release-kit 0.2.2

#!/usr/bin/env sh
# Verify the protections are exactly the ones this setup owns, with the
# shapes a release needs, and state what the forge actually enforces rather
# than passing on a claim it cannot meet: tag protection here stops accident,
# not authority, and a check that hides that difference is worse than none.
set -eu
: "${RK_REPO:?rk sets this; run this script through rk setup}"
: "${RK_TRUNK_BRANCH:?rk sets this; run this script through rk setup}"

project="$(printf '%s' "$RK_REPO" | sed 's|/|%2F|g')"

# The forge CLI may pretty-print JSON; stripping whitespace makes every
# pattern below hold for the compact and the pretty form alike, and no
# value a pattern touches can carry whitespace of its own.
compact() { tr -d ' \t\r\n'; }
status=0

assert() {
  label="$1"
  pattern="$2"
  body="$3"
  remedy="$4"
  if printf '%s' "$body" | grep -q "$pattern"; then
    echo "ok $label"
  else
    echo "FAIL $label" >&2
    echo "remediation: $remedy" >&2
    status=1
  fi
}

trunk="$(glab api "projects/$project/protected_branches/$RK_TRUNK_BRANCH" 2>/dev/null | compact || true)"
assert "$RK_TRUNK_BRANCH is protected" "\"name\":\"$RK_TRUNK_BRANCH\"" "$trunk" \
  'rk setup step protect-trunk --apply'
assert "$RK_TRUNK_BRANCH refuses force pushes" '"allow_force_push":false' "$trunk" \
  'rk setup step protect-trunk --apply'
trunk_levels="$(printf '%s' "$trunk" | grep -o '"push_access_levels":\[[^]]*\]' || true)"
trunk_grants="$(printf '%s' "$trunk_levels" | grep -o '{' | grep -c . || true)"
if [ "$trunk_grants" = "1" ] && printf '%s' "$trunk_levels" | grep -q '"access_level":0'; then
  echo "ok $RK_TRUNK_BRANCH takes no direct push"
else
  echo "FAIL $RK_TRUNK_BRANCH takes no direct push: the forge honors the most permissive of $trunk_grants push grants" >&2
  echo 'remediation: rk setup step protect-trunk --apply' >&2
  status=1
fi
trunk_merge_levels="$(printf '%s' "$trunk" | grep -o '"merge_access_levels":\[[^]]*\]' || true)"
trunk_merge_grants="$(printf '%s' "$trunk_merge_levels" | grep -o '{' | grep -c . || true)"
if [ "$trunk_merge_grants" = "1" ] && printf '%s' "$trunk_merge_levels" | grep -q '"access_level":40'; then
  echo "ok $RK_TRUNK_BRANCH merges only through maintainers"
else
  echo "FAIL $RK_TRUNK_BRANCH merge grants: the setup owns exactly one at maintainer level, found $trunk_merge_grants" >&2
  echo 'remediation: rk setup step protect-trunk --apply' >&2
  status=1
fi

settings="$(glab api "projects/$project" | compact)"
assert 'the gate requires the whole pipeline' '"only_allow_merge_if_pipeline_succeeds":true' "$settings" \
  'rk setup step protect-trunk --apply'
assert 'merges fast-forward' '"merge_method":"ff"' "$settings" \
  'rk setup step protect-trunk --apply'
assert 'every merge request squashes' '"squash_option":"always"' "$settings" \
  'rk setup step protect-trunk --apply'

tags="$(glab api "projects/$project/protected_tags/v%2A" 2>/dev/null | compact || true)"
assert 'v* is protected' '"name":"v\*"' "$tags" \
  'rk setup step protect-tags --apply'
echo 'note: tag protection here stops git clients and non-privileged users; an Owner or Maintainer can still delete a protected tag through the UI or API'

# The optional release-line protection: absent is fine, present is owned.
lines="$(glab api "projects/$project/protected_branches/release%2F%2A" 2>/dev/null | compact || true)"
if [ -n "$lines" ]; then
  assert 'release/* refuses force pushes' '"allow_force_push":false' "$lines" \
    'rk setup step protect-release-lines --apply'
fi

[ "$status" -eq 0 ] || exit 1
echo 'ok protections-check'