Reconcile no-Actions local release workflow with accepted Hop implementation

Hop-State: A_06FN5GEZTNDD5V7A7PXHBR0 Hop-Proposal: R_06FN5GDDA8WVH1V6JW0FBY0 Hop-Task: T_06FN3MBF98GWD4NA5PA1RWG Hop-Attempt: AT_06FN5FPYNDP5C49S0G52NQG
2026-07-11 12:57:45 -07:00
parent aad987e762
commit 011f6fa102
8 changed files with 156 additions and 158 deletions
@@ -0,0 +1,105 @@
+#!/bin/sh
+set -eu
+
+fail() {
+  printf 'hop release: %s\n' "$*" >&2
+  exit 1
+}
+
+usage() {
+  cat <<'EOF'
+Usage: scripts/release-local.sh --snapshot
+       scripts/release-local.sh --publish
+
+--snapshot  Test and build all release archives locally without uploading.
+--publish   Test, build, and upload a draft release to githop.xyz.
+            Requires a clean signed tag, LICENSE, and GITEA_TOKEN.
+EOF
+}
+
+[ "$#" -eq 1 ] || { usage >&2; exit 2; }
+mode=$1
+case "$mode" in
+  --snapshot | --publish) ;;
+  *) usage >&2; exit 2 ;;
+esac
+
+root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+cd "$root"
+
+for command in curl git go tar; do
+  command -v "$command" >/dev/null 2>&1 || fail "$command is required"
+done
+
+if [ "$mode" = --publish ]; then
+  [ -f LICENSE ] || fail "LICENSE is required before publishing"
+  [ -n "${GITEA_TOKEN:-}" ] || fail "set a scoped GITEA_TOKEN in the local environment"
+  [ -z "$(git status --porcelain)" ] || fail "the Git worktree must be clean"
+  tag=$(git describe --tags --exact-match HEAD 2>/dev/null) ||
+    fail "HEAD must have an exact release tag"
+  case "$tag" in
+    v[0-9]*) ;;
+    *) fail "release tag must start with v followed by a number" ;;
+  esac
+  [ "$(git cat-file -t "$tag")" = tag ] || fail "$tag must be an annotated tag"
+  git verify-tag "$tag" >/dev/null 2>&1 || fail "$tag must have a valid signature"
+  git ls-remote --exit-code origin "refs/tags/$tag" >/dev/null 2>&1 ||
+    fail "$tag must be pushed to origin before publishing"
+fi
+
+printf 'Running local release validation...\n'
+go test -race ./...
+go vet ./...
+sh -n scripts/install.sh
+sh scripts/test-install.sh
+git diff --check
+
+goreleaser_version=2.17.0
+case "$(uname -s)/$(uname -m)" in
+  Darwin/arm64)
+    archive=goreleaser_Darwin_arm64.tar.gz
+    expected=58912a80159199c0fd5c8484e4c868bf87414129655d6d87cd1cd84ee645736c
+    ;;
+  Darwin/x86_64)
+    archive=goreleaser_Darwin_x86_64.tar.gz
+    expected=f37e89fb844ddfd23cffb97e30d91f972c42da68232a676bfba2beacea300543
+    ;;
+  Linux/arm64 | Linux/aarch64)
+    archive=goreleaser_Linux_arm64.tar.gz
+    expected=75f93fc0e25d10d8535ffd0e4abcf39d6784a2467ba453d479ae513729a9ebbf
+    ;;
+  Linux/x86_64 | Linux/amd64)
+    archive=goreleaser_Linux_x86_64.tar.gz
+    expected=dde10e2d5a13cef969c0eec00c74f359c0ac306d702b1bd291ad9337b4e54c1d
+    ;;
+  *) fail "unsupported release host: $(uname -s)/$(uname -m)" ;;
+esac
+
+tmp_dir=$(mktemp -d 2>/dev/null || mktemp -d -t hop-release)
+cleanup() {
+  rm -rf "$tmp_dir"
+}
+trap cleanup EXIT HUP INT TERM
+
+printf 'Downloading verified GoReleaser %s...\n' "$goreleaser_version"
+curl -fsSL --retry 3 --proto '=https' --tlsv1.2 \
+  -o "$tmp_dir/$archive" \
+  "https://github.com/goreleaser/goreleaser/releases/download/v${goreleaser_version}/${archive}"
+if command -v sha256sum >/dev/null 2>&1; then
+  actual=$(sha256sum "$tmp_dir/$archive" | awk '{print $1}')
+elif command -v shasum >/dev/null 2>&1; then
+  actual=$(shasum -a 256 "$tmp_dir/$archive" | awk '{print $1}')
+else
+  fail "sha256sum or shasum is required"
+fi
+[ "$actual" = "$expected" ] || fail "GoReleaser checksum verification failed"
+tar -xzf "$tmp_dir/$archive" -C "$tmp_dir" goreleaser
+
+"$tmp_dir/goreleaser" check
+if [ "$mode" = --snapshot ]; then
+  "$tmp_dir/goreleaser" release --snapshot --clean
+  printf 'Local snapshot complete: %s/dist\n' "$root"
+else
+  "$tmp_dir/goreleaser" release --clean
+  printf 'Draft release uploaded to https://githop.xyz/GnosysLabs/Hop/releases\n'
+fi