Release 1.0.0: Builds ausschließlich für Release-Tags

.gitea/scripts/publish.py

@@ -9,7 +9,7 @@ import distribution as dist
 import release
 
 tag, evidence_revision = os.environ['TB_TAG'], os.environ['TB_EVIDENCE_REVISION']
-dist.require(re.fullmatch(r'v[0-9]+\.[0-9]+\.[0-9]+(?:-[A-Za-z0-9.-]+)?', tag), 'Ungültiger Tag')
+release.release_version(tag)
 dist.require(re.fullmatch('[0-9a-f]{40}', evidence_revision), 'Ungültige Nachweisrevision')
 revision = subprocess.check_output(['git', 'rev-parse', '--verify', tag + '^{commit}'], text=True).strip()
 api = release.Gitea()

.gitea/scripts/release.py

@@ -44,13 +44,19 @@ class Gitea:
             return response.read()
 
 
+def release_version(tag):
+    dist.require(re.fullmatch(r'v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)', tag),
+                 'Release-Tag muss vX.Y.Z entsprechen')
+    return tag[1:]
+
+
 def expected(version):
     return [n for t in dist.TARGETS for n in (dist.name(version, t), dist.name(version, t) + '.sha256')] + ['acceptance.json']
 
 
 def stage(api, directory, tag, revision):
-    version = tag.removeprefix('v')
-    dist.require(tag == 'v' + version and re.fullmatch('[0-9a-f]{40}', revision), 'Tag/Revision ungültig')
+    version = release_version(tag)
+    dist.require(re.fullmatch('[0-9a-f]{40}', revision), 'Tag/Revision ungültig')
     dist.require(api.request('GET', '/tags/' + quote(tag, safe=''))['commit']['sha'] == revision, 'Tag zeigt auf andere Revision')
     names = expected(version)
     for target in dist.TARGETS:
@@ -92,8 +98,7 @@ def verify_uploads(api, release_id, directory, names):
 
 
 def publish(api, directory, evidence, tag, revision):
-    version = tag.removeprefix('v')
-    dist.require(tag == 'v' + version, 'Versionstag erforderlich')
+    version = release_version(tag)
     dist.require(api.request('GET', '/tags/' + quote(tag, safe=''))['commit']['sha'] == revision, 'Tag zeigt auf andere Revision')
     dist.gate(directory, evidence, revision, version)
     release = api.request('GET', '/releases/tags/' + quote(tag, safe=''))
@@ -118,7 +123,7 @@ def main():
     else:
         args.packages.mkdir(parents=True)  # Nie lokale Kandidaten überschreiben.
         release = api.request('GET', '/releases/tags/' + quote(args.tag, safe=''))
-        names = expected(args.tag.removeprefix('v'))
+        names = expected(release_version(args.tag))
         dist.require(release['draft'], 'Nur bestehende Entwürfe freigeben')
         assets = release.get('assets', [])
         dist.require(len(assets) == len(names) and {a['name'] for a in assets} == set(names), 'Pflichtassets fehlen')

.gitea/scripts/test_distribution.py

@@ -18,7 +18,7 @@ class DistributionTests(unittest.TestCase):
         self.packages = self.root / 'packages'; self.packages.mkdir()
         self.evidence = self.root / 'evidence'; self.evidence.mkdir()
         self.revision = 'a' * 40
-        self.version = '0.1.0'
+        self.version = '1.0.0'
         self.manifests = {}
         for target in d.TARGETS:
             path = self.packages / d.name(self.version, target)
@@ -42,6 +42,13 @@ class DistributionTests(unittest.TestCase):
         self.mock_verify = patch.object(d, 'verify', side_effect=lambda archive, target, *args: self.manifests[target])
         self.mock_verify.start(); self.addCleanup(self.mock_verify.stop)
 
+    def test_release_tags_are_exact_numeric_versions(self):
+        for tag in ('v1.0.0', 'v0.0.0', 'v12.34.56'):
+            self.assertEqual(r.release_version(tag), tag[1:])
+        for tag in ('main', '1.0.0', 'v1.0', 'v1.0.0-rc1', 'v1.0.0+build',
+                    'v1.0.0/extra', 'v01.0.0', 'v1x.0.0', 'v1.0.0\n'):
+            with self.assertRaises(ValueError, msg=tag): r.release_version(tag)
+
     def gate(self):
         return d.gate(self.packages, self.evidence, self.revision, self.version)