Publish tagged source zips on release #2

Merged
benvin merged 7 commits from benvin/release-pipeline into main 2026-09-09 23:22:43 +10:00
5 changed files with 146 additions and 3 deletions
+10
View File
@@ -0,0 +1,10 @@
# Kept out of the release archive: it ships to a package path, not a checkout.
.editorconfig export-ignore
.gitattributes export-ignore
.gitignore export-ignore
.luacheckrc export-ignore
.pre-commit-config.yaml export-ignore
.stylua.toml export-ignore
.woodpecker export-ignore
Makefile export-ignore
tests export-ignore
+1
View File
@@ -1 +1,2 @@
doc/tags
dist/
+75
View File
@@ -0,0 +1,75 @@
when:
- event: tag
steps:
- name: test
image: alpine:3.22
commands:
- apk add --no-cache neovim curl unzip tar zip make
- make test
backend_options:
kubernetes:
serviceAccountName: default
resources:
requests:
memory: 512Mi
cpu: 1
limits:
memory: 2Gi
cpu: 2
# A source zip wrapping everything in a single "arti-pack-<version>"
# directory, the shape arti-pack's installer expects from a tag archive.
- name: package
image: alpine:3.22
commands:
- apk add --no-cache git make unzip
- make package VERSION=${CI_COMMIT_TAG}
- make verify-package VERSION=${CI_COMMIT_TAG}
depends_on: [test]
backend_options:
kubernetes:
serviceAccountName: default
resources:
requests:
memory: 128Mi
cpu: 100m
limits:
memory: 512Mi
cpu: 500m
# Publish under the tag-archive path shape so arti-pack installs itself with
# registry ".../api/v2/remotes/nvim-plugins/files" and { 'unkin/arti-pack' }.
- name: publish
image: alpine:3.22
commands:
- apk add --no-cache curl
- |
HOST="https://artifactapi.k8s.syd1.au.unkin.net"
REPO="nvim-plugins"
PATH_IN_REPO="unkin/arti-pack/archive/refs/tags/${CI_COMMIT_TAG}.zip"
ZIP=$$(ls dist/arti-pack-*.zip | head -1)
# Uploads are immutable (409 on overwrite); a re-run of an existing tag
# must not fail the pipeline. artifactapi has no HEAD route, so probe
# with GET.
code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/$$PATH_IN_REPO" || true)
if [ "$$code" = "200" ]; then
echo "$$PATH_IN_REPO already published (HTTP $$code); skipping upload"
exit 0
fi
echo "Uploading $$ZIP to $$REPO/$$PATH_IN_REPO (existence probe returned $$code)"
curl -f -X PUT \
"$$HOST/api/v2/remotes/$$REPO/files/$$PATH_IN_REPO" \
-H "Content-Type: application/zip" \
--data-binary @"$$ZIP"
depends_on: [package]
backend_options:
kubernetes:
serviceAccountName: default
resources:
requests:
memory: 128Mi
cpu: 100m
limits:
memory: 512Mi
cpu: 500m
+42 -1
View File
@@ -1,4 +1,10 @@
.PHONY: test lint fmt pre-commit patch minor major _tag
.PHONY: test lint fmt pre-commit package verify-package patch minor major _tag
VERSION ?= $(shell git describe --tags --always)
# Archive names drop the leading "v", the way tag source archives do.
BARE_VERSION = $(patsubst v%,%,$(VERSION))
DIST = dist
ARCHIVE = $(DIST)/arti-pack-$(BARE_VERSION).zip
test:
nvim --headless -l tests/run.lua
@@ -12,6 +18,41 @@ fmt:
pre-commit:
@uvx pre-commit run --all-files
# The prefix directory is what arti-pack's own extractor strips on install.
package:
@mkdir -p $(DIST)
git archive --format=zip --prefix=arti-pack-$(BARE_VERSION)/ -o $(ARCHIVE) HEAD
@echo $(ARCHIVE)
# Published uploads are immutable, so a malformed archive cannot be replaced at
# its version path. Assert the shape before anything ships.
RUNTIME_PATHS = lua/ plugin/ doc/ README.md
EXCLUDED_PATHS = tests/ .woodpecker/ Makefile .editorconfig .gitattributes \
.gitignore .luacheckrc .pre-commit-config.yaml .stylua.toml
verify-package:
@test -f $(ARCHIVE) || { echo "verify-package: $(ARCHIVE) not built"; exit 1; }
@names=$$(unzip -Z1 $(ARCHIVE)); \
roots=$$(printf '%s\n' "$$names" | cut -d/ -f1 | sort -u); \
if [ "$$(printf '%s\n' "$$roots" | wc -l)" -ne 1 ]; then \
echo "verify-package: expected one top-level directory, found:"; \
printf ' %s\n' $$roots; exit 1; \
fi; \
fail=0; \
printf '%s\n' "$$names" | grep -q "^$$roots/." || \
{ echo "verify-package: top-level $$roots is not a directory"; fail=1; }; \
for p in $(RUNTIME_PATHS); do \
printf '%s\n' "$$names" | grep -q "^$$roots/$$p" || \
{ echo "verify-package: missing runtime path $$p"; fail=1; }; \
done; \
for p in $(EXCLUDED_PATHS); do \
if printf '%s\n' "$$names" | grep -q "^$$roots/$$p"; then \
echo "verify-package: excluded path $$p leaked into the archive"; fail=1; \
fi; \
done; \
[ $$fail -eq 0 ] || exit 1; \
echo "verify-package: $(ARCHIVE) ok, root $$roots"
# Bump helpers — read the latest semver tag and create the next one.
# If no tag exists yet, start from v0.0.0.
_LATEST = $(shell git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$$' | head -1)
+18 -2
View File
@@ -18,13 +18,29 @@ from.
## Install
arti-pack manages itself least awkwardly as a plain clone into the package path:
Each tag is published as a source zip under the same tag-archive path shape
arti-pack expects, so it installs the same way as everything it manages —
mirror it into your own artifact repository and fetch it from there:
```sh
git clone https://git.unkin.net/unkin/arti-pack \
curl -fsSL -o /tmp/arti-pack.zip \
https://artifacts.example.com/artifactory/nvim-plugins/unkin/arti-pack/archive/refs/tags/v0.1.0.zip
mkdir -p "${XDG_DATA_HOME:-$HOME/.local/share}/nvim/site/pack/arti-pack/start"
unzip -q /tmp/arti-pack.zip -d /tmp/arti-pack
mv /tmp/arti-pack/arti-pack-0.1.0 \
"${XDG_DATA_HOME:-$HOME/.local/share}/nvim/site/pack/arti-pack/start/arti-pack"
```
Once installed it can carry itself, since `url` bypasses the registry:
```lua
{
'unkin/arti-pack',
tag = 'v0.1.0',
url = 'https://artifacts.example.com/artifactory/nvim-plugins/unkin/arti-pack/archive/refs/tags/v0.1.0.zip',
}
```
## Usage
```lua