against producers that cannot plausibly reach the buffer. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
249 lines
10 KiB
Bash
Executable File
249 lines
10 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Publish a release with the plugin zip attached, on whichever forge is running
|
|
# this, and then verify the result the way a shop will actually see it.
|
|
#
|
|
# Needs: TAG, GITHUB_REPOSITORY, GITHUB_API_URL, GITHUB_SERVER_URL, GH_TOKEN.
|
|
#
|
|
# The verification at the end is the part worth keeping. The update feed is
|
|
# read anonymously by every shop, and the two ways it breaks — a private
|
|
# repository and a release with no zip attached — both leave a release page
|
|
# that looks perfectly fine to whoever is logged in. Nobody would notice for
|
|
# months; what they would notice is that updates stopped arriving.
|
|
set -euo pipefail
|
|
|
|
cd "$(dirname "$0")/.."
|
|
. ci/lib.sh
|
|
ci_load_conf
|
|
|
|
: "${TAG:?TAG is not set}"
|
|
: "${GH_TOKEN:?GH_TOKEN is not set}"
|
|
: "${GITHUB_REPOSITORY:?}"
|
|
: "${GITHUB_API_URL:?}"
|
|
|
|
zip="build/$PLUGIN_SLUG.zip"
|
|
[ -f "$zip" ] || { echo "$zip does not exist — run ci/build-zip.sh first." >&2; exit 1; }
|
|
|
|
# RELEASE_REPO wins over the repository running the workflow: releases go to a
|
|
# separate public dist repo, so the source can be private while a shop still
|
|
# fetches its update anonymously. Falls back to the running repo, which is what
|
|
# a plugin without a split still wants.
|
|
target="${RELEASE_REPO:-$GITHUB_REPOSITORY}"
|
|
owner="${target%%/*}"
|
|
repo="${target#*/}"
|
|
echo "Publishing $TAG to $owner/$repo" >&2
|
|
|
|
# The tag message is the announcement, so it has to survive the checkout.
|
|
#
|
|
# actions/checkout fetches every tag correctly and then overwrites this one ref
|
|
# with the commit SHA — `fetch-depth: 0` does not save you. The annotated tag
|
|
# becomes a lightweight one pointing at the commit, and reading its message
|
|
# returns the COMMIT message instead: on a merge commit, "Merge pull request
|
|
# #12 from ...". Nothing fails. The release is simply published with the wrong
|
|
# text, and only the page shows it.
|
|
git fetch --force origin "refs/tags/$TAG:refs/tags/$TAG"
|
|
|
|
[ "$(git cat-file -t "$TAG")" = tag ] || {
|
|
echo "$TAG is not an annotated tag. Its message is what gets published, so create it with 'git tag -a'." >&2
|
|
exit 1
|
|
}
|
|
|
|
notes=$(git tag -l --format='%(contents)' "$TAG")
|
|
first_line=$(printf '%s\n' "$notes" | head -1)
|
|
|
|
case "$first_line" in
|
|
'Merge pull request'*|'Merge branch'*|'')
|
|
echo "The release notes read '$first_line'." >&2
|
|
echo "That is a commit message, not the tag message — the annotated tag did not survive the checkout." >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
ci_step "release notes"
|
|
printf '%s\n' "$notes" | sed 's/^/ /'
|
|
|
|
# The updater reads this line out of the release body, so wp-admin can show
|
|
# what this version was tested against rather than what the last one claimed.
|
|
readme=
|
|
for f in readme.txt README.txt; do [ -f "$f" ] && readme=$f && break; done
|
|
tested_wp=$([ -n "$readme" ] && sed -n -E 's/^Tested up to:[[:space:]]*([^[:space:]]+).*/\1/p' "$readme" | head -1)
|
|
tested_wc=$(ci_plugin_header 'WC tested up to')
|
|
|
|
body=$(printf '%s\n\n---\n\nTested up to: %s\nWC tested up to: %s\n' \
|
|
"$notes" "${tested_wp:-unknown}" "${tested_wc:-unknown}")
|
|
|
|
# Read one top-level field out of a JSON response.
|
|
#
|
|
# Not sed. A greedy `.*"id":([0-9]+)` matches the LAST id in the payload, and a
|
|
# Gitea release carries both an embedded "author" object and, once anything is
|
|
# attached, an "assets" array — each with an id of its own. Measured on this
|
|
# repo: the four published releases have ids 416/417/419/421, and the greedy
|
|
# pattern returns 1/2/3/4, which are the asset ids.
|
|
#
|
|
# Those four releases were nonetheless published correctly, and only by luck:
|
|
# the author id on this instance is **-1**, and the minus sign stops `[0-9]+`
|
|
# from matching, so on a create response — which has no assets yet — the last
|
|
# numeric id happened to be the release's. A real author id, or a re-run
|
|
# against a release that already has its zip, and it picks the wrong number.
|
|
#
|
|
# Found by the session porting this into subscriptions, where it picked the
|
|
# author id and the upload 404'd. python3 is already a required tool here.
|
|
json_field() { # field (JSON on stdin)
|
|
python3 -c '
|
|
import json, sys
|
|
try:
|
|
data = json.load( sys.stdin )
|
|
except Exception:
|
|
sys.exit( 0 )
|
|
value = data.get( sys.argv[1] )
|
|
if value is not None:
|
|
print( value )
|
|
' "$1"
|
|
}
|
|
|
|
api() { # method path [data]
|
|
curl -fsS -X "$1" \
|
|
-H "Authorization: token $GH_TOKEN" \
|
|
-H 'Accept: application/json' \
|
|
-H 'Content-Type: application/json' \
|
|
${3:+-d "$3"} \
|
|
"$2"
|
|
}
|
|
|
|
if [ "${GITHUB_SERVER_URL:-}" = 'https://github.com' ]; then
|
|
ci_step "publishing to GitHub"
|
|
gh release create "$TAG" "$zip" --title "$TAG" --notes "$body" 2>/dev/null \
|
|
|| gh release upload "$TAG" "$zip" --clobber
|
|
release_api="$GITHUB_API_URL/repos/$owner/$repo/releases/tags/$TAG"
|
|
else
|
|
ci_step "publishing to $GITHUB_SERVER_URL"
|
|
payload=$(printf '%s' "$body" | python3 -c '
|
|
import json, sys, os
|
|
print(json.dumps({
|
|
"tag_name": os.environ["TAG"],
|
|
"name": os.environ["TAG"],
|
|
"body": sys.stdin.read(),
|
|
"draft": False,
|
|
"prerelease": False,
|
|
}))')
|
|
|
|
# A re-run of a release must not fail on "already exists".
|
|
existing=$(curl -fsS -H "Authorization: token $GH_TOKEN" \
|
|
"$GITHUB_API_URL/repos/$owner/$repo/releases/tags/$TAG" 2>/dev/null || true)
|
|
id=$(printf '%s' "$existing" | json_field id)
|
|
|
|
if [ -z "$id" ]; then
|
|
created=$(api POST "$GITHUB_API_URL/repos/$owner/$repo/releases" "$payload")
|
|
id=$(printf '%s' "$created" | json_field id)
|
|
fi
|
|
[ -n "$id" ] || { echo "Could not create or find the release for $TAG." >&2; exit 1; }
|
|
echo " release id $id"
|
|
|
|
# Before uploading anything to it, confirm the id really is this tag's. The
|
|
# failure being guarded against is not a 404 — that is loud — but an id that
|
|
# exists and belongs to something else, which would attach this plugin's zip
|
|
# to an unrelated release with every check still green.
|
|
release=$(curl -fsS -H "Authorization: token $GH_TOKEN" \
|
|
"$GITHUB_API_URL/repos/$owner/$repo/releases/$id")
|
|
actual=$(printf '%s' "$release" | json_field tag_name)
|
|
if [ "$actual" != "$TAG" ]; then
|
|
echo "Release id $id is tagged '$actual', not '$TAG'. Refusing to upload the zip to it." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# A re-run must not fail on the half that already succeeded: the upload
|
|
# rejects a duplicate asset name.
|
|
if printf '%s' "$release" | python3 -c '
|
|
import json, sys
|
|
data = json.load( sys.stdin )
|
|
sys.exit( 0 if any( a.get( "name" ) == sys.argv[1] for a in data.get( "assets", [] ) ) else 1 )
|
|
' "$PLUGIN_SLUG.zip"; then
|
|
echo " $PLUGIN_SLUG.zip is already attached — leaving it alone"
|
|
else
|
|
curl -fsS -X POST \
|
|
-H "Authorization: token $GH_TOKEN" \
|
|
-F "attachment=@$zip" \
|
|
"$GITHUB_API_URL/repos/$owner/$repo/releases/$id/assets?name=$PLUGIN_SLUG.zip" >/dev/null
|
|
echo " attached $PLUGIN_SLUG.zip"
|
|
fi
|
|
|
|
release_api="$GITHUB_API_URL/repos/$owner/$repo/releases/latest"
|
|
fi
|
|
|
|
ci_step "the feed, read the way a shop reads it"
|
|
|
|
# Only the forge named in "Update URI" actually serves shops. This script runs
|
|
# on both, and the other one is a mirror — requiring a mirror to be anonymously
|
|
# readable would fail every release for a repository that is private on purpose.
|
|
# (It did, on the first v1.4.0 run: GitHub is private and is not the feed.)
|
|
update_uri=$(sed -n -E 's/^[[:space:]]*\*[[:space:]]*Update URI:[[:space:]]*(.*)/\1/p' "$PLUGIN_MAIN" | head -1 | tr -d '[:space:]')
|
|
feed_host=$(printf '%s' "$update_uri" | sed -E 's|^[a-z]+://([^/]+).*|\1|')
|
|
this_host=$(printf '%s' "${GITHUB_SERVER_URL:-}" | sed -E 's|^[a-z]+://([^/]+).*|\1|')
|
|
|
|
if [ -z "$update_uri" ]; then
|
|
echo "The plugin header has no Update URI, so there is no feed to check."
|
|
exit 0
|
|
fi
|
|
|
|
if [ "$feed_host" != "$this_host" ]; then
|
|
echo " $this_host is a mirror; shops read $feed_host. Nothing to verify here."
|
|
exit 0
|
|
fi
|
|
|
|
feed=$(curl -fsS --max-time 30 "$release_api" 2>/dev/null || true)
|
|
|
|
if [ -z "$feed" ]; then
|
|
echo
|
|
ci_fail "$release_api cannot be read without credentials, so no shop will ever be offered this update."
|
|
echo "Either the repository is still private, or the release was not created."
|
|
echo "For Gitea: Settings → make the repository public. The update feed is a public read by design;"
|
|
echo "that is the whole mechanism, and there is nothing secret in a GPL plugin zip anyway."
|
|
exit 1
|
|
fi
|
|
|
|
# `case`, not `printf … | grep -q`. Under `set -o pipefail` a grep that
|
|
# MATCHES can make the pipeline exit 141: grep closes the pipe on the first
|
|
# hit and the producer takes SIGPIPE, which pipefail reports as failure. So a
|
|
# match becomes an error, in the publishing path, with a message saying the
|
|
# feed has no download URL when it plainly does.
|
|
#
|
|
# Not reachable today — the feed is 3.5 KB and the pipe buffer is 64 KB — but
|
|
# it grows about 1.9 KB per release, so it arrives around release 34. A bug on
|
|
# a timer is worse than a bug, because nothing about the commit that trips it
|
|
# will have anything to do with it. `case` has no pipe, no fork and no
|
|
# producer to signal.
|
|
case "$feed" in
|
|
*'"browser_download_url"'*) ;;
|
|
*)
|
|
echo
|
|
ci_fail "The release is readable, but it has no zip attached. WordPress would be offered an update it cannot download."
|
|
exit 1
|
|
;;
|
|
esac
|
|
# Checked at the address the PLUGIN builds, not the one the API reports.
|
|
#
|
|
# A forge fills browser_download_url from its own configured root URL, which is
|
|
# not necessarily the address the outside world reaches it on: gitea.nolimit.dk
|
|
# returns http://57.129.89.117:25001/... there, a plain-HTTP raw IP that
|
|
# bypasses the Cloudflare tunnel. Verifying that address would be verifying a
|
|
# URL no shop ever uses — a green check on the wrong thing, which is worse than
|
|
# no check.
|
|
package="$update_uri/releases/download/$TAG/$PLUGIN_SLUG.zip"
|
|
code=$(curl -s -o /tmp/wpci-feed.zip -w '%{http_code}' -L --max-time 120 "$package")
|
|
echo " $package -> HTTP $code"
|
|
[ "$code" = 200 ] || { ci_fail "The package URL the plugin will use is not anonymously downloadable."; exit 1; }
|
|
|
|
# And it has to be the plugin, not an error page with a 200 on it.
|
|
python3 -c '
|
|
import sys, zipfile
|
|
names = zipfile.ZipFile("/tmp/wpci-feed.zip").namelist()
|
|
main = sys.argv[1] + "/" + sys.argv[2]
|
|
if main not in names:
|
|
sys.exit("The downloaded zip does not contain " + main)
|
|
print(" it is the plugin: %d entries, %s present" % (len(names), main))
|
|
' "$PLUGIN_SLUG" "$PLUGIN_MAIN"
|
|
rm -f /tmp/wpci-feed.zip
|
|
|
|
echo
|
|
echo "Published $TAG. A shop running this plugin will be offered it within twelve hours,"
|
|
echo "or immediately on Dashboard → Updates → Check again."
|