70 lines
2.6 KiB
Bash
Executable File
70 lines
2.6 KiB
Bash
Executable File
#!/bin/sh
|
|
# Trigger the GitHub "Release candidate" workflow on main and download
|
|
# all artifacts. Needs the gh CLI, authenticated (gh auth login).
|
|
# If a parameter is provided, it will be used as the download path,
|
|
# by default, 'artifacts'.
|
|
set -eu
|
|
repo=jgm/pandoc
|
|
workflow=release-candidate.yml
|
|
ref=main
|
|
artifacts="${1:-artifacts}"
|
|
|
|
# Cancel any release candidate runs that are still queued or in progress.
|
|
for r in $(gh run list -R "$repo" --workflow "$workflow" -L 50 \
|
|
--json databaseId,status \
|
|
--jq '.[] | select(.status != "completed") | .databaseId'); do
|
|
echo "Canceling run $r"
|
|
gh run cancel "$r" -R "$repo" || true
|
|
done
|
|
|
|
start=$(date -u +%Y-%m-%dT%H:%M:%SZ)
|
|
gh workflow run "$workflow" -R "$repo" --ref "$ref"
|
|
|
|
# The dispatch doesn't return a run id; wait for the new run to show up.
|
|
while :; do
|
|
sleep 10
|
|
run=$(gh run list -R "$repo" --workflow "$workflow" --branch "$ref" \
|
|
--event workflow_dispatch -L 1 --json databaseId,createdAt \
|
|
--jq ".[] | select(.createdAt >= \"$start\") | .databaseId")
|
|
[ -n "$run" ] && break
|
|
done
|
|
echo "Run $run started: https://github.com/$repo/actions/runs/$run"
|
|
|
|
# Once the unsigned Windows artifact appears, signing is waiting on
|
|
# approval in SignPath; send a macOS notification.
|
|
(
|
|
while :; do
|
|
sleep 60
|
|
if gh api "repos/$repo/actions/runs/$run/artifacts" --paginate \
|
|
--jq '.artifacts[].name' 2>/dev/null |
|
|
grep -qx 'windows-release-candidate-unsigned'; then
|
|
osascript -e 'display notification "SignPath is awaiting approval of the Windows package signing." with title "pandoc release candidate"'
|
|
break
|
|
fi
|
|
done
|
|
) &
|
|
notifier=$!
|
|
# Make sure the notifier is killed however the script exits. Background
|
|
# jobs in a non-interactive shell ignore SIGINT, so Ctrl-C won't reach it.
|
|
trap 'kill "$notifier" 2>/dev/null || true' EXIT
|
|
trap 'exit 130' INT
|
|
trap 'exit 143' TERM
|
|
trap 'exit 129' HUP
|
|
|
|
# Wait for the run to finish; download artifacts even if a job failed.
|
|
status=0
|
|
gh run watch "$run" -R "$repo" -i 60 --exit-status >/dev/null || status=$?
|
|
kill "$notifier" 2>/dev/null || true
|
|
gh run view "$run" -R "$repo" --json jobs \
|
|
--jq '.jobs[] | "\(.name): \(.conclusion)"'
|
|
|
|
# Skip the intermediate Windows artifacts; only the signed one is wanted.
|
|
mkdir -p "$artifacts"
|
|
for name in $(gh api "repos/$repo/actions/runs/$run/artifacts" --paginate \
|
|
--jq '.artifacts[].name |
|
|
select(test("^windows-release-candidate-(unsigned|to-sign)$") | not)'); do
|
|
rm -f "$artifacts/$name"
|
|
gh run download "$run" -R "$repo" -n "$name" -D "$artifacts" || status=$?
|
|
done
|
|
exit "$status"
|