feat: use curl to create release and upload assets (#143)

Reviewed-on: https://code.forgejo.org/actions/forgejo-release/pulls/143
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
Co-committed-by: Michael Kriese <michael.kriese@visualon.de>

.forgejo/workflows/integration.yml

@@ -5,7 +5,7 @@ on:
       - "**"
 
 env:
-  FORGEJO_VERSION: 11.0.10 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo
+  FORGEJO_VERSION: 11.0.10 # renovate: datasource=docker depName=data.forgejo.org/forgejo/forgejo
 
 jobs:
   integration:
@@ -14,7 +14,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - id: forgejo
-        uses: https://code.forgejo.org/actions/setup-forgejo@v3.1.1
+        uses: https://code.forgejo.org/actions/setup-forgejo@v3.1.4
         with:
           user: testuser
           password: admin1234
@@ -48,6 +48,37 @@ jobs:
 
           test $(cat /tmp/v1.json | jq -r .hide_archive_links) = true
 
+      - name: testdata/release-notes-file
+        run: |
+          export LOOP_DELAY=30
+          export FORGEJO_RUNNER_LOGS="${{ steps.forgejo.outputs.runner-logs }}"
+          forgejo-test-helper.sh run_workflow testdata/release-notes-file http://testuser:admin1234@${{ steps.forgejo.outputs.host-port }} testuser release-notes-file forgejo-release "${{ steps.forgejo.outputs.token }}"
+
+          set -ex
+          export FORGEJO="${{ steps.forgejo.outputs.url }}"
+          curl --fail -sS $FORGEJO/api/v1/repos/testuser/release-notes-file/releases/tags/v1.0 > /tmp/v1.json
+          curl --fail -sS $FORGEJO/api/v1/repos/testuser/release-notes-file/releases/tags/v2.0 > /tmp/v2.json
+          curl --fail -sS $FORGEJO/api/v1/repos/testuser/release-notes-file/releases/tags/v3.0 > /tmp/v3.json
+
+          EXPECTED='# This is a Release Note
+
+          Some *formatted*,
+
+          multiline
+
+          Markdown content.
+
+          ```bash
+          echo "Even a code block"
+          ```'
+          test "$EXPECTED" = "$(jq -r .body < /tmp/v1.json)"
+
+          test "$EXPECTED" = "$(jq -r .body < /tmp/v2.json)"
+          test "I wont be there" != "$(jq -r .body < /tmp/v2.json)"
+
+          test "$EXPECTED" != "$(jq -r .body < /tmp/v3.json)"
+          test "I will be there" = "$(jq -r .body < /tmp/v3.json)"
+
       - name: testdata/upload-download-private
         run: |
           export LOOP_DELAY=30

.forgejo/workflows/tests.yml

@@ -2,7 +2,7 @@ on:
   pull_request:
   push:
     branches:
-      - "**"
+      - '**'
 
 jobs:
   tests:
@@ -24,6 +24,4 @@ jobs:
 
       - name: Unit tests of the supporting script forgejo-release.sh
         run: |
-          testdata/forgejo-release-test.sh test_system_tea_bin
-          testdata/forgejo-release-test.sh test_download_tea_bin
           testdata/forgejo-release-test.sh test_maybe_sign_release

README.md

@@ -18,6 +18,7 @@ Upload or download the assets of a release to a Forgejo instance.
 | `token` | <p>Forgejo application token (must have <code>write:repository</code>)</p> | `false` | `${{ forge.token }}` |
 | `release-dir` | <p>Directory in which release assets are uploaded or downloaded</p> | `false` | `dist/release` |
 | `release-notes` | <p>Release notes</p> | `false` | `""` |
+| `release-notes-file` | <p>Path to a file containing your release notes (takes priority over <code>release-notes</code>)</p> | `false` | `""` |
 | `direction` | <p>Can either be <code>download</code> or <code>upload</code></p> | `true` | `""` |
 | `gpg-private-key` | <p>GPG Private Key to sign the release artifacts</p> | `false` | `""` |
 | `gpg-passphrase` | <p>Passphrase of the GPG Private Key</p> | `false` | `""` |
@@ -43,7 +44,7 @@ jobs:
     runs-on: docker
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/forgejo-release@v2.8.0
+      - uses: actions/forgejo-release@v2.9.1
         with:
           direction: upload
           url: https://my-forgejo-instance.net
@@ -54,6 +55,27 @@ jobs:
           release-notes: "MY RELEASE NOTES"
 ```
 
+Upload a release with custom release notes located in a file:
+
+```yaml
+jobs:
+  upload-release:
+    runs-on: docker
+    steps:
+      - uses: actions/checkout@v4
+      - name: Generate Changelog
+        run: ./generate-changelog.sh > dist/changelog.md
+      - uses: actions/forgejo-release@v2.7.3
+        with:
+          direction: upload
+          url: https://my-forgejo-instance.net
+          repo: myuser/myrepo
+          token: ${{ secrets.WRITE_TOKEN_TO_MYREPO }}
+          tag: v13.0.2
+          release-dir: dist/release
+          release-notes-file: dist/changelog.md
+```
+
 ### Download
 
 Example downloading the forgejo release v1.21.4-0 into the working directory:
@@ -64,7 +86,7 @@ jobs:
     runs-on: docker
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/forgejo-release@v2.8.0
+      - uses: actions/forgejo-release@v2.9.1
         with:
           direction: download
           url: https://my-forgejo-instance.net

action.yml

@@ -26,6 +26,8 @@ inputs:
     default: 'dist/release'
   release-notes:
     description: 'Release notes'
+  release-notes-file:
+    description: 'Path to a file containing your release notes (takes priority over `release-notes`)'
   direction:
     description: 'Can either be `download` or `upload`'
     required: true
@@ -100,6 +102,16 @@ runs:
         EOF
         )
 
+        RELEASENOTES_FILE="${{ inputs.release-notes-file }}"
+        if [ ! -z "$RELEASENOTES_FILE" ]; then
+          if [ ! -f "$RELEASENOTES_FILE" ]; then
+            echo "! Release notes file $RELEASENOTES_FILE does not exist."
+            exit 1
+          fi
+
+          export RELEASENOTES=$(cat "$RELEASENOTES_FILE")
+        fi
+
         export SHA="${{ inputs.sha }}"
 
         export OVERRIDE="${{ inputs.override }}"

forgejo-release.sh

@@ -12,33 +12,22 @@ if ${VERBOSE:-false}; then set -x; fi
 : ${DOWNLOAD_LATEST:=false}
 : ${TMP_DIR:=$(mktemp -d)}
 : ${GNUPGHOME:=$TMP_DIR}
-: ${TEA_BIN:=$TMP_DIR/tea}
-: ${TEA_VERSION:=0.10.1}
 : ${OVERRIDE:=false}
 : ${HIDE_ARCHIVE_LINK:=false}
 : ${RETRY:=1}
 : ${DELAY:=10}
+: ${SKIP_ASSETS:=false}
 
-RELEASE_NOTES_ASSISTANT_VERSION=v1.5.1 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org
+RELEASE_NOTES_ASSISTANT_VERSION=v1.5.2 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org
 
 TAG_FILE="$TMP_DIR/tag$$.json"
 TAG_URL=$(echo "$TAG" | sed 's/\//%2F/g')
 
 export GNUPGHOME
 
-setup_tea() {
-    if which tea 2>/dev/null; then
-        TEA_BIN=$(which tea)
-    elif ! test -f $TEA_BIN; then
-        ARCH=$(dpkg --print-architecture)
-        curl -sL https://dl.gitea.io/tea/$TEA_VERSION/tea-$TEA_VERSION-linux-"$ARCH" >$TEA_BIN
-        chmod +x $TEA_BIN
-    fi
-}
-
 get_tag() {
     if ! test -f "$TAG_FILE"; then
-        if api GET repos/$REPO/tags/"$TAG_URL" >"$TAG_FILE"; then
+        if api_json GET repos/$REPO/tags/"$TAG_URL" >"$TAG_FILE"; then
             echo "tag $TAG exists"
         else
             echo "tag $TAG does not exists"
@@ -69,42 +58,52 @@ ensure_tag() {
 }
 
 create_tag() {
-    api POST repos/$REPO/tags --data-raw '{"tag_name": "'"$TAG"'", "target": "'"$SHA"'"}' >"$TAG_FILE"
+    api_json POST repos/$REPO/tags --data-raw '{"tag_name": "'"$TAG"'", "target": "'"$SHA"'"}' >"$TAG_FILE"
 }
 
 delete_tag() {
     if get_tag; then
-        api DELETE repos/$REPO/tags/"$TAG_URL"
+        api_json DELETE repos/$REPO/tags/"$TAG_URL"
         rm -f "$TAG_FILE"
     fi
 }
 
 upload_release() {
-    # assets is defined as a list of arguments, where values may contain whitespace and need to be quoted like this -a "my file.txt" -a "file.txt".
-    # It is expanded using "${assets[@]}" which preserves the separation of arguments and not split whitespace containing values.
-    # For reference, see https://github.com/koalaman/shellcheck/wiki/SC2086#exceptions
-    local assets=()
-    if ! "$SKIP_ASSETS"; then
-        for file in "$RELEASE_DIR"/*; do
-            assets=("${assets[@]}" -a "$file")
-        done
-    fi
     if $PRERELEASE || echo "${TAG}" | grep -qi '\-rc'; then
-        releaseType="--prerelease"
+        prerelease="true"
         echo "Uploading as Pre-Release"
     else
+        prerelease="false"
         echo "Uploading as Stable"
     fi
     ensure_tag
-    if ! $TEA_BIN release create "${assets[@]}" --repo $REPO --note "$RELEASENOTES" --tag "$TAG" --title "$TITLE" --draft ${releaseType} >&"$TMP_DIR"/tea.log; then
+    jq -n --arg title "$TITLE" --arg body "$RELEASENOTES" --arg tag "$TAG" --arg pre $prerelease '{"draft": true, "name": $title, "body": $body, "prerelease": $pre | test("true"), "tag_name": $tag }' >"$TMP_DIR"/release-payload.json
-        if grep --quiet 'Unknown API Error: 500' "$TMP_DIR"/tea.log && grep --quiet services/release/release.go:194 "$TMP_DIR"/tea.log; then
+    if ${VERBOSE:-false}; then
-            echo "workaround v1.20 race condition https://codeberg.org/forgejo/forgejo/issues/1370"
+        echo "Payload:"
-            sleep 10
+        cat "$TMP_DIR"/release-payload.json | jq
-            $TEA_BIN release create "${assets[@]}" --repo $REPO --note "$RELEASENOTES" --tag "$TAG" --title "$TITLE" --draft ${releaseType}
+    fi
-        else
+    if ! api_json POST repos/$REPO/releases -d @"$TMP_DIR"/release-payload.json >"$TMP_DIR"/release.json; then
-            cat "$TMP_DIR"/tea.log
+        if ${VERBOSE:-false}; then
-            return 1
+            echo "Response:"
+            cat "$TMP_DIR"/release.json | jq
         fi
+        exit 1
+    fi
+    if [ "$SKIP_ASSETS" == 'false' ]; then
+        release_id=$(jq --raw-output .id <"$TMP_DIR"/release.json)
+        for file in "$RELEASE_DIR"/*; do
+            # https://dev.to/pkutaj/how-to-use-jq-for-uri-encoding-2o5
+            # https://unix.stackexchange.com/questions/94295/shellcheck-is-advising-not-to-use-basename-why/94307#94307
+            # url encode some chars
+            asset_name="$(echo -n "${file##*/}" | jq -sRr @uri)"
+            if ! api POST "repos/$REPO/releases/$release_id/assets?name=$asset_name" -H "Content-Type: multipart/form-data" -F "attachment=@$file" >"$TMP_DIR/release-$asset_name.json"; then
+                if ${VERBOSE:-false}; then
+                    echo "Response:"
+                    cat "$TMP_DIR/release-$asset_name.json" | jq
+                fi
+                exit 1
+            fi
+        done
     fi
     maybe_use_release_note_assistant
     release_draft false
@@ -113,9 +112,9 @@ upload_release() {
 release_draft() {
     local state="$1"
 
-    local id=$(api GET repos/$REPO/releases/tags/"$TAG_URL" | jq --raw-output .id)
+    local id=$(api_json GET repos/$REPO/releases/tags/"$TAG_URL" | jq --raw-output .id)
 
-    api PATCH repos/$REPO/releases/"$id" --data-raw '{"draft": '"$state"', "hide_archive_links": '$HIDE_ARCHIVE_LINK'}'
+    api_json PATCH repos/$REPO/releases/"$id" --data-raw '{"draft": '"$state"', "hide_archive_links": '$HIDE_ARCHIVE_LINK'}'
 }
 
 maybe_use_release_note_assistant() {
@@ -151,7 +150,7 @@ maybe_override() {
     if test "$OVERRIDE" = "false"; then
         return
     fi
-    api DELETE repos/$REPO/releases/tags/"$TAG_URL" >&/dev/null || true
+    api_json DELETE repos/$REPO/releases/tags/"$TAG_URL" >&/dev/null || true
     if get_tag && ! matched_tag; then
         delete_tag
     fi
@@ -159,9 +158,6 @@ maybe_override() {
 
 upload() {
     setup_api
-    setup_tea
-    rm -f ~/.config/tea/config.yml
-    GITEA_SERVER_TOKEN=$TOKEN $TEA_BIN login add --url $FORGEJO
     maybe_sign_release
     maybe_override
     upload_release
@@ -174,19 +170,23 @@ setup_api() {
     fi
 }
 
+api_json() {
+    api "$@" -H "Content-Type: application/json"
+}
+
 api() {
     method=$1
     shift
     path=$1
     shift
 
-    curl --fail -X "$method" -sS -H "Content-Type: application/json" -H "Authorization: token $TOKEN" "$@" $FORGEJO/api/v1/"$path"
+    curl --retry 5 --fail -X "$method" -sS -H "Authorization: token $TOKEN" "$@" $FORGEJO/api/v1/"$path"
 }
 
 wait_release() {
     local ready=false
     for i in $(seq $RETRY); do
-        if api GET repos/$REPO/releases/tags/"$TAG_URL" | jq --raw-output .draft >"$TMP_DIR"/draft; then
+        if api_json GET repos/$REPO/releases/tags/"$TAG_URL" | jq --raw-output .draft >"$TMP_DIR"/draft; then
             if test "$(cat "$TMP_DIR"/draft)" = "false"; then
                 ready=true
                 break
@@ -209,13 +209,13 @@ download() {
     (
         mkdir -p $RELEASE_DIR
         cd $RELEASE_DIR
-        if [[ ${DOWNLOAD_LATEST} == "true" ]]; then
+        if [[ ${DOWNLOAD_LATEST} = "true" ]]; then
             echo "Downloading the latest release"
-            api GET repos/$REPO/releases/latest >"$TMP_DIR"/assets.json
+            api_json GET repos/$REPO/releases/latest >"$TMP_DIR"/assets.json
         elif [[ ${DOWNLOAD_LATEST} == "false" ]]; then
             wait_release
             echo "Downloading tagged release ${TAG}"
-            api GET repos/$REPO/releases/tags/"$TAG_URL" >"$TMP_DIR"/assets.json
+            api_json GET repos/$REPO/releases/tags/"$TAG_URL" >"$TMP_DIR"/assets.json
         fi
         jq --raw-output '.assets[] | "\(.browser_download_url) \(.name)"' <"$TMP_DIR"/assets.json | while read url name; do # `name` may contain whitespace, therefore, it must be last
             url=$(echo "$url" | sed "s#/download/${TAG}/#/download/${TAG_URL}/#")

testdata/forgejo-release-test.sh

@@ -4,33 +4,17 @@
 set -ex
 PS4='${BASH_SOURCE[0]}:$LINENO: ${FUNCNAME[0]}:  '
 
-test_system_tea_bin() {
-	SYSTEM_TEA_BIN=$TMP_DIR/tea
-	touch $SYSTEM_TEA_BIN && chmod +x $SYSTEM_TEA_BIN
-	export PATH=$TMP_DIR:$PATH
-    setup_tea
-	test $TEA_BIN == $SYSTEM_TEA_BIN
-}
-
-test_download_tea_bin() {
-    # assume tea is not installed on system
-    setup_tea
-    test $TEA_BIN == $TMP_DIR/tea
-}
-
 test_teardown() {
     setup_api
-    api DELETE repos/$REPO/releases/tags/$TAG || true
+    api_json DELETE repos/$REPO/releases/tags/$TAG || true
-    api DELETE repos/$REPO/tags/$TAG || true
+    api_json DELETE repos/$REPO/tags/$TAG || true
     rm -fr dist/release
-    setup_tea
-    $TEA_BIN login delete $DOER || true
 }
 
 test_reset_repo() {
     local project="$1"
-    api DELETE repos/$REPO || true
+    api_json DELETE repos/$REPO || true
-    api POST user/repos --data-raw '{"name":"'$project'", "auto_init":true}'
+    api_json POST user/repos --data-raw '{"name":"'$project'", "auto_init":true}'
     git clone $FORGEJO/$REPO $TMP_DIR/repo
     SHA=$(git -C $TMP_DIR/repo rev-parse HEAD)
 }

testdata/nested-upload-download/.forgejo/workflows/test.yml

@@ -16,7 +16,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - id: forgejo
-        uses: https://code.forgejo.org/actions/setup-forgejo@v3.1.1
+        uses: https://code.forgejo.org/actions/setup-forgejo@v3.1.4
         with:
           user: testuser
           password: admin1234

testdata/release-notes-file/.forgejo/workflows/test.yml

@@ -0,0 +1,44 @@
+# SPDX-License-Identifier: MIT
+
+name: Upload a release with Release Notes to the project that runs the workflow
+on: [push]
+jobs:
+  upload-download:
+    runs-on: lxc-bookworm
+    steps:
+      - uses: actions/checkout@v6
+      - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+        id: release-notes-file
+        uses: SELF@vTest
+        with:
+          direction: upload
+          tag: v1.0
+          token: FORGEJO_TEST_TOKEN
+          release-dir: upload-dir
+          release-notes-file: upload-dir/RELEASE_NOTES.md
+          verbose: true
+
+      - uses: actions/checkout@v6
+      - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+        id: release-notes-file-takes-precedence
+        uses: SELF@vTest
+        with:
+          direction: upload
+          tag: v2.0
+          token: FORGEJO_TEST_TOKEN
+          release-dir: upload-dir
+          release-notes: "I wont be there"
+          release-notes-file: upload-dir/RELEASE_NOTES.md
+          verbose: true
+
+      - uses: actions/checkout@v6
+      - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+        id: release-notes
+        uses: SELF@vTest
+        with:
+          direction: upload
+          tag: v3.0
+          token: FORGEJO_TEST_TOKEN
+          release-dir: upload-dir
+          release-notes: "I will be there"
+          verbose: true

testdata/release-notes-file/.gitignore

@@ -0,0 +1 @@
+*~

testdata/release-notes-file/upload-dir/RELEASE_NOTES.md

@@ -0,0 +1,12 @@
+# This is a Release Note
+
+Some *formatted*,
+
+multiline
+
+Markdown content.
+
+```bash
+echo "Even a code block"
+```
+

testdata/release-notes-file/upload-dir/file 3.txt

@@ -0,0 +1 @@
+FILE3

testdata/release-notes-file/upload-dir/file1.txt

@@ -0,0 +1 @@
+FILE1

testdata/release-notes-file/upload-dir/file2.txt

@@ -0,0 +1 @@
+FILE2