From ba55d1d5529f0f6184038028deaff04d4648d027 Mon Sep 17 00:00:00 2001 From: Andriujose <43181885+andriujoseba@users.noreply.github.com> Date: Mon, 3 Aug 2026 21:39:02 +0000 Subject: [PATCH] feat: declare the release door path --- .github/scripts/release-path.sh | 15 ++++ test/release-path.test.sh | 120 ++++++++++++++++++++++++++++++++ 2 files changed, 135 insertions(+) create mode 100755 .github/scripts/release-path.sh create mode 100755 test/release-path.test.sh diff --git a/.github/scripts/release-path.sh b/.github/scripts/release-path.sh new file mode 100755 index 0000000..0068f62 --- /dev/null +++ b/.github/scripts/release-path.sh @@ -0,0 +1,15 @@ +#!/usr/bin/env bash +# The release doors' executable path (discussion #217; issue #237). The +# 0.5.0 record had to explain why lib/ruling.sh changed without changing a +# door. Keep this list executable so a doors-unchanged record measures the +# workflow and only the scripts it actually runs, while the test catches a +# new or removed dependency before a record can silently omit it. +set -euo pipefail + +printf '%s\n' \ + .github/workflows/release.yml \ + bin/ \ + lib/version.sh \ + lib/decide.sh \ + lib/facts.sh \ + lib/changelog.sh diff --git a/test/release-path.test.sh b/test/release-path.test.sh new file mode 100755 index 0000000..9fa5db2 --- /dev/null +++ b/test/release-path.test.sh @@ -0,0 +1,120 @@ +#!/usr/bin/env bash +# Contract tests for the release-door path manifest (issue #237). The list +# is evidence for skipping a live drill, so drift in either direction must +# fail before a release record can make an incomplete claim. +set -u + +ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +# shellcheck source=test/harness.sh +. "$ROOT/test/harness.sh" + +PATH_SCRIPT="$ROOT/.github/scripts/release-path.sh" +TMP="$(mktemp -d)" +trap 'rm -rf "$TMP"' EXIT + +# derive_path — print the workflow, bin/ when a bin command sources a +# door library, and the workflow's direct + transitive lib dependencies. +derive_path() { + local tree="$1" workflow="$tree/.github/workflows/release.yml" + local pending seen=" " lib file refs ref bin_uses_lib=no + + printf '%s\n' .github/workflows/release.yml + pending="$(sed -n 's|.*\(lib/[[:alnum:]_.-]*\.sh\).*|\1|p' "$workflow" | sort -u)" + + while [ -n "$pending" ]; do + lib="$(printf '%s\n' "$pending" | sed -n '1p')" + pending="$(printf '%s\n' "$pending" | sed '1d')" + case "$seen" in + *" $lib "*) continue ;; + esac + seen="$seen$lib " + printf '%s\n' "$lib" + file="$tree/$lib" + [ -f "$file" ] || continue + refs="$(sed -n 's|.*\(lib/[[:alnum:]_.-]*\.sh\).*|\1|p' "$file" | sort -u)" + if [ -n "$refs" ]; then + pending="$(printf '%s\n%s\n' "$pending" "$refs" | sed '/^$/d' | sort -u)" + fi + done + + if [ -d "$tree/bin" ]; then + for file in "$tree"/bin/*; do + [ -f "$file" ] || continue + refs="$(sed -n 's|.*\(lib/[[:alnum:]_.-]*\.sh\).*|\1|p' "$file")" + for ref in $refs; do + case "$seen" in + *" $ref "*) bin_uses_lib=yes ;; + esac + done + done + fi + [ "$bin_uses_lib" = no ] || printf '%s\n' bin/ +} + +declared_path() { + bash "$1/.github/scripts/release-path.sh" +} + +path_check() { + local tree="$1" declared derived missing extra + declared="$(declared_path "$tree" | sort -u)" + derived="$(derive_path "$tree" | sort -u)" + missing="$(comm -13 <(printf '%s\n' "$declared") <(printf '%s\n' "$derived"))" + extra="$(comm -23 <(printf '%s\n' "$declared") <(printf '%s\n' "$derived"))" + if [ -n "$missing" ]; then + printf 'release-path: missing dependency: %s\n' "$missing" >&2 + fi + if [ -n "$extra" ]; then + printf 'release-path: stale path: %s\n' "$extra" >&2 + fi + [ -z "$missing" ] && [ -z "$extra" ] +} + +fixture() { + local name="$1" tree + tree="$TMP/$name" + mkdir -p "$tree/.github/scripts" "$tree/.github/workflows" "$tree/lib" "$tree/bin" + cp "$PATH_SCRIPT" "$tree/.github/scripts/release-path.sh" + printf '#!/usr/bin/env bash\n. "$ROOT/lib/changelog.sh"\n' >"$tree/bin/assemble" + printf '#!/usr/bin/env bash\n' >"$tree/lib/changelog.sh" + printf '#!/usr/bin/env bash\n' >"$tree/lib/decide.sh" + printf '#!/usr/bin/env bash\n. "$ROOT/lib/version.sh"\n' >"$tree/lib/facts.sh" + printf '#!/usr/bin/env bash\n' >"$tree/lib/version.sh" + printf '%s\n' "$tree" +} + +# Exact output is the record author's copy-paste source. +check "manifest prints the specified ordered release path" 0 \ + $'.github/workflows/release.yml\nbin/\nlib/version.sh\nlib/decide.sh\nlib/facts.sh\nlib/changelog.sh' \ + bash "$PATH_SCRIPT" +check "real workflow and transitive dependencies match the manifest" 0 "" \ + path_check "$ROOT" + +# A door growing a dependency must name the missing path (#237 D7). +tree="$(fixture missing)" +printf 'run: bash "$CEREMONY_DIR/lib/facts.sh"\nrun: bash "$CEREMONY_DIR/lib/decide.sh"\nrun: . "$CEREMONY_DIR/lib/changelog.sh"\nrun: . "$CEREMONY_DIR/lib/version.sh"\nrun: . "$CEREMONY_DIR/lib/ruling.sh"\n' \ + >"$tree/.github/workflows/release.yml" +printf '#!/usr/bin/env bash\n' >"$tree/lib/ruling.sh" +check "a new workflow library fails with its missing path" 1 \ + "missing dependency: lib/ruling.sh" path_check "$tree" + +# A manifest may not rot into a safe-looking superset. +tree="$(fixture extra)" +printf 'run: bash "$CEREMONY_DIR/lib/facts.sh"\nrun: bash "$CEREMONY_DIR/lib/decide.sh"\nrun: . "$CEREMONY_DIR/lib/changelog.sh"\n' \ + >"$tree/.github/workflows/release.yml" +sed -i 's| lib/changelog.sh$| lib/changelog.sh \\|' \ + "$tree/.github/scripts/release-path.sh" +printf ' lib/ruling.sh\n' >>"$tree/.github/scripts/release-path.sh" +printf '#!/usr/bin/env bash\n' >"$tree/lib/ruling.sh" +check "a path no door reads fails as stale" 1 "stale path: lib/ruling.sh" \ + path_check "$tree" + +# Transitive sourcing is part of the derivation, not decoration. +tree="$(fixture transitive)" +printf 'run: bash "$CEREMONY_DIR/lib/facts.sh"\nrun: bash "$CEREMONY_DIR/lib/decide.sh"\nrun: . "$CEREMONY_DIR/lib/changelog.sh"\n' \ + >"$tree/.github/workflows/release.yml" +: >"$tree/lib/facts.sh" +check "removing facts' version source fails as a stale path" 1 \ + "stale path: lib/version.sh" path_check "$tree" + +summary