release-kit 0.2.2

A canonical release workflow: a technology-agnostic method, per-technology bindings, and the rk CLI that lands and serves them.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

#!/usr/bin/env sh
# Protect the trunk. It takes no direct push: a merge request with a passing
# pipeline is the only way in. This forge's gate is the project setting
# requiring the whole pipeline — it is project-wide and names no check, which
# is why no check name reaches this script. Linear history is the ff merge
# method plus squash on every merge request: the forge that can fast-forward,
# does, so the trunk takes no merge commits; the method's invariants chapter
# owns these facts. Rerunning re-asserts: the protection updates in place
# where the forge allows and is re-created where it does not.
set -eu
: "${RK_REPO:?rk sets this; run this script through rk setup}"
: "${RK_TRUNK_BRANCH:?rk sets this; run this script through rk setup}"

project="$(printf '%s' "$RK_REPO" | sed 's|/|%2F|g')"

# The forge CLI may pretty-print JSON; stripping whitespace makes every
# pattern below hold for the compact and the pretty form alike, and no
# value a pattern touches can carry whitespace of its own.
compact() { tr -d ' \t\r\n'; }

if glab api "projects/$project/protected_branches/$RK_TRUNK_BRANCH" >/dev/null 2>&1; then
  # Access levels are fixed at creation, so an update that must change them
  # is delete-then-create; allow_force_push alone patches in place.
  current="$(glab api "projects/$project/protected_branches/$RK_TRUNK_BRANCH" | compact)"
  levels="$(printf '%s' "$current" | grep -o '"push_access_levels":\[[^]]*\]' || true)"
  merge_levels="$(printf '%s' "$current" | grep -o '"merge_access_levels":\[[^]]*\]' || true)"
  # Exactly one push grant at the no-access entry, and exactly one merge
  # grant at maintainer level: the forge takes the most permissive grant, so
  # a second push entry is a branch that still takes a direct push, and a
  # merge level of 0 keeps every release request unmergeable.
  grants="$(printf '%s' "$levels" | grep -o '{' | grep -c . || true)"
  merge_grants="$(printf '%s' "$merge_levels" | grep -o '{' | grep -c . || true)"
  if [ "$grants" = "1" ] && printf '%s' "$levels" | grep -q '"access_level":0' \
    && [ "$merge_grants" = "1" ] && printf '%s' "$merge_levels" | grep -q '"access_level":40'; then
    glab api -X PATCH "projects/$project/protected_branches/$RK_TRUNK_BRANCH" \
      -F allow_force_push=false >/dev/null
  else
    glab api -X DELETE "projects/$project/protected_branches/$RK_TRUNK_BRANCH" >/dev/null
    glab api -X POST "projects/$project/protected_branches" \
      -f "name=$RK_TRUNK_BRANCH" -F push_access_level=0 -F merge_access_level=40 \
      -F allow_force_push=false >/dev/null
  fi
else
  glab api -X POST "projects/$project/protected_branches" \
    -f "name=$RK_TRUNK_BRANCH" -F push_access_level=0 -F merge_access_level=40 \
    -F allow_force_push=false >/dev/null
fi

# The squash template is asserted, not assumed: %{title} is this forge's
# documented default, and asserting it keeps the trunk's commit message the
# merge request's title even where a project once set something else.
glab api -X PUT "projects/$project" \
  -F only_allow_merge_if_pipeline_succeeds=true -f merge_method=ff -f squash_option=always \
  -f 'squash_commit_template=%{title}' >/dev/null

echo "check: prints the protection, the pipeline requirement, the merge method, the squash setting, and the squash template"
glab api "projects/$project/protected_branches/$RK_TRUNK_BRANCH" | compact | grep -o "\"name\":\"$RK_TRUNK_BRANCH\""
glab api "projects/$project" | compact | grep -o '"only_allow_merge_if_pipeline_succeeds":[a-z]*'
glab api "projects/$project" | compact | grep -o '"merge_method":"[^"]*"'
glab api "projects/$project" | compact | grep -o '"squash_option":"[^"]*"'
glab api "projects/$project" | compact | grep -o '"squash_commit_template":"[^"]*"'