You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@reqsign.apache.org by "tisonkun (via GitHub)" <gi...@apache.org> on 2026/09/29 22:32:20 UTC
[PR] ci: simplify Rust release automation [reqsign]
tisonkun opened a new pull request, #891:
URL: https://github.com/apache/reqsign/pull/891
The release helpers repeat Cargo metadata validation, maintain their own topological sorter, and audit the same bootstrap state through several layers. Simplify these repository-specific scripts and remove 1,268 lines while retaining dependency-ordered publishing, fresh OIDC credentials per attempt, rate-limit recovery, and resumable bootstrap.
Use `graphlib.TopologicalSorter`, direct response-field access, and assertions for invariant violations. Remove unused project/registry configuration, redundant data classes, API error wrappers, and the separate bootstrap discovery job. Bootstrap still audits the complete plan before any write, refuses to modify established crates, and verifies the complete plan afterward. Ordinary API failures now stop the run; automatic waits remain only for Cargo publish rate limits and public metadata propagation. Assertions require normal Python execution, as documented.
The local bootstrap helper uses GitHub's [versioned dispatch API](https://docs.github.com/en/rest/actions/workflows#create-a-workflow-dispatch-event) to obtain the exact run ID, replacing output parsing and run-list polling. It retains the clean-main, protected-environment, and run-commit checks. The release job relies on its existing formal-tag push filter.
Reduce the tests from 33 to 11: remove YAML/literal assertions and internal call-order mocks, and retain coverage for dependency ordering, token cleanup and renewal, publish recovery, zero writes on failed bootstrap preflight, partial-bootstrap reruns, and offline placeholder packaging/building.
Validation:
- 11 Python behavior tests passed.
- `cargo publish --workspace --dry-run --allow-dirty` passed for all 15 crates.
- Public `bootstrap.py verify` passed for all 15 crates.
- Ruff, actionlint, Bash syntax, Hawkeye, and `git diff --check` passed.
Live publication, workflow dispatch, and authenticated crates.io mutations were not exercised.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@reqsign.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@reqsign.apache.org
For additional commands, e-mail: commits-help@reqsign.apache.org
Re: [PR] ci: simplify Rust release automation [reqsign]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #891:
URL: https://github.com/apache/reqsign/pull/891#discussion_r4139315008
##########
release/scripts/bootstrap-rust-crates.sh:
##########
@@ -19,134 +19,33 @@
set -euo pipefail
-script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-repo_dir="$(git -C "${script_dir}" rev-parse --show-toplevel)"
-cd "${repo_dir}"
-
-for command in gh git jq python3; do
- command -v "${command}" >/dev/null || {
- echo "required command is unavailable: ${command}" >&2
- exit 1
- }
-done
-
-if [[ "$#" -ne 0 ]]; then
- echo "usage: $0" >&2
- exit 1
-fi
-if [[ -n "$(git status --porcelain)" ]]; then
- echo "the release checkout must be clean" >&2
- exit 1
-fi
-
-apache_remote="$(
- git remote -v |
- awk '$2 ~ /github.com[:\/]apache\/reqsign(\.git)?$/ && $3 == "(fetch)" { print $1; exit }'
-)"
-if [[ -z "${apache_remote}" ]]; then
- echo "cannot find a git remote for apache/reqsign" >&2
- exit 1
-fi
-
-git fetch "${apache_remote}" main
-source_commit="$(git rev-parse FETCH_HEAD)"
-if [[ "$(git rev-parse HEAD)" != "${source_commit}" ]]; then
- echo "the release checkout must be at the current apache/reqsign main: ${source_commit}" >&2
- exit 1
-fi
-
-git cat-file -e \
- "${source_commit}:.github/workflows/bootstrap_rust_crates.yml"
-git cat-file -e \
- "${source_commit}:.github/scripts/release_rust/bootstrap.py"
+cd "$(git -C "$(dirname "${BASH_SOURCE[0]}")" rev-parse --show-toplevel)"
+test "$#" -eq 0
+test -z "$(git status --porcelain)"
repo="apache/reqsign"
workflow="bootstrap_rust_crates.yml"
-environment="rust-bootstrap"
-if ! environment_json="$(gh api "repos/${repo}/environments/${environment}")"; then
- echo "GitHub environment ${environment} is not configured" >&2
- exit 1
-fi
-if ! jq -e \
- '[.protection_rules[]? | select(.type == "required_reviewers")] | length > 0' \
- >/dev/null <<<"${environment_json}"; then
- echo "GitHub environment ${environment} must require reviewers" >&2
- exit 1
-fi
-
-run_title="Bootstrap Rust crates at ${source_commit}"
-started_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+git fetch "https://github.com/${repo}.git" main
+source_commit="$(git rev-parse FETCH_HEAD)"
+test "$(git rev-parse HEAD)" = "${source_commit}"
-if ! dispatch_output="$(
- gh workflow run "${workflow}" \
- --repo "${repo}" \
- --ref main 2>&1
-)"; then
- echo "${dispatch_output}" >&2
- exit 1
-fi
-echo "${dispatch_output}"
+gh api "repos/${repo}/environments/rust-bootstrap" |
+ jq -e '[.protection_rules[] | select(.type == "required_reviewers")] | length > 0' >/dev/null
+# The versioned dispatch API returns the exact run; no polling or title matching.
run_id="$(
- sed -nE \
- 's#.*github\.com/apache/reqsign/actions/runs/([0-9]+).*#\1#p' \
- <<<"${dispatch_output}" |
- tail -n 1
-)"
-deadline=$((SECONDS + 120))
-while [[ -z "${run_id}" && ${SECONDS} -lt ${deadline} ]]; do
- runs="$(
- gh run list \
- --repo "${repo}" \
- --workflow "${workflow}" \
- --event workflow_dispatch \
- --limit 50 \
- --json databaseId,displayTitle,headSha,createdAt
- )"
- run_id="$(
- jq -r \
- --arg title "${run_title}" \
- --arg head_sha "${source_commit}" \
- --arg started_at "${started_at}" \
- '[.[]
- | select(
- .displayTitle == $title
- and .headSha == $head_sha
- and .createdAt >= $started_at
- )
- ]
- | sort_by(.createdAt)
- | last
- | .databaseId // empty' \
- <<<"${runs}"
- )"
- if [[ -z "${run_id}" ]]; then
- sleep 2
- fi
-done
-
-if [[ -z "${run_id}" ]]; then
- echo "could not resolve the dispatched ${workflow} run" >&2
- exit 1
-fi
-
-run_head_sha="$(
- gh run view "${run_id}" --repo "${repo}" --json headSha --jq '.headSha'
+ gh api --method POST \
+ -H 'X-GitHub-Api-Version: 2026-03-10' \
+ "repos/${repo}/actions/workflows/${workflow}/dispatches" \
+ -f ref=main |
Review Comment:
The 2026-03-10 dispatch API returns `workflow_run_id` only when `return_run_details` is explicitly true. With only `ref`, this keeps the legacy 204/no-body response, so `jq` fails after dispatching the workflow and the helper never watches or verifies that run. Send the typed boolean field as part of this request.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@reqsign.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@reqsign.apache.org
For additional commands, e-mail: commits-help@reqsign.apache.org
Re: [PR] ci: simplify Rust release automation [reqsign]
Posted by "Xuanwo (via GitHub)" <gi...@apache.org>.
Xuanwo merged PR #891:
URL: https://github.com/apache/reqsign/pull/891
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@reqsign.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@reqsign.apache.org
For additional commands, e-mail: commits-help@reqsign.apache.org