bzr 0.3.0

A CLI for Bugzilla, inspired by gh
Documentation
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
name: Release

on:
  push:
    tags: ['v*']

permissions: read-all

env:
  CARGO_TERM_COLOR: always

jobs:
  # Preflight runs before any side-effecting work (build, package, attest,
  # release upload, crates.io publish, Homebrew tap bump). It enforces the
  # RELEASING.md policy that Cargo.toml's version exactly matches the tag,
  # including any prerelease suffix. If this fails the rest of the workflow
  # is skipped and no GitHub Release is created -- the operator can delete
  # the bad tag, fix Cargo.toml, and re-tag.
  preflight:
    name: Verify tag matches Cargo.toml
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
      - name: Compare tag with Cargo.toml version
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          cargo_version="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n 1)"
          tag_version="${TAG#v}"
          echo "tag (no v): $tag_version"
          echo "Cargo.toml: $cargo_version"
          if [ "$cargo_version" != "$tag_version" ]; then
            echo "::error::tag/Cargo.toml mismatch -- bump Cargo.toml to match the tag (RELEASING.md step 1)"
            exit 1
          fi
          echo "version alignment: OK"

  manpages:
    name: Generate manpages
    needs: preflight
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4  # v2
        with:
          key: manpages
      - name: Generate manpages
        run: cargo run -p xtask --no-default-features --release --locked -- man --out man/man1
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
        with:
          name: bzr-manpages
          path: man/man1/*.1
          if-no-files-found: error

  build:
    name: Build ${{ matrix.target }}
    needs: manpages
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
      id-token: write       # OIDC token for keyless Sigstore signing
      attestations: write   # publish SLSA build provenance
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            use_cross: false
            archive: tar.gz
            pkg_deb: true
            pkg_rpm: true
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            use_cross: true
            archive: tar.gz
            pkg_deb: true
            pkg_rpm: true
          - target: powerpc64le-unknown-linux-gnu
            os: ubuntu-latest
            use_cross: false
            use_qemu: true
            archive: tar.gz
            pkg_deb: true
            pkg_rpm: true
          - target: s390x-unknown-linux-gnu
            os: ubuntu-latest
            use_cross: true
            archive: tar.gz
            # .deb skipped: Debian s390x audience is effectively zero.
            pkg_deb: false
            pkg_rpm: true
          - target: aarch64-apple-darwin
            os: macos-14
            use_cross: false
            archive: tar.gz
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            use_cross: false
            archive: zip
          - target: aarch64-pc-windows-msvc
            os: windows-latest
            use_cross: false
            archive: zip
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6

      - name: Install libdbus-1-dev (native Linux)
        if: matrix.target == 'x86_64-unknown-linux-gnu'
        run: sudo apt-get update && sudo apt-get install -y libdbus-1-dev pkg-config

      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
        with:
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4  # v2
        with:
          key: ${{ matrix.target }}

      - name: Set up QEMU
        if: matrix.use_qemu
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a  # v4

      - name: Install cross
        if: matrix.use_cross
        run: cargo install cross --locked

      - name: Static CRT link (Windows)
        if: contains(matrix.target, 'windows-msvc')
        shell: bash
        run: echo "RUSTFLAGS=-C target-feature=+crt-static" >> "$GITHUB_ENV"

      - name: Build
        env:
          # pkg-config refuses to cross-compile by default; Cross.toml
          # installs target-arch libdbus via multiarch inside the cross
          # images, and this tells pkg-config to honour the resulting
          # target `.pc` files.
          PKG_CONFIG_ALLOW_CROSS: "1"
        run: |
          if [ "${{ matrix.use_qemu }}" = "true" ]; then
            # Use the latest stable Rust image so the container's rustc tracks
            # `dtolnay/rust-toolchain@stable` used by the rest of the matrix.
            # A pinned older image (e.g. rust:1.85-bookworm) silently breaks
            # whenever Cargo.toml's `rust-version` advances.
            docker run --rm --platform linux/ppc64le \
              -v "${{ github.workspace }}:/workspace" -w /workspace \
              rust:bookworm \
              bash -c "apt-get update && apt-get install -y libdbus-1-dev pkg-config && cargo build --release --locked --target ${{ matrix.target }}"
            # The container ran as root and left target/ owned by root.
            # Subsequent host-side steps (cargo deb / cargo generate-rpm /
            # tarball staging / lintian) run as the runner user and would
            # otherwise hit "Permission denied" on target/.
            sudo chown -R "$(id -u):$(id -g)" target
          elif [ "${{ matrix.use_cross }}" = "true" ]; then
            cross build --release --locked --target ${{ matrix.target }}
          else
            cargo build --release --locked --target ${{ matrix.target }}
          fi
        shell: bash

      - name: Download manpages
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
        with:
          name: bzr-manpages
          path: man/man1

      - name: Package (unix)
        if: matrix.archive == 'tar.gz'
        run: |
          STAGING="bzr-${{ github.ref_name }}-${{ matrix.target }}"
          mkdir "$STAGING"
          cp "target/${{ matrix.target }}/release/bzr" "$STAGING/"
          cp LICENSE README.md "$STAGING/"
          mkdir -p "$STAGING/man/man1"
          cp man/man1/*.1 "$STAGING/man/man1/"
          tar czf "$STAGING.tar.gz" "$STAGING"
        shell: bash

      - name: Package (windows)
        if: matrix.archive == 'zip'
        run: |
          $STAGING = "bzr-${{ github.ref_name }}-${{ matrix.target }}"
          New-Item -ItemType Directory -Path $STAGING
          Copy-Item "target\${{ matrix.target }}\release\bzr.exe" "$STAGING\"
          Copy-Item LICENSE, README.md "$STAGING\"
          New-Item -ItemType Directory -Path "$STAGING\man\man1"
          Copy-Item "man\man1\*.1" "$STAGING\man\man1\"
          Compress-Archive -Path $STAGING -DestinationPath "$STAGING.zip"
        shell: pwsh

      - name: Install cargo-deb
        if: matrix.pkg_deb
        uses: taiki-e/install-action@49ba71bf46962339e6e5c0a7a4ec3ed4c8af28ac
        with:
          tool: cargo-deb

      - name: Install cargo-generate-rpm
        if: matrix.pkg_rpm
        uses: taiki-e/install-action@49ba71bf46962339e6e5c0a7a4ec3ed4c8af28ac
        with:
          tool: cargo-generate-rpm

      - name: Build .deb
        if: matrix.pkg_deb
        run: cargo deb --no-build --no-strip --target ${{ matrix.target }}
        shell: bash

      - name: Build .rpm
        if: matrix.pkg_rpm
        shell: bash
        run: |
          # RPM's Version field disallows '-' (it separates the package's
          # Version from its Release in NVR notation), so 0.2.0-rc6 is a
          # hard error from cargo-generate-rpm. Translate the prerelease
          # suffix to '~', which RPM accepts and which sorts correctly:
          # 0.2.0~rc6 < 0.2.0 < 0.2.0~rc7. cargo-deb (run earlier in this
          # job) accepts the hyphen form and is unaffected; this rewrite
          # only persists for the rest of the cross-compile job in CI.
          sed -i 's/^version = "\([^-"]*\)-\(.*\)"/version = "\1~\2"/' Cargo.toml
          cargo generate-rpm --target ${{ matrix.target }}

      - name: Stage packages alongside tarball
        if: matrix.pkg_deb || matrix.pkg_rpm
        run: |
          set -euo pipefail
          if [ "${{ matrix.pkg_deb }}" = "true" ]; then
            cp target/${{ matrix.target }}/debian/*.deb .
          fi
          if [ "${{ matrix.pkg_rpm }}" = "true" ]; then
            cp target/${{ matrix.target }}/generate-rpm/*.rpm .
          fi
        shell: bash

      - name: Lint .deb (warn-only)
        if: matrix.pkg_deb
        continue-on-error: true
        run: |
          sudo apt-get update && sudo apt-get install -y lintian
          lintian --no-tag-display-limit *.deb || true
        shell: bash

      - name: Lint .rpm (warn-only)
        if: matrix.pkg_rpm
        continue-on-error: true
        run: |
          sudo apt-get update && sudo apt-get install -y rpmlint
          rpmlint *.rpm || true
        shell: bash

      - name: Install-test .deb (x86_64 only)
        if: matrix.target == 'x86_64-unknown-linux-gnu' && matrix.pkg_deb
        run: |
          docker run --rm -v "$PWD:/pkg" -w /pkg debian:stable bash -c '
            apt-get update && apt-get install -y ./*.deb && bzr --version'
        shell: bash

      - name: Install-test .rpm (x86_64 only)
        if: matrix.target == 'x86_64-unknown-linux-gnu' && matrix.pkg_rpm
        run: |
          docker run --rm -v "$PWD:/pkg" -w /pkg fedora:latest bash -c '
            dnf install -y ./*.rpm && bzr --version'
        shell: bash

      - name: Attest build provenance
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4
        with:
          subject-path: |
            bzr-${{ github.ref_name }}-${{ matrix.target }}.${{ matrix.archive }}
            *.deb
            *.rpm

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
        with:
          name: bzr-${{ matrix.target }}
          path: |
            bzr-${{ github.ref_name }}-${{ matrix.target }}.*
            *.deb
            *.rpm

  release:
    name: Create Release
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
        with:
          path: artifacts
          # Match per-target artifacts (e.g. bzr-x86_64-pc-windows-msvc) but
          # exclude bzr-manpages, which is an internal artifact consumed by
          # the build matrix and must not appear on the release page.
          pattern: bzr-*-*
          merge-multiple: true

      - name: Stage installer scripts (with version baked in)
        working-directory: artifacts
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          python3 - <<'PYEOF'
          import os, pathlib
          tag = os.environ["TAG"]

          sh_marker = 'BZR_VERSION="${BZR_VERSION:-}"'
          sh_replace = 'BZR_VERSION="${BZR_VERSION:-' + tag + '}"'
          sh_in = pathlib.Path("../install.sh").read_text()
          sh_out = sh_in.replace(sh_marker, sh_replace, 1)
          assert sh_out != sh_in, f"install.sh marker line not found: {sh_marker!r}"
          pathlib.Path("install.sh").write_text(sh_out)

          ps_marker = "$BzrVersion = $env:BZR_VERSION"
          ps_replace = (
              "$BzrVersion = if ($env:BZR_VERSION) "
              "{ $env:BZR_VERSION } else { '" + tag + "' }"
          )
          ps_in = pathlib.Path("../install.ps1").read_text()
          ps_out = ps_in.replace(ps_marker, ps_replace, 1)
          assert ps_out != ps_in, f"install.ps1 marker line not found: {ps_marker!r}"
          pathlib.Path("install.ps1").write_text(ps_out)
          PYEOF
          chmod +x install.sh

      - name: Generate SHA256SUMS
        working-directory: artifacts
        run: |
          set -euo pipefail
          # Hash every release artifact (tarballs, zips, .deb, .rpm).
          # Sorted, LF-only output so reproducible across re-runs of the
          # same set of inputs.
          find . -maxdepth 1 -type f ! -name 'SHA256SUMS' -printf '%f\n' \
            | sort \
            | xargs -d '\n' sha256sum \
            > SHA256SUMS
          echo "Generated SHA256SUMS:"
          cat SHA256SUMS

      - name: Extract release notes from CHANGELOG.md
        id: notes
        shell: bash
        run: |
          set -euo pipefail
          TAG="${{ github.ref_name }}"
          VERSION="${TAG#v}"
          NOTES_FILE="$(mktemp)"
          awk -v v="$VERSION" '
            $0 ~ "^## \\[" v "\\]" { capture = 1; next }
            capture && /^## \[/      { exit }
            capture                  { print }
          ' CHANGELOG.md > "$NOTES_FILE"
          if ! [ -s "$NOTES_FILE" ]; then
            echo "::error::No CHANGELOG.md entry found for [$VERSION]"
            exit 1
          fi
          echo "notes_file=$NOTES_FILE" >> "$GITHUB_OUTPUT"

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          PRERELEASE=""
          if [[ "$GITHUB_REF_NAME" == *-* ]]; then
            PRERELEASE="--prerelease"
          fi
          gh release create "$GITHUB_REF_NAME" \
            --title "bzr $GITHUB_REF_NAME" \
            --notes-file "${{ steps.notes.outputs.notes_file }}" \
            $PRERELEASE \
            artifacts/*

  installer-smoke:
    name: Installer smoke ${{ matrix.os }}
    needs: release
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
    steps:
      # Check out so we can read Cargo.toml's version field. Cargo.toml is the
      # source of truth for what `bzr --version` prints, so the smoke check
      # validates the installed binary's output against it. This is robust
      # whether or not the project carries an rc suffix in Cargo.toml across
      # the rc cycle.
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6

      # The tag-vs-Cargo.toml check is enforced by the `preflight` job before
      # any build runs, so we don't repeat it here. This step verifies the
      # downloaded binary's --version output matches Cargo.toml at the tagged
      # commit -- catches a stale build artifact (Cargo.toml bumped post-build).
      - name: Smoke install.sh
        if: matrix.os == 'ubuntu-latest'
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          export BZR_INSTALL_DIR="$HOME/.local/bin"
          curl -fsSL "https://github.com/randomparity/bzr/releases/download/${TAG}/install.sh" | sh
          installed_version="$("$BZR_INSTALL_DIR/bzr" --version 2>&1)"
          expected="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n 1)"
          echo "installed: $installed_version"
          echo "expected:  $expected"
          case "$installed_version" in
            *"$expected"*) echo "binary version: OK" ;;
            *) echo "binary mismatch: expected=$expected output=$installed_version" >&2; exit 1 ;;
          esac
        shell: bash

      - name: Smoke install.ps1
        if: matrix.os == 'windows-latest'
        env:
          TAG: ${{ github.ref_name }}
        shell: pwsh
        run: |
          $env:BZR_INSTALL_DIR = Join-Path $env:LOCALAPPDATA 'Programs\bzr'
          irm "https://github.com/randomparity/bzr/releases/download/$env:TAG/install.ps1" | iex
          $installed = & (Join-Path $env:BZR_INSTALL_DIR 'bzr.exe') --version
          $expected = (Select-String -Path Cargo.toml -Pattern '^version = "(.*)"' |
                       Select-Object -First 1).Matches[0].Groups[1].Value
          Write-Host "installed: $installed"
          Write-Host "expected:  $expected"
          if ($installed -notlike "*$expected*") {
              Write-Error "binary mismatch: expected=$expected output=$installed"
              exit 1
          }
          Write-Host "binary version: OK"

  # Bump randomparity/homebrew-tap on stable releases. This used to be a
  # separate workflow triggered by `release: published`, but the release
  # event from a GITHUB_TOKEN-authenticated `gh release create` does not
  # fire downstream workflows (well-known GH Actions safeguard against
  # workflow recursion), so the bump never ran for v0.2.0. Folding the
  # logic into release.yml as a job that depends on `release` removes the
  # event-cascade dependency entirely.
  homebrew:
    name: Bump randomparity/homebrew-tap
    needs: release
    if: ${{ !contains(github.ref_name, '-') }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout bzr (for template)
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6

      - name: Checkout tap
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
        with:
          repository: randomparity/homebrew-tap
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
          path: tap

      - name: Render formula
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          VERSION="${TAG#v}"
          BASE="https://github.com/randomparity/bzr/releases/download/${TAG}"

          fetch_sha() {
            curl --fail --silent --show-error --location "$1" | sha256sum | awk '{print $1}'
          }

          MAC_ARM_SHA=$(fetch_sha   "${BASE}/bzr-${TAG}-aarch64-apple-darwin.tar.gz")
          LINUX_ARM_SHA=$(fetch_sha "${BASE}/bzr-${TAG}-aarch64-unknown-linux-gnu.tar.gz")
          LINUX_INTEL_SHA=$(fetch_sha "${BASE}/bzr-${TAG}-x86_64-unknown-linux-gnu.tar.gz")
          SRC_SHA=$(fetch_sha       "https://github.com/randomparity/bzr/archive/refs/tags/${TAG}.tar.gz")

          mkdir -p tap/Formula
          sed \
            -e "s|{{VERSION}}|${VERSION}|g" \
            -e "s|{{MAC_ARM_SHA}}|${MAC_ARM_SHA}|g" \
            -e "s|{{LINUX_ARM_SHA}}|${LINUX_ARM_SHA}|g" \
            -e "s|{{LINUX_INTEL_SHA}}|${LINUX_INTEL_SHA}|g" \
            -e "s|{{SRC_SHA}}|${SRC_SHA}|g" \
            homebrew/bzr.rb.template > tap/Formula/bzr.rb

      - name: Commit and push
        working-directory: tap
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add Formula/bzr.rb
          if git diff --staged --quiet; then
            echo "Formula already up-to-date for ${TAG}; nothing to commit."
            exit 0
          fi
          git commit -m "bzr ${TAG#v}"
          git push