Viewing is open to everyone. Downloading and starring need a GitHub sign-in.
Sign in with GitHub
publish.sh
v0.1.0-build.85
Latest
Commit ede38f5
Sign in with GitHub to download. Each download is recorded with your GitHub username.
| 1 | #! |
| 2 | # Publishes one CKey release to every registry, from the files the Release |
| 3 | # workflow attached to its draft GitHub Release. Nothing is rebuilt here: the |
| 4 | # exact bytes in SHA256SUMS are what get published. |
| 5 | # |
| 6 | # tools/release/publish.sh v0.1.0-build.83 # everything |
| 7 | # tools/release/publish.sh v0.1.0-build.83 npm nuget # only some |
| 8 | # |
| 9 | # Targets: npm, nuget, maven, homebrew, release (un-drafts the GitHub Release). |
| 10 | # Account setup and the environment variables each target needs are in |
| 11 | # docs/PUBLISHING.md. Run it on the maintainer's machine; never in CI for |
| 12 | # `community`. |
| 13 | set -euo pipefail |
| 14 | |
| 15 | tag="${1:?usage: publish.sh <tag> [npm nuget maven homebrew release]}" |
| 16 | shift || true |
| 17 | targets=("$@") |
| 18 | [ ${#targets[@]} -eq 0 ] && targets=(npm nuget maven homebrew release) |
| 19 | version="${tag#v}" |
| 20 | repo="clearkeysolutions/ckey" |
| 21 | tap_repo="clearkeysolutions/homebrew-ckey" |
| 22 | |
| 23 | need() { command -v "$1" >/dev/null || { echo "missing tool: $1 ($2)"; exit 1; }; } |
| 24 | want() { local t; for t in "${targets[@]}"; do [ "$t" = "$1" ] && return 0; done; return 1; } |
| 25 | need gh "brew install gh, then gh auth login" |
| 26 | need shasum "part of macOS" |
| 27 | |
| 28 | work="$(mktemp -d)" |
| 29 | trap 'rm -rf "$work"' EXIT |
| 30 | echo "==> Downloading the assets of ${tag}" |
| 31 | gh release download "$tag" --repo "$repo" --dir "$work" |
| 32 | cd "$work" |
| 33 | echo "==> Verifying SHA256SUMS" |
| 34 | shasum -a 256 -c SHA256SUMS |
| 35 | if gh attestation verify --help >/dev/null 2>&1; then |
| 36 | for f in *; do |
| 37 | [ "$f" = SHA256SUMS ] && continue |
| 38 | gh attestation verify "$f" --repo "$repo" >/dev/null && echo "provenance ok: $f" |
| 39 | done |
| 40 | fi |
| 41 | |
| 42 | if want npm; then |
| 43 | need npm "install Node.js 22" |
| 44 | echo "==> npm" |
| 45 | tgz=$(ls openckey-*.tgz | head -1) |
| 46 | # A prerelease needs an explicit dist-tag; until 1.0 every build is "latest". |
| 47 | npm publish "$tgz" --access public --tag latest |
| 48 | fi |
| 49 | |
| 50 | if want nuget; then |
| 51 | need dotnet "install the .NET 8 SDK" |
| 52 | : "${NUGET_API_KEY:?set NUGET_API_KEY (docs/PUBLISHING.md)}" |
| 53 | echo "==> NuGet" |
| 54 | for pkg in *.nupkg; do |
| 55 | dotnet nuget push "$pkg" --source https://api.nuget.org/v3/index.json --api-key "$NUGET_API_KEY" --skip-duplicate |
| 56 | done |
| 57 | fi |
| 58 | |
| 59 | if want maven; then |
| 60 | need gpg "brew install gnupg" |
| 61 | : "${MAVEN_CENTRAL_TOKEN:?set MAVEN_CENTRAL_TOKEN to base64 of user:password from central.sonatype.com (docs/PUBLISHING.md)}" |
| 62 | echo "==> Maven Central" |
| 63 | mkdir bundle |
| 64 | (cd bundle && unzip -q "../ckey-android-maven-${version}.zip") |
| 65 | # Central requires a -javadoc.jar beside every artifact. The Android modules |
| 66 | # ship sources jars; where no javadoc jar exists, add the placeholder Central |
| 67 | # accepts (a jar holding a README that points to the sources and docs). |
| 68 | find bundle -name '*.pom' | while read -r pom; do |
| 69 | base="$PWD/${pom%.pom}" |
| 70 | if [ ! -f "${base}-javadoc.jar" ]; then |
| 71 | tmp="$(mktemp -d)" |
| 72 | printf 'API documentation: https://github.com/clearkeysolutions/ckey/tree/Stable-Release/sdk/android\nThe sources jar beside this file holds the documented Kotlin sources.\n' > "$tmp/README.txt" |
| 73 | (cd "$tmp" && zip -q "${base}-javadoc.jar" README.txt) |
| 74 | rm -rf "$tmp" |
| 75 | fi |
| 76 | done |
| 77 | # Central requires a signature and MD5/SHA-1 checksums for every file. |
| 78 | find bundle -type f ! -name '*.asc' ! -name '*.md5' ! -name '*.sha1' ! -name '*.sha256' ! -name '*.sha512' \ |
| 79 | ! -name 'maven-metadata*' | while read -r f; do |
| 80 | gpg --batch --yes --armor --detach-sign ${GPG_KEY_ID:+--local-user "$GPG_KEY_ID"} "$f" |
| 81 | md5 -q "$f" > "$f.md5" |
| 82 | shasum -a 1 "$f" | cut -d' ' -f1 > "$f.sha1" |
| 83 | done |
| 84 | find bundle -name 'maven-metadata*' -delete |
| 85 | (cd bundle && zip -qr ../central-bundle.zip .) |
| 86 | curl -fsS -X POST "https://central.sonatype.com/api/v1/publisher/upload?name=ckey-${version}&publishingType=USER_MANAGED" \ |
| 87 | -H "Authorization: Bearer ${MAVEN_CENTRAL_TOKEN}" -F "bundle=@central-bundle.zip" |
| 88 | echo |
| 89 | echo "Uploaded. Review and press Publish at https://central.sonatype.com/publishing/deployments" |
| 90 | fi |
| 91 | |
| 92 | if want homebrew; then |
| 93 | need git "part of the Xcode command line tools" |
| 94 | echo "==> Homebrew tap" |
| 95 | git clone -q "https://github.com/${tap_repo}.git" tap |
| 96 | mkdir -p tap/Formula |
| 97 | cp ckey.rb tap/Formula/ckey.rb |
| 98 | (cd tap && git add Formula/ckey.rb && git commit -qm "ckey ${version}" && git push -q origin HEAD) |
| 99 | echo "Formula published: brew install clearkeysolutions/ckey/ckey" |
| 100 | fi |
| 101 | |
| 102 | if want release; then |
| 103 | echo "==> Publishing the GitHub Release" |
| 104 | gh release edit "$tag" --repo "$repo" --draft=false --latest |
| 105 | fi |
| 106 | |
| 107 | echo "==> Done: ${targets[*]}" |