Release 1.0.0: Builds ausschließlich für Release-Tags

.gitea/scripts/publish.py

@@ -9,7 +9,7 @@ import distribution as dist
 import release
 
 tag, evidence_revision = os.environ['TB_TAG'], os.environ['TB_EVIDENCE_REVISION']
-dist.require(re.fullmatch(r'v[0-9]+\.[0-9]+\.[0-9]+(?:-[A-Za-z0-9.-]+)?', tag), 'Ungültiger Tag')
+release.release_version(tag)
 dist.require(re.fullmatch('[0-9a-f]{40}', evidence_revision), 'Ungültige Nachweisrevision')
 revision = subprocess.check_output(['git', 'rev-parse', '--verify', tag + '^{commit}'], text=True).strip()
 api = release.Gitea()

.gitea/scripts/release.py

@@ -44,13 +44,19 @@ class Gitea:
             return response.read()
 
 
+def release_version(tag):
+    dist.require(re.fullmatch(r'v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)', tag),
+                 'Release-Tag muss vX.Y.Z entsprechen')
+    return tag[1:]
+
+
 def expected(version):
     return [n for t in dist.TARGETS for n in (dist.name(version, t), dist.name(version, t) + '.sha256')] + ['acceptance.json']
 
 
 def stage(api, directory, tag, revision):
-    version = tag.removeprefix('v')
-    dist.require(tag == 'v' + version and re.fullmatch('[0-9a-f]{40}', revision), 'Tag/Revision ungültig')
+    version = release_version(tag)
+    dist.require(re.fullmatch('[0-9a-f]{40}', revision), 'Tag/Revision ungültig')
     dist.require(api.request('GET', '/tags/' + quote(tag, safe=''))['commit']['sha'] == revision, 'Tag zeigt auf andere Revision')
     names = expected(version)
     for target in dist.TARGETS:
@@ -92,8 +98,7 @@ def verify_uploads(api, release_id, directory, names):
 
 
 def publish(api, directory, evidence, tag, revision):
-    version = tag.removeprefix('v')
-    dist.require(tag == 'v' + version, 'Versionstag erforderlich')
+    version = release_version(tag)
     dist.require(api.request('GET', '/tags/' + quote(tag, safe=''))['commit']['sha'] == revision, 'Tag zeigt auf andere Revision')
     dist.gate(directory, evidence, revision, version)
     release = api.request('GET', '/releases/tags/' + quote(tag, safe=''))
@@ -118,7 +123,7 @@ def main():
     else:
         args.packages.mkdir(parents=True)  # Nie lokale Kandidaten überschreiben.
         release = api.request('GET', '/releases/tags/' + quote(args.tag, safe=''))
-        names = expected(args.tag.removeprefix('v'))
+        names = expected(release_version(args.tag))
         dist.require(release['draft'], 'Nur bestehende Entwürfe freigeben')
         assets = release.get('assets', [])
         dist.require(len(assets) == len(names) and {a['name'] for a in assets} == set(names), 'Pflichtassets fehlen')

.gitea/scripts/test_distribution.py

@@ -18,7 +18,7 @@ class DistributionTests(unittest.TestCase):
         self.packages = self.root / 'packages'; self.packages.mkdir()
         self.evidence = self.root / 'evidence'; self.evidence.mkdir()
         self.revision = 'a' * 40
-        self.version = '0.1.0'
+        self.version = '1.0.0'
         self.manifests = {}
         for target in d.TARGETS:
             path = self.packages / d.name(self.version, target)
@@ -42,6 +42,13 @@ class DistributionTests(unittest.TestCase):
         self.mock_verify = patch.object(d, 'verify', side_effect=lambda archive, target, *args: self.manifests[target])
         self.mock_verify.start(); self.addCleanup(self.mock_verify.stop)
 
+    def test_release_tags_are_exact_numeric_versions(self):
+        for tag in ('v1.0.0', 'v0.0.0', 'v12.34.56'):
+            self.assertEqual(r.release_version(tag), tag[1:])
+        for tag in ('main', '1.0.0', 'v1.0', 'v1.0.0-rc1', 'v1.0.0+build',
+                    'v1.0.0/extra', 'v01.0.0', 'v1x.0.0', 'v1.0.0\n'):
+            with self.assertRaises(ValueError, msg=tag): r.release_version(tag)
+
     def gate(self):
         return d.gate(self.packages, self.evidence, self.revision, self.version)
 

.gitea/workflows/build.yml

@@ -1,15 +1,11 @@
-name: Vierziel-Build und Pflichtabnahme
+name: Release-Build und Pflichtabnahme
 on:
   push:
-    branches: ['main', 'ci/**']
-    tags: ['v*']
-  pull_request:
-  workflow_dispatch:
+    tags: ['v[0-9]*.[0-9]*.[0-9]*']
 permissions:
   contents: read
 jobs:
   checks:
-    if: gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository
     runs-on: linux-arm64
     container: ghcr.io/rust-cross/cargo-zigbuild@sha256:82af75c41958c2af2787e8bedd912da7678a9438937e223e9d83d006d747b38b
     timeout-minutes: 60
@@ -30,6 +26,18 @@ jobs:
       - uses: https://gitea.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           persist-credentials: false
+      - name: Release-Tag und Workspace-Version prüfen
+        env:
+          TB_TAG: ${{ gitea.ref_name }}
+          PYTHONPATH: .gitea/scripts
+        run: |
+          python3 - <<'PYTHON'
+          import os, tomllib
+          import distribution as dist
+          from release import release_version
+          version = tomllib.loads((dist.ROOT / 'Cargo.toml').read_text())['workspace']['package']['version']
+          dist.require(release_version(os.environ['TB_TAG']) == version, 'Tag und Workspace-Version weichen ab')
+          PYTHON
       - name: Gepinnte Werkzeuge
         run: sh .gitea/scripts/bootstrap.sh
       - name: Fixierten Fremdbestand bereitstellen
@@ -50,7 +58,7 @@ jobs:
           path: acceptance/
           if-no-files-found: error
   build:
-    if: gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository
+    needs: checks
     runs-on: linux-arm64
     timeout-minutes: 90
     strategy:
@@ -116,7 +124,7 @@ jobs:
         env:
           GITEA_SERVER_URL: ${{ gitea.server_url }}
           GITEA_REPOSITORY: ${{ gitea.repository }}
-          TB_RELEASE_TOKEN: ${{ secrets.TB_RELEASE_TOKEN }}
+          TB_RELEASE_TOKEN: ${{ secrets.TB_RELEASE_TOKEN || gitea.token }}
           TB_TAG: ${{ gitea.ref_name }}
           TB_REVISION: ${{ gitea.sha }}
         run: |

.gitea/workflows/publish.yml

@@ -3,7 +3,7 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Vorhandener Versionstag, z.B. v0.1.0'
+        description: 'Vorhandener Versionstag, z.B. v1.0.0'
         required: true
       evidence_commit:
         description: '40-stellige Origin-Revision mit release-evidence/<tag>/'
@@ -34,7 +34,7 @@ jobs:
         env:
           GITEA_SERVER_URL: ${{ gitea.server_url }}
           GITEA_REPOSITORY: ${{ gitea.repository }}
-          TB_RELEASE_TOKEN: ${{ secrets.TB_RELEASE_TOKEN }}
+          TB_RELEASE_TOKEN: ${{ secrets.TB_RELEASE_TOKEN || gitea.token }}
           TB_TAG: ${{ inputs.tag }}
           TB_EVIDENCE_REVISION: ${{ inputs.evidence_commit }}
         run: python3 .gitea/scripts/publish.py