import json import subprocess import itertools import textwrap from pathlib import Path import tempfile import hashlib import datetime from . import environment from .environment import RelengEnvironment from . import keys from . import docker from .version import VERSION, RELEASE_NAME, MAJOR $RAISE_SUBPROC_ERROR = True $XONSH_SHOW_TRACEBACK = True GCROOTS_DIR = Path('./release/gcroots') BUILT_GCROOTS_DIR = Path('./release/gcroots-build') DRVS_TXT = Path('./release/drvs.txt') ARTIFACTS = Path('./release/artifacts') MANUAL = Path('./release/manual') RELENG_MSG = "Release created with releng/create_release.xsh" BUILD_CORES = 16 MAX_JOBS = 2 # TODO RELEASE_SYSTEMS = ["x86_64-linux"] def setup_creds(env: RelengEnvironment): key = keys.get_ephemeral_key(env) $AWS_SECRET_ACCESS_KEY = key.secret_key $AWS_ACCESS_KEY_ID = key.id $AWS_DEFAULT_REGION = 'garage' $AWS_ENDPOINT_URL = environment.S3_ENDPOINT def git_preconditions(): # verify there is nothing in index ready to stage proc = !(git diff-index --quiet --cached HEAD --) assert proc.rtn == 0 # verify there is nothing *stageable* and tracked proc = !(git diff-files --quiet) assert proc.rtn == 0 def official_release_commit_tag(force_tag=False): print('[+] Setting officialRelease in flake.nix and tagging') prev_branch = $(git symbolic-ref --short HEAD).strip() git switch --detach sed -i 's/officialRelease = false/officialRelease = true/' flake.nix git add flake.nix message = f'release: {VERSION} "{RELEASE_NAME}"\n\nRelease produced with releng/create_release.xsh' git commit -m @(message) git tag @(['-f'] if force_tag else []) -a -m @(message) @(VERSION) return prev_branch def merge_to_release(prev_branch): git switch @(prev_branch) # Create a merge back into the release branch so that git tools understand # that the release branch contains the tag, without the release commit # actually influencing the tree. merge_msg = textwrap.dedent("""\ release: merge release {VERSION} back to mainline This merge commit returns to the previous state prior to the release but leaves the tag in the branch history. {RELENG_MSG} """).format(VERSION=VERSION, RELENG_MSG=RELENG_MSG) git merge -m @(merge_msg) -s ours @(VERSION) def realise(paths: list[str]): args = [ '--realise', '--max-jobs', MAX_JOBS, '--cores', BUILD_CORES, '--log-format', 'bar-with-logs', '--add-root', BUILT_GCROOTS_DIR ] nix-store @(args) @(paths) def eval_jobs(): nej_output = $(nix-eval-jobs --workers 4 --gc-roots-dir @(GCROOTS_DIR) --force-recurse --flake '.#release-jobs') return [x for x in (json.loads(s) for s in nej_output.strip().split('\n')) if x['system'] in RELEASE_SYSTEMS ] def upload_drv_paths_and_outputs(env: RelengEnvironment, paths: list[str]): proc = subprocess.Popen([ 'nix', 'copy', '-v', '--to', env.cache_store_uri(), '--stdin', ], stdin=subprocess.PIPE, env=__xonsh__.env.detype(), ) proc.stdin.write('\n'.join(itertools.chain(paths, x + '^*' for x in paths)).encode()) proc.stdin.close() rv = proc.wait() if rv != 0: raise subprocess.CalledProcessError(rv, proc.args) def make_manifest(eval_result): manifest = {vs['system']: vs['outputs']['out'] for vs in eval_result} def manifest_line(system, out): return f' {system} = "{out}";' manifest_text = textwrap.dedent("""\ # This file was generated by releng/create_release.xsh in Lix {{ {lines} }} """).format(lines='\n'.join(manifest_line(s, p) for (s, p) in manifest.items())) return manifest_text def make_git_tarball(to: Path): git archive --verbose --prefix=lix-@(VERSION)/ --format=tar.gz -o @(to) @(VERSION) def confirm(prompt, expected): resp = input(prompt) if resp != expected: raise ValueError('Unconfirmed') def sha256_file(f: Path): hasher = hashlib.sha256() with open(f, 'rb') as h: while data := h.read(1024 * 1024): hasher.update(data) return hasher.hexdigest() def make_artifacts_dir(eval_result, d: Path): d.mkdir(exist_ok=True, parents=True) version_dir = d / 'lix' / f'lix-{VERSION}' version_dir.mkdir(exist_ok=True, parents=True) tarballs_drv = next(p for p in eval_result if p['attr'] == 'tarballs') cp --no-preserve=mode -r @(tarballs_drv['outputs']['out'])/* @(version_dir) # FIXME: upgrade-nix searches for manifest.nix at root, which is rather annoying with open(d / 'manifest.nix', 'w') as h: h.write(make_manifest(eval_result)) with open(version_dir / 'manifest.nix', 'w') as h: h.write(make_manifest(eval_result)) print('[+] Make sources tarball') filename = f'lix-{VERSION}.tar.gz' git_tarball = version_dir / filename make_git_tarball(git_tarball) file_hash = sha256_file(git_tarball) print(f'Hash: {file_hash}') with open(version_dir / f'{filename}.sha256', 'w') as h: h.write(file_hash) def prepare_release_notes(): print('[+] Preparing release notes') RELEASE_NOTES_PATH = Path('doc/manual/rl-next') if RELEASE_NOTES_PATH.isdir(): notes_body = subprocess.check_output(['build-release-notes', '--change-authors', 'doc/manual/change-authors.yml', 'doc/manual/rl-next']).decode() else: # I guess nobody put release notes on their changes? print('[-] Warning: seemingly missing any release notes, not worrying about it') notes_body = '' rl_path = Path(f'doc/manual/src/release-notes/rl-{MAJOR}.md') existing_rl = '' try: with open(rl_path, 'r') as fh: existing_rl = fh.read() except FileNotFoundError: pass date = datetime.datetime.now().strftime('%Y-%m-%d') minor_header = f'# Lix {VERSION} ({date})' header = f'# Lix {MAJOR} "{RELEASE_NAME}"' if existing_rl.startswith(header): # strip the header off for minor releases lines = existing_rl.splitlines() header = lines[0] existing_rl = '\n'.join(lines[1:]) else: header += f' ({date})\n\n' header += '\n' + minor_header + '\n' notes = header notes += notes_body notes += "\n\n" notes += existing_rl # make pre-commit happy about one newline notes = notes.rstrip() notes += "\n" with open(rl_path, 'w') as fh: fh.write(notes) commit_msg = textwrap.dedent("""\ release: release notes for {VERSION} {RELENG_MSG} """).format(VERSION=VERSION, RELENG_MSG=RELENG_MSG) git add @(rl_path) git rm doc/manual/rl-next/*.md git commit -m @(commit_msg) def verify_are_on_tag(): current_tag = $(git describe --tag).strip() assert current_tag == VERSION def upload_artifacts(env: RelengEnvironment, noconfirm=False, no_check_git=False, force_push_tag=False): if not no_check_git: verify_are_on_tag() git_preconditions() assert 'AWS_SECRET_ACCESS_KEY' in __xonsh__.env tree @(ARTIFACTS) not noconfirm and confirm( f'Would you like to release {ARTIFACTS} as {VERSION}? Type "I want to release this" to confirm\n', 'I want to release this' ) docker_images = list((ARTIFACTS / f'lix/lix-{VERSION}').glob(f'lix-{VERSION}-docker-image-*.tar.gz')) assert docker_images print('[+] Upload to cache') with open(DRVS_TXT) as fh: upload_drv_paths_and_outputs(env, [x.strip() for x in fh.readlines() if x]) print('[+] Upload docker images') for target in env.docker_targets: docker.upload_docker_images(target, docker_images) print('[+] Upload to release bucket') aws s3 cp --recursive @(ARTIFACTS)/ @(env.releases_bucket)/ print('[+] Upload manual') upload_manual(env) print('[+] git push tag') git push @(['-f'] if force_push_tag else []) @(env.git_repo) f'{VERSION}:refs/tags/{VERSION}' def do_tag_merge(force_tag=False, no_check_git=False): if not no_check_git: git_preconditions() prev_branch = official_release_commit_tag(force_tag=force_tag) merge_to_release(prev_branch) git switch --detach @(VERSION) def build_manual(eval_result): manual = next(x['outputs']['doc'] for x in eval_result if x['attr'] == 'build.x86_64-linux') print('[+] Building manual') realise([manual]) cp --no-preserve=mode -vr @(manual)/share/doc/nix @(MANUAL) def upload_manual(env: RelengEnvironment): stable = json.loads($(nix eval --json '.#nix.officialRelease')) if stable: version = MAJOR else: version = 'nightly' print('[+] aws s3 sync manual') aws s3 sync @(MANUAL)/ @(env.docs_bucket)/manual/lix/@(version)/ if stable: aws s3 sync @(MANUAL)/ @(env.docs_bucket)/manual/lix/stable/ def build_artifacts(no_check_git=False): rm -rf release/ if not no_check_git: verify_are_on_tag() git_preconditions() print('[+] Evaluating') eval_result = eval_jobs() drv_paths = [x['drvPath'] for x in eval_result] print('[+] Building') realise(drv_paths) build_manual(eval_result) with open(DRVS_TXT, 'w') as fh: # don't bother putting the release tarballs themselves because they are duplicate and huge fh.write('\n'.join(x['drvPath'] for x in eval_result if x['attr'] != 'lix-release-tarballs')) make_artifacts_dir(eval_result, ARTIFACTS) print(f'[+] Done! See {ARTIFACTS}')