| 1 | #!/usr/bin/env bash |
| 2 | # Fails CI if version state is inconsistent across the workspace, npm |
| 3 | # wrapper, and Cargo.lock. Run on every push/PR so silent drift can't ship. |
| 4 | # |
| 5 | # Checks performed: |
| 6 | # 1. No `crates/*/Cargo.toml` carries a literal `version = "x.y.z"`; every |
| 7 | # crate must inherit `version.workspace = true`. |
| 8 | # 2. Every crate inherits the workspace MSRV through |
| 9 | # `rust-version.workspace = true`. |
| 10 | # 3. `npm/codewhale/package.json` and the root workspace lock entry match |
| 11 | # the workspace `version` in the root `Cargo.toml`. |
| 12 | # (`npm/deepseek-tui/` still exists only as an unpublished compatibility |
| 13 | # notice and must stay private.) |
| 14 | # 4. Internal `codewhale-*` path dependency pins match the workspace version. |
| 15 | # 5. The TUI crate's packaged changelog copy matches root `CHANGELOG.md`. |
| 16 | # 6. The current version has either an explicit source-candidate entry or a |
| 17 | # dated Keep a Changelog release entry and a matching compare link. |
| 18 | # 7. README contributor additions are mentioned in the current release entry. |
| 19 | # 8. `SECURITY.md` keeps the dedicated security contact. |
| 20 | # 9. Generated website facts carry the workspace version. |
| 21 | # 10. Public install and version snippets point at the current release. |
| 22 | # 11. `codewhale-app-server` stays library-only; the shipped app-server |
| 23 | # entrypoint belongs to `codewhale-cli`. |
| 24 | # 12. `Cargo.lock` is in sync with the manifests (`cargo metadata --locked` |
| 25 | # fails if not). |
| 26 | set -euo pipefail |
| 27 | |
| 28 | require_dated_release=0 |
| 29 | if [[ "${1:-}" == "--require-dated-release" ]]; then |
| 30 | require_dated_release=1 |
| 31 | shift |
| 32 | fi |
| 33 | if [[ "$#" -ne 0 ]]; then |
| 34 | echo "Usage: $0 [--require-dated-release]" >&2 |
| 35 | exit 2 |
| 36 | fi |
| 37 | |
| 38 | cd "$(dirname "$0")/../.." |
| 39 | |
| 40 | fail=0 |
| 41 | |
| 42 | # 1) Literal versions in crate manifests. |
| 43 | literals="$(grep -nE '^version = "' crates/*/Cargo.toml || true)" |
| 44 | if [[ -n "${literals}" ]]; then |
| 45 | echo "::error::Crate manifests must use 'version.workspace = true', not literal versions:" >&2 |
| 46 | echo "${literals}" >&2 |
| 47 | fail=1 |
| 48 | fi |
| 49 | |
| 50 | # 2) Workspace MSRV inheritance. A workspace value is not included in package |
| 51 | # metadata unless every member opts in, which would silently omit the MSRV from |
| 52 | # all crates.io manifests. |
| 53 | missing_rust_version="" |
| 54 | for manifest in crates/*/Cargo.toml; do |
| 55 | if ! grep -qxF 'rust-version.workspace = true' "${manifest}"; then |
| 56 | missing_rust_version+="${manifest}"$'\n' |
| 57 | fi |
| 58 | done |
| 59 | if [[ -n "${missing_rust_version}" ]]; then |
| 60 | echo "::error::Every crate manifest must inherit the workspace MSRV with 'rust-version.workspace = true':" >&2 |
| 61 | printf '%s' "${missing_rust_version}" >&2 |
| 62 | fail=1 |
| 63 | fi |
| 64 | |
| 65 | # 3) Workspace ↔ npm package.json ↔ root package lock. |
| 66 | workspace_version="$(grep -E '^version = "' Cargo.toml | head -n1 | sed -E 's/^version = "([^"]+)".*/\1/')" |
| 67 | npm_version="$(node -p "require('./npm/codewhale/package.json').version")" |
| 68 | if [[ "${workspace_version}" != "${npm_version}" ]]; then |
| 69 | echo "::error::npm/codewhale/package.json version (${npm_version}) does not match workspace Cargo.toml (${workspace_version})." >&2 |
| 70 | fail=1 |
| 71 | fi |
| 72 | lock_npm_version="$(node -p "require('./package-lock.json').packages?.['npm/codewhale']?.version ?? ''")" |
| 73 | if [[ "${workspace_version}" != "${lock_npm_version}" ]]; then |
| 74 | echo "::error::package-lock.json npm/codewhale version (${lock_npm_version:-<missing>}) does not match workspace Cargo.toml (${workspace_version})." >&2 |
| 75 | echo "Run: npm install --package-lock-only --ignore-scripts" >&2 |
| 76 | fail=1 |
| 77 | fi |
| 78 | if [[ -f npm/deepseek-tui/package.json ]]; then |
| 79 | legacy_private="$(node -p "Boolean(require('./npm/deepseek-tui/package.json').private)")" |
| 80 | legacy_publish_config="$(node -p "Boolean(require('./npm/deepseek-tui/package.json').publishConfig)")" |
| 81 | if [[ "${legacy_private}" != "true" ]]; then |
| 82 | echo "::error::npm/deepseek-tui/package.json must stay private so the legacy package is not republished." >&2 |
| 83 | fail=1 |
| 84 | fi |
| 85 | if [[ "${legacy_publish_config}" == "true" ]]; then |
| 86 | echo "::error::npm/deepseek-tui/package.json must not define publishConfig; the legacy package is deprecated." >&2 |
| 87 | fail=1 |
| 88 | fi |
| 89 | fi |
| 90 | |
| 91 | # 4) Internal path dependency pins. |
| 92 | internal_dep_drift="$( |
| 93 | grep -nE 'codewhale-[a-z-]+[[:space:]]*=[[:space:]]*\{[^}]*version[[:space:]]*=[[:space:]]*"' crates/*/Cargo.toml \ |
| 94 | | grep -v "version[[:space:]]*=[[:space:]]*\"${workspace_version}\"" || true |
| 95 | )" |
| 96 | if [[ -n "${internal_dep_drift}" ]]; then |
| 97 | echo "::error::Internal codewhale-* path dependency versions must match workspace version ${workspace_version}:" >&2 |
| 98 | echo "${internal_dep_drift}" >&2 |
| 99 | fail=1 |
| 100 | fi |
| 101 | |
| 102 | # 5) Packaged TUI changelog slice (recent releases embedded in the binary). |
| 103 | if ! ./scripts/sync-changelog.sh --check >/dev/null 2>&1; then |
| 104 | echo "::error::crates/tui/CHANGELOG.md is out of date with the root CHANGELOG.md slice." >&2 |
| 105 | echo "Run: ./scripts/sync-changelog.sh" >&2 |
| 106 | fail=1 |
| 107 | fi |
| 108 | |
| 109 | # 6) Current candidate/release-note shape. Normal branch and release-candidate |
| 110 | # CI must accept an honest source candidate. Tag creation and public release |
| 111 | # workflows pass --require-dated-release so publication cannot proceed until |
| 112 | # the same entry has a real release date and tag-based compare link. |
| 113 | current_section="$( |
| 114 | awk -v version="${workspace_version}" ' |
| 115 | index($0, "## [" version "] - ") == 1 { in_section = 1; print; next } |
| 116 | in_section && /^## \[/ { exit } |
| 117 | in_section { print } |
| 118 | ' CHANGELOG.md |
| 119 | )" |
| 120 | if [[ -z "${current_section}" ]]; then |
| 121 | echo "::error::CHANGELOG.md must contain a section for ${workspace_version}." >&2 |
| 122 | fail=1 |
| 123 | else |
| 124 | dated_heading="## [${workspace_version}] - YYYY-MM-DD" |
| 125 | candidate_heading="## [${workspace_version}] - Unreleased candidate" |
| 126 | if [[ "${require_dated_release}" == "1" ]]; then |
| 127 | if ! grep -qE "^## \\[${workspace_version}\\] - [0-9]{4}-[0-9]{2}-[0-9]{2}$" <<<"${current_section}"; then |
| 128 | echo "::error::Publication requires CHANGELOG.md section ${workspace_version} to use '${dated_heading}'." >&2 |
| 129 | fail=1 |
| 130 | fi |
| 131 | elif ! grep -qE "^## \\[${workspace_version}\\] - ([0-9]{4}-[0-9]{2}-[0-9]{2}|Unreleased candidate)$" <<<"${current_section}"; then |
| 132 | echo "::error::CHANGELOG.md section ${workspace_version} must use '${candidate_heading}' or '${dated_heading}'." >&2 |
| 133 | fail=1 |
| 134 | fi |
| 135 | if ! grep -qE "^### (Added|Changed|Deprecated|Removed|Fixed|Security)$" <<<"${current_section}"; then |
| 136 | echo "::error::CHANGELOG.md section ${workspace_version} must contain at least one Keep a Changelog subsection." >&2 |
| 137 | fail=1 |
| 138 | fi |
| 139 | fi |
| 140 | |
| 141 | compare_line="$(grep -E "^\\[${workspace_version}\\]: " CHANGELOG.md || true)" |
| 142 | if [[ -z "${compare_line}" ]]; then |
| 143 | echo "::error::CHANGELOG.md must include a compare link for ${workspace_version}." >&2 |
| 144 | fail=1 |
| 145 | elif [[ "${require_dated_release}" == "1" ]] && |
| 146 | ! grep -qE "^\\[${workspace_version}\\]: https://github.com/Hmbown/CodeWhale/compare/v[0-9]+\\.[0-9]+\\.[0-9]+\\.\\.\\.v${workspace_version}$" <<<"${compare_line}"; then |
| 147 | echo "::error::Publication requires the ${workspace_version} compare link to end at v${workspace_version}." >&2 |
| 148 | fail=1 |
| 149 | fi |
| 150 | |
| 151 | unreleased_section="$( |
| 152 | awk ' |
| 153 | index($0, "## [Unreleased]") == 1 { in_section = 1; print; next } |
| 154 | in_section && /^## \[/ { exit } |
| 155 | in_section { print } |
| 156 | ' CHANGELOG.md |
| 157 | )" |
| 158 | credit_sections="${current_section} |
| 159 | ${unreleased_section}" |
| 160 | |
| 161 | # 7) Contributor-credit cross-check for README additions on the release branch. |
| 162 | # This cannot prove every external PR author has been credited, but it does |
| 163 | # catch the common release-polish failure mode: adding a README contributor row |
| 164 | # without mentioning that credit/correction in the current release entry. While |
| 165 | # a release branch is still unbumped, `[Unreleased]` is also a valid credit |
| 166 | # surface. |
| 167 | previous_tag="" |
| 168 | current_tag="v${workspace_version}" |
| 169 | if [[ "${compare_line}" =~ compare/(v[0-9]+\.[0-9]+\.[0-9]+)\.\.\.${current_tag} ]]; then |
| 170 | previous_tag="${BASH_REMATCH[1]}" |
| 171 | fi |
| 172 | if [[ -n "${previous_tag}" ]]; then |
| 173 | if ! git rev-parse -q --verify "refs/tags/${previous_tag}" >/dev/null; then |
| 174 | git fetch --quiet --depth=1 origin "refs/tags/${previous_tag}:refs/tags/${previous_tag}" || true |
| 175 | fi |
| 176 | if git rev-parse -q --verify "refs/tags/${previous_tag}" >/dev/null; then |
| 177 | while IFS= read -r line; do |
| 178 | [[ -z "${line}" ]] && continue |
| 179 | handle="$(sed -E 's#.*github.com/([^)/]+).*#\1#' <<<"${line}")" |
| 180 | if [[ -n "${handle}" && "${handle}" != "${line}" ]]; then |
| 181 | if ! grep -Fq "github.com/${handle}" <<<"${credit_sections}" && ! grep -Fq "@${handle}" <<<"${credit_sections}"; then |
| 182 | echo "::error::README.md adds contributor @${handle}, but CHANGELOG.md ${workspace_version} or [Unreleased] does not mention that credit." >&2 |
| 183 | fail=1 |
| 184 | fi |
| 185 | fi |
| 186 | done < <( |
| 187 | git diff "${previous_tag}..HEAD" -- README.md \ |
| 188 | | grep -E '^\+[-*] \*\*\[[^]]+\]\(https://github.com/[^)]+\)\*\*' || true |
| 189 | ) |
| 190 | fi |
| 191 | fi |
| 192 | |
| 193 | # 8) Security contact guard. |
| 194 | security_email="hmbown@gmail.com" |
| 195 | if ! grep -qF "${security_email}" SECURITY.md; then |
| 196 | echo "::error::SECURITY.md must list ${security_email} as the security contact." >&2 |
| 197 | fail=1 |
| 198 | fi |
| 199 | if grep -qF "hmbown.dev@gmail.com" SECURITY.md; then |
| 200 | echo "::error::SECURITY.md must not use the alternate personal fallback email; use ${security_email}." >&2 |
| 201 | fail=1 |
| 202 | fi |
| 203 | |
| 204 | # 9) Generated web facts carry the workspace version. The file is ignored and |
| 205 | # generated during web builds, so a clean CI checkout must derive it before this |
| 206 | # release guard can inspect it. |
| 207 | if [[ ! -f web/lib/facts.generated.ts ]]; then |
| 208 | node web/scripts/derive-facts.mjs |
| 209 | fi |
| 210 | facts_version="$(grep -oE '"version": "[0-9]+\.[0-9]+\.[0-9]+"' web/lib/facts.generated.ts | head -n1 | sed -E 's/.*"([0-9.]+)".*/\1/')" |
| 211 | if [[ "${facts_version}" != "${workspace_version}" ]]; then |
| 212 | node web/scripts/derive-facts.mjs |
| 213 | facts_version="$(grep -oE '"version": "[0-9]+\.[0-9]+\.[0-9]+"' web/lib/facts.generated.ts | head -n1 | sed -E 's/.*"([0-9.]+)".*/\1/')" |
| 214 | if [[ "${facts_version}" != "${workspace_version}" ]]; then |
| 215 | echo "::error::web/lib/facts.generated.ts version (${facts_version}) does not match workspace (${workspace_version}). Run: node web/scripts/derive-facts.mjs" >&2 |
| 216 | fail=1 |
| 217 | fi |
| 218 | fi |
| 219 | |
| 220 | # 10) README install-tag examples point at the current release. |
| 221 | for readme in README.md README.zh-CN.md README.ja-JP.md README.vi.md README.ko-KR.md; do |
| 222 | stale_tags="$(grep -nE -- "--tag v[0-9]+\.[0-9]+\.[0-9]+" "${readme}" | grep -v -- "--tag v${workspace_version}" || true)" |
| 223 | if [[ -n "${stale_tags}" ]]; then |
| 224 | echo "::error::${readme} has install examples pinned to an old tag (want v${workspace_version}):" >&2 |
| 225 | echo "${stale_tags}" >&2 |
| 226 | fail=1 |
| 227 | fi |
| 228 | done |
| 229 | |
| 230 | # 10b) Public install/version snippets stay on the current release (#3767). |
| 231 | # `codewhale --version # X.Y.Z` verify-your-install lines across README |
| 232 | # locales and docs/INSTALL.md, plus the docs/INSTALL.md npm-wrapper publish |
| 233 | # pointer ("published at vX.Y.Z"). These drifted while this gate still passed |
| 234 | # on a prior lane, so guard them explicitly. Narrowly scoped to those two |
| 235 | # snippet shapes to avoid flagging unrelated prose. |
| 236 | for doc in README.md README.zh-CN.md README.ja-JP.md README.vi.md README.ko-KR.md docs/INSTALL.md; do |
| 237 | [[ -f "${doc}" ]] || continue |
| 238 | stale_version_comments="$(grep -nE -- "codewhale --version[[:space:]]+#[[:space:]]*[0-9]+\.[0-9]+\.[0-9]+" "${doc}" | grep -vE -- "#[[:space:]]*${workspace_version}([^0-9]|$)" || true)" |
| 239 | if [[ -n "${stale_version_comments}" ]]; then |
| 240 | echo "::error::${doc} has 'codewhale --version # X' snippet(s) not on ${workspace_version}:" >&2 |
| 241 | echo "${stale_version_comments}" >&2 |
| 242 | fail=1 |
| 243 | fi |
| 244 | done |
| 245 | |
| 246 | # The publish pointer can wrap onto the next line; also scan the line after the lead-in. |
| 247 | wrapper_pointer_version="$(grep -A1 -E -- "wrapper is published at" docs/INSTALL.md | grep -oE -- "v[0-9]+\.[0-9]+\.[0-9]+" | head -n1 || true)" |
| 248 | if [[ -n "${wrapper_pointer_version}" && "${wrapper_pointer_version}" != "v${workspace_version}" ]]; then |
| 249 | echo "::error::docs/INSTALL.md npm-wrapper publish pointer is ${wrapper_pointer_version}, want v${workspace_version}." >&2 |
| 250 | fail=1 |
| 251 | fi |
| 252 | |
| 253 | remote_smoke_tag="$(grep -oE 'RELEASE_TAG:-v[0-9]+\.[0-9]+\.[0-9]+' scripts/remote-smoke/setup-vm.sh | head -n1 | sed 's/.*:-//' || true)" |
| 254 | if [[ "${remote_smoke_tag}" != "v${workspace_version}" ]]; then |
| 255 | echo "::error::scripts/remote-smoke/setup-vm.sh defaults to ${remote_smoke_tag:-<missing>}, want v${workspace_version}." >&2 |
| 256 | fail=1 |
| 257 | fi |
| 258 | |
| 259 | # 11) App-server is not a standalone binary. |
| 260 | app_server_bins="$( |
| 261 | cargo metadata --locked --format-version 1 --no-deps \ |
| 262 | | node -e ' |
| 263 | const fs = require("fs"); |
| 264 | const metadata = JSON.parse(fs.readFileSync(0, "utf8")); |
| 265 | const pkg = metadata.packages.find((p) => p.name === "codewhale-app-server"); |
| 266 | if (!pkg) { |
| 267 | process.exit(2); |
| 268 | } |
| 269 | const bins = pkg.targets |
| 270 | .filter((target) => target.kind.includes("bin")) |
| 271 | .map((target) => target.name); |
| 272 | process.stdout.write(bins.join("\n")); |
| 273 | ' |
| 274 | )" |
| 275 | if [[ -n "${app_server_bins}" ]]; then |
| 276 | echo "::error::codewhale-app-server must stay library-only; use the codewhale-cli-owned 'codewhale app-server' entrypoint instead. Unexpected binary target(s):" >&2 |
| 277 | echo "${app_server_bins}" >&2 |
| 278 | fail=1 |
| 279 | fi |
| 280 | |
| 281 | # 12) Cargo.lock in sync. |
| 282 | if ! cargo metadata --locked --format-version 1 --no-deps >/dev/null 2>&1; then |
| 283 | echo "::error::Cargo.lock is out of sync with the manifests. Run 'cargo update -p codewhale-tui' or 'cargo build' and commit the result." >&2 |
| 284 | fail=1 |
| 285 | fi |
| 286 | |
| 287 | if [[ "${fail}" -eq 0 ]]; then |
| 288 | echo "Version state OK: workspace=${workspace_version}, npm=${npm_version}, lockfile in sync." |
| 289 | fi |
| 290 | |
| 291 | exit "${fail}" |
| 292 |