Skip to content

Commit 4ad02b7

Browse files
alexeaglealexeagle
authored
refactor(release): switch release integrity to be dynamic (#854)
* refactor(release): switch release integrity to be dynamic This matches rules_py as documented by https://blog.aspect.build/releasing-bazel-rulesets-rust It has the benefit that developers no longer get yelled at to vendor some updated integrity hashes into bazel-lib every time they touch the Go sources. * refactor: echo should produce trailing newline * chore: bump action-gh-release to avoid Node 16 warning * chore: update test that is sensitive to compilation mode We now only use --compilation_mode=opt when cutting a release
1 parent 6959b3f commit 4ad02b7

20 files changed

+175
-216
lines changed

‎.bazelrc

+5-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,11 @@ build --embed_label=v1.2.3
1515
# Mock versioning command to test the --stamp behavior
1616
build --workspace_status_command="echo BUILD_SCM_VERSION 1.2.3"
1717

18-
common --compilation_mode opt
18+
# For releasing, use --workspace_status_command and stamp
19+
# before adding more flags to the release config make sure it does not
20+
# affect the hashes of /tools. See tools/release.bzl for opt transition
21+
# add appropriate commandline transition there to match the configuration.
22+
common:release -c opt
1923

2024
# Load any settings & overrides specific to the current user from `.aspect/bazelrc/user.bazelrc`.
2125
# This file should appear in `.gitignore` so that settings are not shared with team members. This

‎.github/workflows/integrity.jq

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# JQ filter to transform sha256 files to a value we can read from starlark.
2+
# NB: the sha256 files are expected to be newline-terminated.
3+
#
4+
# Input looks like
5+
# 48552e399a1f2ab97e62ca7fce5783b6214e284330c7555383f43acf82446636 unpack-linux-aarch64\nfd265552bfd236efef519f81ce783322a50d8d7ab5af5d08a713e519cedff87f unpack-linux-x86_64\n
6+
#
7+
# Output should look like
8+
# {
9+
# "unpack-linux-aarch64": "48552e399a1f2ab97e62ca7fce5783b6214e284330c7555383f43acf82446636",
10+
# "unpack-linux-x86_64": "fd265552bfd236efef519f81ce783322a50d8d7ab5af5d08a713e519cedff87f"
11+
# }
12+
13+
.
14+
# Don't end with an empty object
15+
| rtrimstr("\n")
16+
| split("\n")
17+
| map(
18+
split(" ")
19+
| {"key": .[1], "value": .[0]}
20+
)
21+
| from_entries

‎.github/workflows/release.yml

+28-32
Original file line numberDiff line numberDiff line change
@@ -10,47 +10,43 @@ on:
1010

1111
jobs:
1212
build:
13+
# Go cross-compilation works from linux -> any platform
1314
runs-on: ubuntu-latest
1415
steps:
15-
- name: Checkout
16-
uses: actions/checkout@v4
17-
- name: Mount bazel caches
18-
uses: actions/cache@v4
19-
with:
20-
path: |
21-
~/.cache/bazel
22-
~/.cache/bazel-repo
23-
key: bazel-cache-release-${{ hashFiles('.bazelrc', '.bazelversion', '.bazeliskrc', '**/BUILD', '**/BUILD.bazel', '**/*.bzl', 'WORKSPACE', 'WORKSPACE.bazel', 'WORKSPACE.bzlmod', 'MODULE.bazel') }}
24-
restore-keys: bazel-cache-release-
25-
- name: bazel test //... (release)
16+
- uses: actions/checkout@v4
17+
- name: Build Go Binaries
2618
env:
27-
# Bazelisk will download bazel to here
28-
XDG_CACHE_HOME: ~/.cache/bazel-repo
29-
run: |
30-
bazel --bazelrc=.aspect/bazelrc/ci.bazelrc \
31-
--bazelrc=.github/workflows/ci.bazelrc \
32-
--bazelrc=.aspect/bazelrc/bazel6.bazelrc \
33-
test --config=local //...
34-
- name: Build release artifacts
19+
# NB: this variable is read by tools/release/copy_release_artifacts.sh
20+
DEST: artifacts
3521
run: |
36-
if [ -n "$(git status --porcelain)" ]; then
37-
>&2 echo "ERROR: the git state is not clean, aborting build..."
38-
exit 1
39-
fi
40-
rm -rf /tmp/aspect/release
41-
bazel --bazelrc=.aspect/bazelrc/ci.bazelrc \
42-
--bazelrc=.github/workflows/ci.bazelrc \
43-
--bazelrc=.aspect/bazelrc/bazel6.bazelrc \
44-
run --config=local //tools/release -- /tmp/aspect/release
22+
rm -rf ${{ env.DEST }}
23+
mkdir -p ${{ env.DEST }}
24+
bazel --bazelrc=.github/workflows/ci.bazelrc \
25+
run --config=release //tools/release:copy_release_artifacts
26+
- uses: actions/upload-artifact@v4
27+
with:
28+
name: artifacts
29+
path: artifacts/
30+
retention-days: 1
31+
32+
release:
33+
needs: build
34+
runs-on: ubuntu-latest
35+
steps:
36+
- uses: actions/checkout@v4
37+
# Fetch the built artifacts from build jobs above and extract into
38+
# ${GITHUB_WORKSPACE}/artifacts/*
39+
- uses: actions/download-artifact@v4
40+
4541
- name: Prepare workspace snippet
46-
run: .github/workflows/release_prep.sh ${{ env.GITHUB_REF_NAME }} > release_notes.txt
47-
- name: Release
48-
uses: softprops/action-gh-release@v1
42+
run: .github/workflows/release_prep.sh > release_notes.txt
43+
44+
- uses: softprops/action-gh-release@v2
4945
with:
5046
# Use GH feature to populate the changelog automatically
5147
generate_release_notes: true
5248
files: |
53-
/tmp/aspect/release/*
49+
artifacts/*
5450
bazel-lib-*.tar.gz
5551
body_path: release_notes.txt
5652
fail_on_unmatched_files: true

‎.github/workflows/release_prep.sh

+29-1
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,37 @@ TAG=${GITHUB_REF_NAME}
1010
# with minimal differences in their code (e.g. strip_prefix remains the same)
1111
PREFIX="bazel-lib-${TAG:1}"
1212
ARCHIVE="bazel-lib-$TAG.tar.gz"
13+
ARCHIVE_TMP=$(mktemp)
1314

1415
# NB: configuration for 'git archive' is in /.gitattributes
15-
git archive --format=tar --prefix=${PREFIX}/ ${TAG} | gzip >$ARCHIVE
16+
git archive --format=tar --prefix=${PREFIX}/ ${TAG} >$ARCHIVE_TMP
17+
18+
############
19+
# Patch up the archive to have integrity hashes for built binaries that we downloaded in the GHA workflow.
20+
# Now that we've run `git archive` we are free to pollute the working directory.
21+
22+
# Delete the placeholder file
23+
tar --file $ARCHIVE_TMP --delete ${PREFIX}/tools/integrity.bzl
24+
25+
mkdir -p ${PREFIX}/tools
26+
cat >${PREFIX}/tools/integrity.bzl <<EOF
27+
"Generated during release by release_prep.sh, using integrity.jq"
28+
29+
RELEASED_BINARY_INTEGRITY = $(
30+
jq \
31+
--from-file .github/workflows/integrity.jq \
32+
--slurp \
33+
--raw-input artifacts/*.sha256
34+
)
35+
EOF
36+
37+
# Append that generated file back into the archive
38+
tar --file $ARCHIVE_TMP --append ${PREFIX}/tools/integrity.bzl
39+
40+
# END patch up the archive
41+
############
42+
43+
gzip <$ARCHIVE_TMP >$ARCHIVE
1644
SHA=$(shasum -a 256 $ARCHIVE | awk '{print $1}')
1745

1846
cat <<EOF

‎e2e/coreutils/md5.txt

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
160e389707f172f2d1333084fec4e650 test.bin
1+
160e389707f172f2d1333084fec4e650 test.bin

‎e2e/coreutils/sha1.txt

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
b3dd96b0db6a12a3ae53899e8fbc04b749c980d6 test.bin
1+
b3dd96b0db6a12a3ae53899e8fbc04b749c980d6 test.bin

‎e2e/coreutils/sha256.txt

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
3285d399e870df47749162ab2ebfd0b727e9142925ab5f5ad221c3a42a852b08 test.bin
1+
3285d399e870df47749162ab2ebfd0b727e9142925ab5f5ad221c3a42a852b08 test.bin

‎lib/private/copy_directory_toolchain.bzl

+5-10
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,7 @@
11
"Setup copy_directory toolchain repositories and rules"
22

33
# https://github.com/aspect-build/bazel-lib/releases
4-
#
5-
# The integrity hashes can be automatically fetched for the latest copy_directory release by running
6-
# `tools/copy_directory/mirror_release.sh`. To calculate for a specific release run
7-
# `tools/copy_directory/mirror_release.sh <release_version>`
8-
9-
load("//tools:integrity.bzl", "COPY_DIRECTORY_INTEGRITY")
4+
load("//tools:integrity.bzl", "RELEASED_BINARY_INTEGRITY")
105
load("//tools:version.bzl", "VERSION")
116

127
# Platform names follow the platform naming convention in @aspect_bazel_lib//:lib/private/repo_utils.bzl
@@ -156,19 +151,19 @@ def _copy_directory_platform_repo_impl(rctx):
156151
is_windows = rctx.attr.platform.startswith("windows_")
157152
meta = COPY_DIRECTORY_PLATFORMS[rctx.attr.platform]
158153
release_platform = meta.release_platform if hasattr(meta, "release_platform") else rctx.attr.platform
154+
release_file = "copy_directory-{}{}".format(release_platform, ".exe" if is_windows else "")
159155

160156
# https://github.com/aspect-build/bazel-lib/releases/download/v1.19.0/copy_directory-linux_amd64
161-
url = "https://github.com/aspect-build/bazel-lib/releases/download/v{0}/copy_directory-{1}{2}".format(
157+
url = "https://github.com/aspect-build/bazel-lib/releases/download/v{}/{}".format(
162158
VERSION,
163-
release_platform,
164-
".exe" if is_windows else "",
159+
release_file,
165160
)
166161

167162
rctx.download(
168163
url = url,
169164
output = "copy_directory.exe" if is_windows else "copy_directory",
170165
executable = True,
171-
integrity = COPY_DIRECTORY_INTEGRITY[release_platform],
166+
integrity = RELEASED_BINARY_INTEGRITY[release_file],
172167
)
173168
build_content = """# @generated by @aspect_bazel_lib//lib/private:copy_directory_toolchain.bzl
174169
load("@aspect_bazel_lib//lib/private:copy_directory_toolchain.bzl", "copy_directory_toolchain")

‎lib/private/copy_to_directory_toolchain.bzl

+5-10
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,7 @@
11
"Setup copy_to_directory toolchain repositories and rules"
22

33
# https://github.com/aspect-build/bazel-lib/releases
4-
#
5-
# The integrity hashes can be automatically fetched for the latest copy_to_directory release by running
6-
# `tools/copy_to_directory/mirror_release.sh`. To calculate for a specific release run
7-
# `tools/copy_to_directory/mirror_release.sh <release_version>`
8-
9-
load("//tools:integrity.bzl", "COPY_TO_DIRECTORY_INTEGRITY")
4+
load("//tools:integrity.bzl", "RELEASED_BINARY_INTEGRITY")
105
load("//tools:version.bzl", "VERSION")
116

127
# Platform names follow the platform naming convention in @aspect_bazel_lib//:lib/private/repo_utils.bzl
@@ -156,19 +151,19 @@ def _copy_to_directory_platform_repo_impl(rctx):
156151
is_windows = rctx.attr.platform.startswith("windows_")
157152
meta = COPY_TO_DIRECTORY_PLATFORMS[rctx.attr.platform]
158153
release_platform = meta.release_platform if hasattr(meta, "release_platform") else rctx.attr.platform
154+
release_file = "copy_to_directory-{}{}".format(release_platform, ".exe" if is_windows else "")
159155

160156
# https://github.com/aspect-build/bazel-lib/releases/download/v1.19.0/copy_to_directory-linux_amd64
161-
url = "https://github.com/aspect-build/bazel-lib/releases/download/v{0}/copy_to_directory-{1}{2}".format(
157+
url = "https://github.com/aspect-build/bazel-lib/releases/download/v{}/{}".format(
162158
VERSION,
163-
release_platform,
164-
".exe" if is_windows else "",
159+
release_file,
165160
)
166161

167162
rctx.download(
168163
url = url,
169164
output = "copy_to_directory.exe" if is_windows else "copy_to_directory",
170165
executable = True,
171-
integrity = COPY_TO_DIRECTORY_INTEGRITY[release_platform],
166+
integrity = RELEASED_BINARY_INTEGRITY[release_file],
172167
)
173168
build_content = """# @generated by @aspect_bazel_lib//lib/private:copy_to_directory_toolchain.bzl
174169
load("@aspect_bazel_lib//lib/private:copy_to_directory_toolchain.bzl", "copy_to_directory_toolchain")

‎lib/private/expand_template_toolchain.bzl

+5-10
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,7 @@
11
"Setup expand_template toolchain repositories and rules"
22

33
# https://github.com/aspect-build/bazel-lib/releases
4-
#
5-
# The integrity hashes can be automatically fetched for the latest expand_template release by running
6-
# `tools/expand_template/mirror_release.sh`. To calculate for a specific release run
7-
# `tools/expand_template/mirror_release.sh <release_version>`
8-
9-
load("//tools:integrity.bzl", "EXPAND_TEMPLATE_INTEGRITY")
4+
load("//tools:integrity.bzl", "RELEASED_BINARY_INTEGRITY")
105
load("//tools:version.bzl", "VERSION")
116

127
# Platform names follow the platform naming convention in @aspect_bazel_lib//:lib/private/repo_utils.bzl
@@ -156,19 +151,19 @@ def _expand_template_platform_repo_impl(rctx):
156151
is_windows = rctx.attr.platform.startswith("windows_")
157152
meta = EXPAND_TEMPLATE_PLATFORMS[rctx.attr.platform]
158153
release_platform = meta.release_platform if hasattr(meta, "release_platform") else rctx.attr.platform
154+
release_file = "expand_template-{}{}".format(release_platform, ".exe" if is_windows else "")
159155

160156
# https://github.com/aspect-build/bazel-lib/releases/download/v1.19.0/expand_template-linux_amd64
161-
url = "https://github.com/aspect-build/bazel-lib/releases/download/v{0}/expand_template-{1}{2}".format(
157+
url = "https://github.com/aspect-build/bazel-lib/releases/download/v{}/{}".format(
162158
VERSION,
163-
release_platform,
164-
".exe" if is_windows else "",
159+
release_file,
165160
)
166161

167162
rctx.download(
168163
url = url,
169164
output = "expand_template.exe" if is_windows else "expand_template",
170165
executable = True,
171-
integrity = EXPAND_TEMPLATE_INTEGRITY[release_platform],
166+
integrity = RELEASED_BINARY_INTEGRITY[release_file],
172167
)
173168
build_content = """# @generated by @aspect_bazel_lib//lib/private:expand_template_toolchain.bzl
174169
load("@aspect_bazel_lib//lib/private:expand_template_toolchain.bzl", "expand_template_toolchain")

‎lib/tests/run_binary_expansions/expansions_golden

+9-9
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
1-
bazel-out/PLATFORM-opt/bin/lib/tests/run_binary_expansions/expansions_out
2-
bazel-out/PLATFORM-opt/bin/lib/tests/run_binary_expansions
1+
bazel-out/PLATFORM-fastbuild/bin/lib/tests/run_binary_expansions/expansions_out
2+
bazel-out/PLATFORM-fastbuild/bin/lib/tests/run_binary_expansions
33
lib/tests/run_binary_expansions/src_1
44
lib/tests/run_binary_expansions/src_1
5-
bazel-out/PLATFORM-opt/bin/lib/tests/run_binary_expansions/src_1
6-
bazel-out/PLATFORM-opt/bin/lib/tests/run_binary_expansions/src_1
5+
bazel-out/PLATFORM-fastbuild/bin/lib/tests/run_binary_expansions/src_1
6+
bazel-out/PLATFORM-fastbuild/bin/lib/tests/run_binary_expansions/src_1
77
aspect_bazel_lib/lib/tests/run_binary_expansions/src_1
88
aspect_bazel_lib/lib/tests/run_binary_expansions/src_1
9-
bazel-out/PLATFORM-opt/bin/lib/tests/run_binary_expansions/src_1
10-
bazel-out/PLATFORM-opt/bin/lib/tests/run_binary_expansions/src_1
11-
opt
12-
bazel-out/PLATFORM-opt/bin
13-
bazel-out/PLATFORM-opt/bin
9+
bazel-out/PLATFORM-fastbuild/bin/lib/tests/run_binary_expansions/src_1
10+
bazel-out/PLATFORM-fastbuild/bin/lib/tests/run_binary_expansions/src_1
11+
fastbuild
12+
bazel-out/PLATFORM-fastbuild/bin
13+
bazel-out/PLATFORM-fastbuild/bin
1414
PLATFORM
1515
lib/tests/run_binary_expansions/BUILD.bazel
1616
bazel-out/volatile-status.txt

‎lib/tests/run_binary_expansions/expansions_golden_bzlmod

+9-9
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
1-
bazel-out/PLATFORM-opt/bin/lib/tests/run_binary_expansions/expansions_out
2-
bazel-out/PLATFORM-opt/bin/lib/tests/run_binary_expansions
1+
bazel-out/PLATFORM-fastbuild/bin/lib/tests/run_binary_expansions/expansions_out
2+
bazel-out/PLATFORM-fastbuild/bin/lib/tests/run_binary_expansions
33
lib/tests/run_binary_expansions/src_1
44
lib/tests/run_binary_expansions/src_1
5-
bazel-out/PLATFORM-opt/bin/lib/tests/run_binary_expansions/src_1
6-
bazel-out/PLATFORM-opt/bin/lib/tests/run_binary_expansions/src_1
5+
bazel-out/PLATFORM-fastbuild/bin/lib/tests/run_binary_expansions/src_1
6+
bazel-out/PLATFORM-fastbuild/bin/lib/tests/run_binary_expansions/src_1
77
_main/lib/tests/run_binary_expansions/src_1
88
_main/lib/tests/run_binary_expansions/src_1
9-
bazel-out/PLATFORM-opt/bin/lib/tests/run_binary_expansions/src_1
10-
bazel-out/PLATFORM-opt/bin/lib/tests/run_binary_expansions/src_1
11-
opt
12-
bazel-out/PLATFORM-opt/bin
13-
bazel-out/PLATFORM-opt/bin
9+
bazel-out/PLATFORM-fastbuild/bin/lib/tests/run_binary_expansions/src_1
10+
bazel-out/PLATFORM-fastbuild/bin/lib/tests/run_binary_expansions/src_1
11+
fastbuild
12+
bazel-out/PLATFORM-fastbuild/bin
13+
bazel-out/PLATFORM-fastbuild/bin
1414
PLATFORM
1515
lib/tests/run_binary_expansions/BUILD.bazel
1616
bazel-out/volatile-status.txt

‎tools/BUILD.bazel

-15
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,4 @@
11
load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
2-
load("//lib:utils.bzl", "is_bazel_6_or_greater")
3-
load("//lib:write_source_files.bzl", "write_source_files")
4-
5-
exports_files([
6-
"create_release.sh",
7-
"create_version.sh",
8-
])
9-
10-
write_source_files(
11-
name = "releases_versions_check_in",
12-
files = {
13-
"integrity.bzl": "//tools/release:release_versions",
14-
},
15-
tags = (["manual"] if not is_bazel_6_or_greater() else []),
16-
)
172

183
bzl_library(
194
name = "integrity",

‎tools/integrity.bzl

+8-24
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,10 @@
1-
"AUTO GENERATED. DO NOT EDIT"
1+
"""Release binary integrity hashes.
22
3-
COPY_DIRECTORY_INTEGRITY = {
4-
"darwin_amd64": "sha256-EH6Qpf/IzIaGncigN+cMc2xCb0C3XuV8I4cUBtaZ7GE=",
5-
"darwin_arm64": "sha256-DH2vl4k0MSyp+lnvfiiOu0ifc+tZSgJUIOFthSOMMvg=",
6-
"freebsd_amd64": "sha256-ogXy1bGEMB4EnuF606H1Vi0h77B3xg+9rSnghDHyVEw=",
7-
"linux_amd64": "sha256-QGFIoivc0z92barkw/JL4LbggV89nmCfsRkDK7fz4gY=",
8-
"linux_arm64": "sha256-lSUkiCmhQaSxPNDaW8Ny+cipW1fcvNogX5Ex3zN1784=",
9-
"windows_amd64": "sha256-ioAUxcSJhMRG7tghZRDH/WjATUEUjVyNN1Cs2BAozJs=",
10-
}
11-
COPY_TO_DIRECTORY_INTEGRITY = {
12-
"darwin_amd64": "sha256-u2pIpD+qv/C58iLcJ0pfDs9U8kM2dIMMVW3YYTiRaBA=",
13-
"darwin_arm64": "sha256-esM3e/Zez9ynrIhjgwq85ZEOd3KT9TZsDgsGuxIrNHw=",
14-
"freebsd_amd64": "sha256-fJpbdVvTSwUfyGtngmaLeppFKdyw9BjFS0G/bYT8ZaY=",
15-
"linux_amd64": "sha256-EoFMz8FEZIOSoUizTKnEQikrevmUwSw+JvPUidxAYa4=",
16-
"linux_arm64": "sha256-+5u2Pz57OK64RDA4JDsvUnIkJUXkH4CfgCA3bx3vUPc=",
17-
"windows_amd64": "sha256-nLybvOhMDWUw+2OyjfaFzmn08IwpO1tF80KwP2rrAPs=",
18-
}
19-
EXPAND_TEMPLATE_INTEGRITY = {
20-
"darwin_amd64": "sha256-pu46U2pS+Sw54B1Bx0OBKvztzBBwnxLQp5fstbrx+To=",
21-
"darwin_arm64": "sha256-wn39/0aGKGd6O6ZCZJnVIPwuScDieELUwrhRITHSPJU=",
22-
"freebsd_amd64": "sha256-5q9RKZAyoxJiwD1dyjeAmo0g/sMVWM4m//DkmkJIZQo=",
23-
"linux_amd64": "sha256-fuHVMGdTm9Ubfk5yufvGbV4g7d9dXUQqUu1kAiawmB4=",
24-
"linux_arm64": "sha256-TLZIWcAB/YvXDM0RSGS/i7mO9ZadAiJ+uByX11uyJeI=",
25-
"windows_amd64": "sha256-rhF8EkJ1y/3Hp/dKZwTJ3HtVPV+B6uqmtkhjUNFQRXA=",
3+
This file contents are entirely replaced during release publishing.
4+
The checked in content is only here to allow load() statements in the sources to resolve.
5+
"""
6+
7+
RELEASED_BINARY_INTEGRITY = {
8+
"copy_directory-darwin_amd64": "sha256-EH6Qpf/IzIaGncigN+cMc2xCb0C3XuV8I4cUBtaZ7GE=",
9+
# ...etc
2610
}

0 commit comments

Comments
 (0)