ochenstarik/server-monitor-manager
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases 17 Packages Wiki Activity Actions

release: prepare v0.1.0-alpha.20

Browse source
This commit is contained in:
ochenstarik-ui 2026-08-18 11:54:11 +07:00
parent 7c43977fd1
commit 6285f1e3ac
7 changed files with 97 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

39
.github/workflows/linux-release.yml vendored
View file

@ -2,6 +2,11 @@ name: Release pipeline
on:
workflow_dispatch:
inputs:
tag:
description: 'Release tag to rehearse (for example v0.1.0-alpha.20)'
required: false
type: string
push:
tags:
- 'v*'
@ -40,6 +45,8 @@ jobs:
- name: Package bootstrap
shell: bash
env:
REHEARSAL_TAG: ${{ inputs.tag }}
run: |
set -Eeuo pipefail
DIST_DIR=dist
@ -47,10 +54,19 @@ jobs:
install -m 0755 deploy/ochenstarik-server-monitor-manager.sh "$DIST_DIR/ochenstarik-server-monitor-manager.sh"
install -m 0755 deploy/smm-setup.sh "$DIST_DIR/smm-setup.sh"
# Substitute PROGRAM_VERSION from tag
# A branch rehearsal with an explicit tag must exercise the same
# version-consistency gate as an immutable tag build.
RELEASE_TAG=""
if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
sed -i "s/^PROGRAM_VERSION=.*$/PROGRAM_VERSION=\"${GITHUB_REF_NAME}\"/" "$DIST_DIR/ochenstarik-server-monitor-manager.sh"
grep -Fq "readonly DEFAULT_RELEASE_TAG=\"${GITHUB_REF_NAME}\"" "$DIST_DIR/smm-setup.sh"
RELEASE_TAG="${GITHUB_REF_NAME}"
elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && -n "$REHEARSAL_TAG" ]]; then
RELEASE_TAG="$REHEARSAL_TAG"
fi
if [[ -n "$RELEASE_TAG" ]]; then
[[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]] \
|| { printf 'Invalid release tag: %s\n' "$RELEASE_TAG" >&2; exit 1; }
sed -i "s/^PROGRAM_VERSION=.*$/PROGRAM_VERSION=\"${RELEASE_TAG}\"/" "$DIST_DIR/ochenstarik-server-monitor-manager.sh"
grep -Fq "readonly DEFAULT_RELEASE_TAG=\"${RELEASE_TAG}\"" "$DIST_DIR/smm-setup.sh"
fi
(
@ -86,9 +102,13 @@ jobs:
- name: Set Version
id: version
shell: bash
env:
REHEARSAL_TAG: ${{ inputs.tag }}
run: |
if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
VERSION="${GITHUB_REF_NAME#v}"
elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && -n "$REHEARSAL_TAG" ]]; then
VERSION="${REHEARSAL_TAG#v}"
else
VERSION="0.2.0-dev"
fi
@ -176,9 +196,13 @@ jobs:
- name: Set Version
id: version
shell: bash
env:
REHEARSAL_TAG: ${{ inputs.tag }}
run: |
if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
VERSION="${GITHUB_REF_NAME#v}"
elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && -n "$REHEARSAL_TAG" ]]; then
VERSION="${REHEARSAL_TAG#v}"
else
VERSION="0.2.0-dev"
fi
@ -235,6 +259,8 @@ jobs:
- name: Generate Manifest v2
shell: bash
env:
REHEARSAL_TAG: ${{ inputs.tag }}
run: |
set -Eeuo pipefail
@ -248,8 +274,11 @@ jobs:
)
# Version fallback for non-tag runs
VERSION="${GITHUB_REF_NAME}"
if [[ ! "${GITHUB_REF}" == refs/tags/* ]]; then
if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
VERSION="${GITHUB_REF_NAME}"
elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && -n "$REHEARSAL_TAG" ]]; then
VERSION="$REHEARSAL_TAG"
else
VERSION="0.0.0-dev"
fi

2
.github/workflows/windows-build.yml vendored
View file

@ -40,7 +40,7 @@ jobs:
- name: Test Desktop security (live release)
env:
SMM_TEST_RELEASE_TAG: v0.1.0-alpha.18
SMM_TEST_RELEASE_TAG: v0.1.0-alpha.20
run: dotnet test tests/ServerMonitorManager.Desktop.Security.Tests/ServerMonitorManager.Desktop.Security.Tests.csproj --configuration Release -p:RestoreLockedMode=true --filter Category=LiveRelease
- name: Build test-signed MSIX installer

4
deploy/smm-setup.sh
View file

@ -3,7 +3,7 @@ set -Eeuo pipefail
IFS=$'\n\t'
readonly PROGRAM_NAME="smm-setup"
readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.18"
readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.20"
readonly DEFAULT_REPOSITORY="ochenstarik-ui/server-monitor-manager"
readonly INNER_ASSET="ochenstarik-server-monitor-manager.sh"
@ -34,7 +34,7 @@ asset. Use -- before a command to force pass-through. Common commands:
backup-create | backup-restore | version
Environment overrides:
SMM_TAG Release tag (default: v0.1.0-alpha.18)
SMM_TAG Release tag (default: v0.1.0-alpha.20)
SMM_REPOSITORY GitHub repository (default: ochenstarik-ui/server-monitor-manager)
SMM_CACHE_DIR Verified-download cache directory
USAGE

6
docs/linux-bootstrap.md
View file

@ -6,11 +6,11 @@ Server Monitor Manager устанавливает Control (Hub) и Agent (Node)
## Быстрая установка
Скачайте и проверьте convenience installer из `v0.1.0-alpha.18`:
Скачайте и проверьте convenience installer из `v0.1.0-alpha.20`:
```bash
curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.18/smm-setup.sh
curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.18/smm-setup.sh.sha256
curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.20/smm-setup.sh
curl -fsSLO https://github.com/ochenstarik-ui/server-monitor-manager/releases/download/v0.1.0-alpha.20/smm-setup.sh.sha256
sha256sum -c smm-setup.sh.sha256
chmod 700 smm-setup.sh
```

1
docs/release-policy.md
View file

@ -20,5 +20,6 @@ Known release history:
- `v0.1.0-alpha.16` clears the acceptance shell's command hash after removing its test-provisioned cosign. Its automatic verification proved clean-host Hub installation, but the convenience installer wrote the bootstrap checksum success line to stdout before the machine-readable `SMMNODE2` enrollment code. Node installation therefore rejected the contaminated value. The immutable release and failed verification remain as evidence; stdout isolation is corrected in the next version.
- `v0.1.0-alpha.17` keeps checksum verification fail-closed while suppressing its success line, so pass-through commands such as `node-code` return only their machine-readable bootstrap output. Its automatic verification completed the clean-host Hub and Node installation, then the negative-test harness stopped while creating a wrong-identity signature because cosign v3 requires an explicit bundle or legacy detached-output mode. The immutable release and failed harness run remain as evidence; the negative test is corrected in the next version.
- `v0.1.0-alpha.18` makes the wrong-identity negative test select cosign v3's explicit detached-output mode, matching the production consumer's detached signature and certificate contract. It is the first release required to complete both automatic `workflow_run` verification and manual `workflow_dispatch` re-verification.
- `v0.1.0-alpha.19` exists as a tag, but its Release pipeline failed when the packaged convenience installer's `DEFAULT_RELEASE_TAG` did not match the immutable tag. No GitHub Release was published. The version number is burned and must not be moved, deleted, recreated, or reused.
Every release candidate must pass a branch `workflow_dispatch` run of the Release pipeline before its immutable version tag is created. The release owner has sole write ownership of version sources, `deploy/**`, `tests/bootstrap/**`, release workflows, the root README release status, and translated README release statuses. Other contributors request changes to those paths in their report; they do not edit or bump them directly. One pull request covers one release topic and may merge only after required CI is green.

13
tests/bootstrap/test-release-contract.sh
View file

@ -11,6 +11,7 @@ windows_workflow="$root/.github/workflows/windows-release.yml"
policy="$root/docs/release-policy.md"
installer_contract="$root/docs/installer-contract.md"
manifest_test="$root/tests/bootstrap/test-manifest-verification.sh"
version_consistency_test="$root/tests/bootstrap/test-release-version-consistency.sh"
v1_fixture="$root/tests/fixtures/alpha8-v1-release"
[[ -s "$setup" ]] || {
@ -18,7 +19,12 @@ v1_fixture="$root/tests/fixtures/alpha8-v1-release"
exit 1
}
bash -n "$setup"
grep -Fq 'readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.18"' "$setup"
grep -Fq 'readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.20"' "$setup"
bash -n "$version_consistency_test"
if command -v shellcheck >/dev/null 2>&1; then
shellcheck --severity=error "$version_consistency_test"
fi
bash "$version_consistency_test"
grep -Fq 'install-hub PUBLIC_HOST [HTTPS_PORT] [WG_PORT]' "$setup"
grep -Fxq ' install-node' "$setup"
if grep -Fq 'validate_control_url' "$setup" || grep -Fq '${CONTROL_URL%/}/control' "$setup"; then
@ -63,6 +69,7 @@ grep -Fq 'v0.1.0-alpha.15' "$policy"
grep -Fq 'v0.1.0-alpha.16' "$policy"
grep -Fq 'v0.1.0-alpha.17' "$policy"
grep -Fq 'v0.1.0-alpha.18' "$policy"
grep -Fq 'v0.1.0-alpha.19' "$policy"
grep -Fq 'hash -r' "$root/tests/release-verification/run-positive-installation.sh"
grep -Fq -- '--use-signing-config=false --new-bundle-format=false' \
"$root/tests/release-verification/run-negative-tests.sh"
@ -193,8 +200,8 @@ chmod +x "$work/bin/uname"
HOME="$work/home" PATH="$work/bin:$PATH" bash "$setup" version >"$work/output"
grep -Fq 'INNER_ARGS=version ' "$work/output"
grep -Fq '/releases/download/v0.1.0-alpha.18/ochenstarik-server-monitor-manager.sh' "$work/urls"
grep -Fq '/releases/download/v0.1.0-alpha.18/ochenstarik-server-monitor-manager.sh.sha256' "$work/urls"
grep -Fq '/releases/download/v0.1.0-alpha.20/ochenstarik-server-monitor-manager.sh' "$work/urls"
grep -Fq '/releases/download/v0.1.0-alpha.20/ochenstarik-server-monitor-manager.sh.sha256' "$work/urls"
node_code="$(HOME="$work/home" PATH="$work/bin:$PATH" bash "$setup" node-code fixture-node)"
[[ "$node_code" == 'SMMNODE1.fixture' ]] || {

46
tests/bootstrap/test-release-version-consistency.sh Normal file
View file

@ -0,0 +1,46 @@
#!/usr/bin/env bash
set -Eeuo pipefail
IFS=$'\n\t'
root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
setup="$root/deploy/smm-setup.sh"
linux_docs="$root/docs/linux-bootstrap.md"
windows_workflow="$root/.github/workflows/windows-build.yml"
release_workflow="$root/.github/workflows/linux-release.yml"
default_tag="$(sed -n 's/^readonly DEFAULT_RELEASE_TAG="\([^"]*\)"$/\1/p' "$setup")"
[[ "$default_tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]] || {
printf 'invalid or missing DEFAULT_RELEASE_TAG: %s\n' "$default_tag" >&2
exit 1
}
grep -Fq "SMM_TAG Release tag (default: $default_tag)" "$setup" || {
printf '%s\n' 'smm-setup help default does not match DEFAULT_RELEASE_TAG' >&2
exit 1
}
windows_tag="$(sed -n 's/^[[:space:]]*SMM_TEST_RELEASE_TAG:[[:space:]]*\([^[:space:]]*\)$/\1/p' "$windows_workflow")"
[[ "$windows_tag" == "$default_tag" ]] || {
printf 'Windows live-release tag %s does not match %s\n' "$windows_tag" "$default_tag" >&2
exit 1
}
mapfile -t documented_tags < <(
grep -Eo 'v0\.1\.0-alpha\.[0-9]+' "$linux_docs" | sort -u
)
[[ ${#documented_tags[@]} -gt 0 ]] || {
printf '%s\n' 'Linux bootstrap documentation has no release download tag' >&2
exit 1
}
for documented_tag in "${documented_tags[@]}"; do
[[ "$documented_tag" == "$default_tag" ]] || {
printf 'Documented release tag %s does not match %s\n' "$documented_tag" "$default_tag" >&2
exit 1
}
done
grep -Fq 'REHEARSAL_TAG: ${{ inputs.tag }}' "$release_workflow"
[[ "$(grep -Fc 'REHEARSAL_TAG: ${{ inputs.tag }}' "$release_workflow")" -eq 4 ]]
grep -Fq 'grep -Fq "readonly DEFAULT_RELEASE_TAG=\"${RELEASE_TAG}\""' "$release_workflow"
printf 'RELEASE_VERSION_CONSISTENCY=PASS tag=%s\n' "$default_tag"