Skip to content

Commit 01ac2f7

Browse files
dschodscho
committed
Merge branch 'embargoed-branches'
This topic branch introduces a GitHub workflow that initializes the branches in the relevant repositories which are needed to build embargoed artifacts for a security release of Git for Windows. Signed-off-by: Johannes Schindelin <[email protected]>
2 parents 905a18b + dd1874e commit 01ac2f7

File tree

3 files changed

+182
-1
lines changed

3 files changed

+182
-1
lines changed

‎.github/workflows/prepare-embargoed-branches.yml

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: prepare-embargoed-branches
2+
run-name: Prepare branches for embargoed ${{ inputs.mingit-only && 'Min' || '' }}Git ${{ inputs.version }}
3+
4+
on:
5+
workflow_dispatch:
6+
inputs:
7+
version:
8+
description: 'The Git version for which to prepare the branches'
9+
required: true
10+
mingit-only:
11+
description: 'Only prepare the MinGit branches'
12+
default: false
13+
type: boolean
14+
15+
jobs:
16+
prepare-embargoed-branches:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: sanity check
20+
if: ${{ github.repository_owner == 'git-for-windows' }}
21+
run: echo "This action is not meant to be run on the Git for Windows repository" >&2 && exit 1
22+
- uses: actions/checkout@v4
23+
- name: identify actor
24+
id: actor
25+
uses: actions/github-script@v7
26+
with:
27+
script: |
28+
const githubApiRequest = require('./github-api-request')
29+
const answer = await githubApiRequest(
30+
console,
31+
'${{ secrets.GITHUB_TOKEN }}',
32+
'GET',
33+
'/users/${{ github.triggering_actor }}'
34+
)
35+
core.setOutput('name', answer.name)
36+
core.setOutput('email', answer.email || '${{ github.triggering_actor }}@users.noreply.github.com')
37+
- name: configure
38+
run: |
39+
USER_NAME="${{ steps.actor.outputs.name }}" &&
40+
USER_EMAIL="${{ steps.actor.outputs.email }}" &&
41+
git config --global user.name "$USER_NAME" &&
42+
git config --global user.email "$USER_EMAIL" &&
43+
git config --global url.https://github.com/${{ github.repository_owner }}.insteadOf \
44+
https://github.com/embargoed-git-for-windows-builds &&
45+
git config --global credential.helper '' &&
46+
git config --global --add credential.helper cache
47+
- name: configure push token
48+
uses: actions/github-script@v7
49+
with:
50+
script: |
51+
const { callGit, getPushAuthorizationHeader } = require('./repository-updates.js')
52+
for (const repo of ['build-extra', 'git', 'git-sdk-32', 'git-sdk-64', 'git-sdk-arm64', 'MINGW-packages']) {
53+
const header = await getPushAuthorizationHeader(
54+
console,
55+
core.setSecret,
56+
${{ secrets.GH_APP_ID }},
57+
${{ toJSON(secrets.GH_APP_PRIVATE_KEY) }},
58+
context.repo.owner,
59+
repo
60+
)
61+
console.log(callGit(['config', '--global', `http.https://github.com/${context.repo.owner}/${repo}.extraHeader`, header]))
62+
}
63+
- name: Prepare embargoed branches
64+
run: sh -x ./prepare-embargoed-branches.sh ${{ inputs.mingit-only && '--mingit ' || ''}}"${{ inputs.version }}"

‎prepare-embargoed-branches.sh

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
#!/bin/sh
2+
3+
die () {
4+
echo "$*" >&2
5+
exit 1
6+
}
7+
8+
dry_run=
9+
mingit=
10+
while case "$1" in
11+
--dry-run|-n) dry_run=1;;
12+
--mingit) mingit=1;;
13+
-*) die "Unknown option: $1";;
14+
*) break;;
15+
esac; do shift; done
16+
17+
test $# = 1 ||
18+
die "Usage: $0 [--dry-run] [--mingit] <version> # e.g. 2.39.1"
19+
20+
version=${1#v}
21+
if test -z "$mingit"
22+
then
23+
case "$version" in
24+
*.*.*.windows.*)
25+
# major.minor.patch.windows.extra
26+
previous_version_prefix=${version%.windows.*}
27+
version="${version%.windows.*}.${version##*.windows.}"
28+
;;
29+
*.*.*\(*)
30+
# major.minor.patch(extra)
31+
previous_version_prefix=${version%(*}
32+
version="${version%(*}.${version##*(}"
33+
version=${version%)}
34+
;;
35+
*[^0-9.]*|*..*|.*|*.) die "Invalid version: '$version'";;
36+
*.*.*.*)
37+
# major.minor.patch.extra
38+
v0="${version#*.*.*.}"
39+
previous_version_prefix=${version%.$v0}
40+
;;
41+
*.*.*) previous_version_prefix=${version%.*}.$((${version##*.}-1));; # major.minor.patch
42+
*) die "Invalid version: '$version'";;
43+
esac
44+
branch_name=git-$version
45+
else
46+
previous_version_prefix="$(expr "$version" : '\([0-9]\+\.[0-9]\+\)\.\{0,1\}[0-9]*$')"
47+
test -n "$previous_version_prefix" || die "Invalid version: '$version'"
48+
branch_name=mingit-$previous_version_prefix.x-releases
49+
fi
50+
grep_version_regex="$(echo "$previous_version_prefix" | sed 's/\./\\\\&/g')"
51+
52+
handle_repo () {
53+
name="$1"
54+
path="$2"
55+
args="$3"
56+
57+
echo "### Handling $name ###" &&
58+
59+
if test -e "$path/.git"
60+
then
61+
git_dir="$path/.git"
62+
main_refspec="refs/remotes/origin/main:refs/heads/main"
63+
else
64+
# To allow for running this script on Linux/macOS, fall back to cloning to pwd
65+
git_dir=${path##*/}.git &&
66+
if test ! -d "$git_dir"
67+
then
68+
# We only need a partial clone
69+
git clone --bare --filter=blob:none \
70+
https://github.com/git-for-windows/$name "$git_dir"
71+
fi
72+
main_refspec="refs/heads/main:refs/heads/main"
73+
fi &&
74+
75+
# ensure that the `embargoed-git-for-windows-builds` remote is set
76+
remote_url=https://github.com/embargoed-git-for-windows-builds/$name &&
77+
case "$(git --git-dir "$git_dir" remote show -n embargoed-git-for-windows-builds)" in
78+
*"Fetch URL: $remote_url"*"Push URL: $remote_url"*) ;; # okay
79+
*) git --git-dir "$git_dir" remote add embargoed-git-for-windows-builds $remote_url;;
80+
esac &&
81+
82+
# if `embargoed-git-for-windows-builds` already has the branch, everything's fine already
83+
revision=$(git --git-dir "$git_dir" ls-remote embargoed-git-for-windows-builds refs/heads/$branch_name | cut -f 1) &&
84+
if test -n "$revision"
85+
then
86+
echo "$name already has $branch_name @$revision"
87+
else
88+
git --git-dir "$git_dir" fetch origin main &&
89+
revision="$(eval git --git-dir "\"$git_dir\"" rev-list -1 FETCH_HEAD $args)" &&
90+
if test -z "$revision"
91+
then
92+
die "No matching revision for $args in $name"
93+
fi &&
94+
echo "Creating $branch_name in $name @$revision" &&
95+
push_ref_spec="$revision:refs/heads/$branch_name $main_refspec" &&
96+
if test -n "$dry_run"
97+
then
98+
git --git-dir "$git_dir" show -s "$revision" &&
99+
echo "Would call 'git push embargoed-git-for-windows-builds $push_ref_spec'"
100+
else
101+
echo "git push embargoed-git-for-windows-builds $push_ref_spec" &&
102+
git --git-dir "$git_dir" push embargoed-git-for-windows-builds $push_ref_spec
103+
fi
104+
fi
105+
}
106+
107+
handle_repo git-sdk-32 /c/git-sdk-32 \
108+
"\"--grep=mingw-w64-i686-git \".*\" -> $grep_version_regex\" -- cmd/git.exe" &&
109+
handle_repo git-sdk-64 /c/git-sdk-64 \
110+
"\"--grep=mingw-w64-x86_64-git \".*\" -> $grep_version_regex\" -- cmd/git.exe" &&
111+
handle_repo git-sdk-arm64 /c/git-sdk-arm64 \
112+
"\"--grep=mingw-w64-clang-aarch64-git \".*\" -> $grep_version_regex\" -- cmd/git.exe" &&
113+
handle_repo build-extra /usr/src/build-extra \
114+
"-- versions/package-versions-$previous_version_prefix\\*-MinGit.txt" &&
115+
handle_repo MINGW-packages /usr/src/MINGW-packages \
116+
"\"--grep=mingw-w64-git: new version .v$grep_version_regex\" -- mingw-w64-git/PKGBUILD"

‎repository-updates.js

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -158,5 +158,6 @@ module.exports = {
158158
callGit,
159159
getWorkflowRunArtifact,
160160
pushRepositoryUpdate,
161-
pushGitBranch
161+
pushGitBranch,
162+
getPushAuthorizationHeader
162163
}

0 commit comments

Comments
 (0)