diff --git a/.github/release-rules/reviews.json b/.github/release-rules/reviews.json index a6bda35..b36fd66 100644 --- a/.github/release-rules/reviews.json +++ b/.github/release-rules/reviews.json @@ -28,7 +28,8 @@ "require_code_owner_review": false, "allowed_merge_methods": [ "merge", - "squash" + "squash", + "rebase" ] } } diff --git a/.github/workflows/release-validate.yaml b/.github/workflows/release-validate.yaml index 0f91f8a..5d6c9f3 100644 --- a/.github/workflows/release-validate.yaml +++ b/.github/workflows/release-validate.yaml @@ -27,6 +27,6 @@ jobs: - name: Regenerate release content env: RELEASE_BASE: ${{ github.event.pull_request.base.sha }} - run: bundle exec bake gem:release:validate "base=$RELEASE_BASE" optional=true + run: bundle exec bake gem:github:release:validate "base=$RELEASE_BASE" - name: Build unsigned package run: bundle exec bake gem:build signing_key=false diff --git a/bake/gem/github/release.rb b/bake/gem/github/release.rb index 171784a..9632a77 100644 --- a/bake/gem/github/release.rb +++ b/bake/gem/github/release.rb @@ -26,6 +26,14 @@ def major(refresh: false) Bake::Gem::GitHub::Project.new(context.root).prepare(context, "major", refresh: refresh) end +# Regenerate release content and require one release commit; ordinary PRs pass without a commit limit. +# @parameter base [String] The current target commit. +# @parameter candidate [String] The proposed PR head. +# @returns [Hash | Nil] Release metadata, or nil for an ordinary PR. +def validate(base:, candidate: "HEAD") + Bake::Gem::GitHub::Project.new(context.root).validate(base: base, candidate: candidate) +end + # Resolve and validate a pushed commit, emitting its merged PR and commit for publishing. # @parameter number [String | Nil] A merged PR number for older workflows; defaults to `RELEASE_PR`. # @parameter commit [String | Nil] The pushed commit SHA; defaults to `RELEASE_COMMIT` and takes precedence over `number`. diff --git a/context/getting-started.md b/context/getting-started.md index 536f05e..3470c0a 100644 --- a/context/getting-started.md +++ b/context/getting-started.md @@ -6,7 +6,7 @@ This guide explains how to configure reviewed Ruby gem releases and prepare the Maintainers prepare a release PR containing the version bump and generated release notes. CI regenerates those changes from the current base to verify the content. Native GitHub rules control approval and merging. A push to the default branch starts release inspection; GitHub Actions builds the exact pushed commit only when it is a validated, merged release PR, then publishes its verified artifact to RubyGems. -`bake-gem` provides version updates, release hooks, and clean builds. `bake-gem-github` adds PR preparation, GitHub policy, and remote publishing. The supported process uses one gemspec, stable three-part versions, merge or squash merging, and RubyGems.org. +`bake-gem` provides version updates, release hooks, and clean builds. `bake-gem-github` adds PR preparation, GitHub policy, and remote publishing. The supported process uses one gemspec, stable three-part versions, single-commit release PRs, and RubyGems.org. Release PRs can be squash merged, rebase merged, or merged with a merge commit. ## Installation @@ -90,7 +90,9 @@ bundle exec bake gem:github:setup:plan bundle exec bake gem:github:setup:apply ``` -Apply updates the four managed rulesets and, when configured, the existing environment's reviewer list. It preserves unrelated rulesets. Other repository and organization protections still apply. Keep check names in `config/release.yaml` synchronized with the workflows, and apply updated rules after renamed jobs are available. Keep rebase merging and merge queues disabled for this process. +Apply updates the four managed rulesets and, when configured, the existing environment's reviewer list. It preserves unrelated rulesets. Other repository and organization protections still apply. Keep check names in `config/release.yaml` synchronized with the workflows, and apply updated rules after renamed jobs are available. + +The generated rules allow merge, squash, and rebase methods; repository settings determine which are available. For linear history, enable squash and/or rebase merging and disable merge commits in repository settings. Release validation requires exactly one commit when the version changes; ordinary PRs have no commit limit. Keep merge queues disabled for this process. ## Prepare the first release PR @@ -115,13 +117,15 @@ git diff This updates managed files in the working tree and returns their changed paths. Review the diff and selectively retain repository customizations before committing. The task does not stage, commit, or change remote settings. Repeated updates produce no further changes unless customizations differ from the templates. Apply changed rulesets after the corresponding workflows are running. +To enable rebase merging on an existing installation, regenerate and merge `release-validate.yaml` so it runs `gem:github:release:validate`, which requires single-commit release PRs. Then review `gem:github:setup:plan` and run `gem:github:setup:apply` to allow rebase merging in the managed rules. Enable rebase merging in repository settings as well. Upgrading the gem alone does not update workflows or live rules. + Regenerate existing workflows to adopt publishing on `push` instead of `pull_request_target`. The workflow filename and `rubygems` environment remain the same, so the RubyGems Trusted Publisher configuration does not change. No exception to GitHub's `pull_request_target` execution policy is needed. The resolve task continues to accept PR numbers from older workflows while you migrate. The release workflows follow `bake modernize` action versions and use moving major tags where available. The RubyGems credentials action uses its [documented `@main` reference](https://github.com/rubygems/configure-rubygems-credentials#trusted-publisher-recommended). Repositories that require fixed revisions can customize these references. ## Current scope -The process has published `bake-gem-github` through GitHub Actions. Each adopting repository still needs its own reviewed setup and successful release. Public single-gem repositories, ordinary stable versions, merge/squash, GitHub-hosted Linux runners, and RubyGems.org are the supported starting point. +The process has published `bake-gem-github` through GitHub Actions. Each adopting repository still needs its own reviewed setup and successful release. Public single-gem repositories, ordinary stable versions, single-commit release PRs using squash/rebase/merge, GitHub-hosted Linux runners, and RubyGems.org are the supported starting point. Native build matrices, reusable publisher workflows, merge queues, automated RubyGems ownership/MFA setup, cross-run artifact recovery, and organization-wide migration are outside the current setup tasks. diff --git a/context/preparing-releases.md b/context/preparing-releases.md index 89f885f..322ec4e 100644 --- a/context/preparing-releases.md +++ b/context/preparing-releases.md @@ -19,11 +19,20 @@ gh workflow run release-prepare.yaml -f bump=patch Replace `patch` with `minor` or `major`. The wrapper fetches the default branch and tags, refuses a stale local checkout, and validates an existing release PR before returning its URL. A matching local or remote branch is reused if PR creation was interrupted. Multiple open release PRs or a different requested bump stop preparation. GitHub's built-in token may require a writer to approve running workflows for its created PR; enable Actions' permission to create PRs. An organization-owned App token can be adopted later if automatic CI triggering is needed. -All release changes belong in the PR. Core preparation commits additions and deletions from release hooks but never pushes, tags or publishes. Validation independently generates the expected tree from the current base. A changed base SHA alone is fine; changed generated notes are not. Ordinary PRs with no version change pass release validation and still build unsigned. +All release changes belong in one commit, including the version bump and generated files. Core preparation commits additions and deletions from release hooks but never pushes, tags or publishes. Validation independently generates the expected tree from the current base and requires exactly one commit ahead of that base. A changed base SHA alone is fine; changed generated notes are not. Ordinary PRs with no version change have no commit limit and still build unsigned. + +To run the same content and commit-count validation locally from a release branch: + +``` bash +git fetch origin main +bundle exec bake gem:github:release:validate base=origin/main +``` + +Replace `main` with your configured default branch. When correcting a release, amend the existing commit or regenerate it with `refresh=true` instead of adding fixup commits. Amended content must still match the generated release; changes to release notes or generation hooks usually belong on the default branch followed by a refresh. ## Publish the merged release -Merging into the configured default branch triggers `release-publish.yaml` through its `push` event. Inspection uses the exact pushed SHA and resolves its associated PR through GitHub. Publication requires one matching merged PR in this repository, targeting the configured branch, with that exact merge commit. Ordinary changes do not publish; release changes without a matching merged PR fail inspection. Both merge commits and squash merges are supported, including merged fork PRs. +Merging into the configured default branch triggers `release-publish.yaml` through its `push` event. Inspection uses the exact pushed SHA and resolves its associated PR through GitHub. Publication requires one matching merged PR in this repository, targeting the configured branch, with that exact resulting commit. Ordinary changes do not publish; release changes without a matching merged PR fail inspection. Single-commit release PRs support squash merging, rebase merging, and merge commits, including merged fork PRs. Publishing validates against the resulting commit's first parent, which is the default branch immediately before the release landed. Each release must land as the tip of its own push, as it does when merging a PR through GitHub. Later pushes do not change a pending release's source: inspection and publishing remain pinned to the original commit, and reruns use the same event. Do not combine a release and later changes into one direct push. If you automate merging, use a GitHub App or personal access token; pushes made using a workflow's `GITHUB_TOKEN` do not trigger another workflow. @@ -45,4 +54,4 @@ bundle exec bake gem:github:release:patch refresh=true gh workflow run release-prepare.yaml -f bump=patch -f refresh=true ``` -Refresh first pushes the complete previous release commit to `release-backups/vVERSION/OLD_SHA`, including manual edits. It then regenerates in a clean worktree from the current default branch, validates, and updates the existing release branch using an explicit `--force-with-lease`. A concurrent remote edit causes the push to fail. Existing local release branches are left intact. Review the backup against the refreshed PR; incorporate necessary manual changes into the default branch or generation hooks and refresh again. Keep the backup until that review is complete. Replace `main` and `patch` with your configured branch and original bump type. +Refresh first pushes the complete previous release commit to `release-backups/vVERSION/OLD_SHA`, including manual edits. It then regenerates one release commit in a clean worktree from the current default branch, validates, and updates the existing release branch using an explicit `--force-with-lease`. A concurrent remote edit causes the push to fail. Existing local release branches are left intact. Review the backup against the refreshed PR; incorporate necessary manual changes into the default branch or generation hooks and refresh again. Keep the backup until that review is complete. Replace `main` and `patch` with your configured branch and original bump type. diff --git a/context/verifying-releases.md b/context/verifying-releases.md index a4228db..2471174 100644 --- a/context/verifying-releases.md +++ b/context/verifying-releases.md @@ -6,7 +6,7 @@ Use this when checking a completed release or confirming which source commit pro ## What publishing verifies -After merge/squash, the publishing workflow verifies GitHub's merged PR record and ancestry, then checks out the exact merged commit. Later development on the default branch is allowed. It regenerates against the merged commit's **first parent**, builds in a clean worktree, optionally certificate-signs, and creates two attestations over the final bytes: +After squash, rebase, or merge, the publishing workflow verifies GitHub's merged PR record and ancestry, then checks out the exact resulting commit. Each release PR contains one commit, so the resulting commit's **first parent** is the default branch immediately before the release landed. Later development on the default branch is allowed. Publishing regenerates against that first parent, builds in a clean worktree, optionally certificate-signs, and creates two attestations over the final bytes: - A Sigstore bundle submitted explicitly with `gem push --attestation` using RubyGems 4.0.21. - GitHub's native SLSA provenance covering both the gem and `release.json`. This signed receipt binds the gem digest to the exact release commit, even when the workflow's own default-branch revision is newer. diff --git a/guides/getting-started/readme.md b/guides/getting-started/readme.md index 536f05e..3470c0a 100644 --- a/guides/getting-started/readme.md +++ b/guides/getting-started/readme.md @@ -6,7 +6,7 @@ This guide explains how to configure reviewed Ruby gem releases and prepare the Maintainers prepare a release PR containing the version bump and generated release notes. CI regenerates those changes from the current base to verify the content. Native GitHub rules control approval and merging. A push to the default branch starts release inspection; GitHub Actions builds the exact pushed commit only when it is a validated, merged release PR, then publishes its verified artifact to RubyGems. -`bake-gem` provides version updates, release hooks, and clean builds. `bake-gem-github` adds PR preparation, GitHub policy, and remote publishing. The supported process uses one gemspec, stable three-part versions, merge or squash merging, and RubyGems.org. +`bake-gem` provides version updates, release hooks, and clean builds. `bake-gem-github` adds PR preparation, GitHub policy, and remote publishing. The supported process uses one gemspec, stable three-part versions, single-commit release PRs, and RubyGems.org. Release PRs can be squash merged, rebase merged, or merged with a merge commit. ## Installation @@ -90,7 +90,9 @@ bundle exec bake gem:github:setup:plan bundle exec bake gem:github:setup:apply ``` -Apply updates the four managed rulesets and, when configured, the existing environment's reviewer list. It preserves unrelated rulesets. Other repository and organization protections still apply. Keep check names in `config/release.yaml` synchronized with the workflows, and apply updated rules after renamed jobs are available. Keep rebase merging and merge queues disabled for this process. +Apply updates the four managed rulesets and, when configured, the existing environment's reviewer list. It preserves unrelated rulesets. Other repository and organization protections still apply. Keep check names in `config/release.yaml` synchronized with the workflows, and apply updated rules after renamed jobs are available. + +The generated rules allow merge, squash, and rebase methods; repository settings determine which are available. For linear history, enable squash and/or rebase merging and disable merge commits in repository settings. Release validation requires exactly one commit when the version changes; ordinary PRs have no commit limit. Keep merge queues disabled for this process. ## Prepare the first release PR @@ -115,13 +117,15 @@ git diff This updates managed files in the working tree and returns their changed paths. Review the diff and selectively retain repository customizations before committing. The task does not stage, commit, or change remote settings. Repeated updates produce no further changes unless customizations differ from the templates. Apply changed rulesets after the corresponding workflows are running. +To enable rebase merging on an existing installation, regenerate and merge `release-validate.yaml` so it runs `gem:github:release:validate`, which requires single-commit release PRs. Then review `gem:github:setup:plan` and run `gem:github:setup:apply` to allow rebase merging in the managed rules. Enable rebase merging in repository settings as well. Upgrading the gem alone does not update workflows or live rules. + Regenerate existing workflows to adopt publishing on `push` instead of `pull_request_target`. The workflow filename and `rubygems` environment remain the same, so the RubyGems Trusted Publisher configuration does not change. No exception to GitHub's `pull_request_target` execution policy is needed. The resolve task continues to accept PR numbers from older workflows while you migrate. The release workflows follow `bake modernize` action versions and use moving major tags where available. The RubyGems credentials action uses its [documented `@main` reference](https://github.com/rubygems/configure-rubygems-credentials#trusted-publisher-recommended). Repositories that require fixed revisions can customize these references. ## Current scope -The process has published `bake-gem-github` through GitHub Actions. Each adopting repository still needs its own reviewed setup and successful release. Public single-gem repositories, ordinary stable versions, merge/squash, GitHub-hosted Linux runners, and RubyGems.org are the supported starting point. +The process has published `bake-gem-github` through GitHub Actions. Each adopting repository still needs its own reviewed setup and successful release. Public single-gem repositories, ordinary stable versions, single-commit release PRs using squash/rebase/merge, GitHub-hosted Linux runners, and RubyGems.org are the supported starting point. Native build matrices, reusable publisher workflows, merge queues, automated RubyGems ownership/MFA setup, cross-run artifact recovery, and organization-wide migration are outside the current setup tasks. diff --git a/guides/preparing-releases/readme.md b/guides/preparing-releases/readme.md index 89f885f..322ec4e 100644 --- a/guides/preparing-releases/readme.md +++ b/guides/preparing-releases/readme.md @@ -19,11 +19,20 @@ gh workflow run release-prepare.yaml -f bump=patch Replace `patch` with `minor` or `major`. The wrapper fetches the default branch and tags, refuses a stale local checkout, and validates an existing release PR before returning its URL. A matching local or remote branch is reused if PR creation was interrupted. Multiple open release PRs or a different requested bump stop preparation. GitHub's built-in token may require a writer to approve running workflows for its created PR; enable Actions' permission to create PRs. An organization-owned App token can be adopted later if automatic CI triggering is needed. -All release changes belong in the PR. Core preparation commits additions and deletions from release hooks but never pushes, tags or publishes. Validation independently generates the expected tree from the current base. A changed base SHA alone is fine; changed generated notes are not. Ordinary PRs with no version change pass release validation and still build unsigned. +All release changes belong in one commit, including the version bump and generated files. Core preparation commits additions and deletions from release hooks but never pushes, tags or publishes. Validation independently generates the expected tree from the current base and requires exactly one commit ahead of that base. A changed base SHA alone is fine; changed generated notes are not. Ordinary PRs with no version change have no commit limit and still build unsigned. + +To run the same content and commit-count validation locally from a release branch: + +``` bash +git fetch origin main +bundle exec bake gem:github:release:validate base=origin/main +``` + +Replace `main` with your configured default branch. When correcting a release, amend the existing commit or regenerate it with `refresh=true` instead of adding fixup commits. Amended content must still match the generated release; changes to release notes or generation hooks usually belong on the default branch followed by a refresh. ## Publish the merged release -Merging into the configured default branch triggers `release-publish.yaml` through its `push` event. Inspection uses the exact pushed SHA and resolves its associated PR through GitHub. Publication requires one matching merged PR in this repository, targeting the configured branch, with that exact merge commit. Ordinary changes do not publish; release changes without a matching merged PR fail inspection. Both merge commits and squash merges are supported, including merged fork PRs. +Merging into the configured default branch triggers `release-publish.yaml` through its `push` event. Inspection uses the exact pushed SHA and resolves its associated PR through GitHub. Publication requires one matching merged PR in this repository, targeting the configured branch, with that exact resulting commit. Ordinary changes do not publish; release changes without a matching merged PR fail inspection. Single-commit release PRs support squash merging, rebase merging, and merge commits, including merged fork PRs. Publishing validates against the resulting commit's first parent, which is the default branch immediately before the release landed. Each release must land as the tip of its own push, as it does when merging a PR through GitHub. Later pushes do not change a pending release's source: inspection and publishing remain pinned to the original commit, and reruns use the same event. Do not combine a release and later changes into one direct push. If you automate merging, use a GitHub App or personal access token; pushes made using a workflow's `GITHUB_TOKEN` do not trigger another workflow. @@ -45,4 +54,4 @@ bundle exec bake gem:github:release:patch refresh=true gh workflow run release-prepare.yaml -f bump=patch -f refresh=true ``` -Refresh first pushes the complete previous release commit to `release-backups/vVERSION/OLD_SHA`, including manual edits. It then regenerates in a clean worktree from the current default branch, validates, and updates the existing release branch using an explicit `--force-with-lease`. A concurrent remote edit causes the push to fail. Existing local release branches are left intact. Review the backup against the refreshed PR; incorporate necessary manual changes into the default branch or generation hooks and refresh again. Keep the backup until that review is complete. Replace `main` and `patch` with your configured branch and original bump type. +Refresh first pushes the complete previous release commit to `release-backups/vVERSION/OLD_SHA`, including manual edits. It then regenerates one release commit in a clean worktree from the current default branch, validates, and updates the existing release branch using an explicit `--force-with-lease`. A concurrent remote edit causes the push to fail. Existing local release branches are left intact. Review the backup against the refreshed PR; incorporate necessary manual changes into the default branch or generation hooks and refresh again. Keep the backup until that review is complete. Replace `main` and `patch` with your configured branch and original bump type. diff --git a/guides/verifying-releases/readme.md b/guides/verifying-releases/readme.md index a4228db..2471174 100644 --- a/guides/verifying-releases/readme.md +++ b/guides/verifying-releases/readme.md @@ -6,7 +6,7 @@ Use this when checking a completed release or confirming which source commit pro ## What publishing verifies -After merge/squash, the publishing workflow verifies GitHub's merged PR record and ancestry, then checks out the exact merged commit. Later development on the default branch is allowed. It regenerates against the merged commit's **first parent**, builds in a clean worktree, optionally certificate-signs, and creates two attestations over the final bytes: +After squash, rebase, or merge, the publishing workflow verifies GitHub's merged PR record and ancestry, then checks out the exact resulting commit. Each release PR contains one commit, so the resulting commit's **first parent** is the default branch immediately before the release landed. Later development on the default branch is allowed. Publishing regenerates against that first parent, builds in a clean worktree, optionally certificate-signs, and creates two attestations over the final bytes: - A Sigstore bundle submitted explicitly with `gem push --attestation` using RubyGems 4.0.21. - GitHub's native SLSA provenance covering both the gem and `release.json`. This signed receipt binds the gem digest to the exact release commit, even when the workflow's own default-branch revision is newer. diff --git a/lib/bake/gem/github/project.rb b/lib/bake/gem/github/project.rb index 0012038..34b896e 100644 --- a/lib/bake/gem/github/project.rb +++ b/lib/bake/gem/github/project.rb @@ -78,7 +78,7 @@ def prepare(context, bump, refresh: false) candidate = @release.resolve("HEAD") end - metadata = @release.validate(base: base, candidate: candidate) + metadata = validate(base: base, candidate: candidate, optional: false) raise "Release branch does not contain the requested version #{version}." unless metadata.fetch(:version) == version push("--force-with-lease=#{release_ref}:#{remote_commit}", "#{candidate}:#{release_ref}") @@ -90,6 +90,23 @@ def prepare(context, bump, refresh: false) ) end + # Validate PR content and require each proposed release to contain exactly one commit. + # @parameter base [String] The current target commit. + # @parameter candidate [String] The proposed PR head. + # @parameter optional [Boolean] Accept ordinary PRs without a version change. + # @returns [Hash | Nil] Release metadata, or nil for an ordinary PR. + # @raises [RuntimeError] If the release content is invalid or the release contains multiple commits. + def validate(base:, candidate: "HEAD", optional: true) + metadata = @release.validate(base: base, candidate: candidate, optional: optional) + if metadata + range = "#{metadata.fetch(:base)}..#{metadata.fetch(:commit)}" + count = readlines("git", "rev-list", "--count", range, chdir: @root).join.strip + raise "Release PRs must contain exactly one commit. Amend or regenerate the release commit instead of adding commits." unless count == "1" + end + + return metadata + end + # Resolve a merged PR through GitHub, and require its actual merge commit in default-branch history. # @parameter number [String | Integer] The positive PR number. # @returns [Hash] GitHub PR data with string keys, including `number` and `merge_commit_sha`. diff --git a/lib/bake/gem/github/setup.rb b/lib/bake/gem/github/setup.rb index d9dd766..81d75fb 100644 --- a/lib/bake/gem/github/setup.rb +++ b/lib/bake/gem/github/setup.rb @@ -89,7 +89,7 @@ def self.rules(config) require_last_push_approval: true, required_review_thread_resolution: true, require_code_owner_review: false, - allowed_merge_methods: ["merge", "squash"], + allowed_merge_methods: ["merge", "squash", "rebase"], }, }], ), diff --git a/readme.md b/readme.md index 8bdda19..234dd6f 100644 --- a/readme.md +++ b/readme.md @@ -24,6 +24,10 @@ Please see the [project documentation](https://socketry.github.io/bake-gem-githu Please see the [project releases](https://socketry.github.io/bake-gem-github/releases/index) for all releases. +### Unreleased + + - Support rebase merging by requiring each release PR to contain exactly one commit, while leaving ordinary PRs unrestricted. Generated rules allow merge, squash, and rebase methods according to repository settings. + ### v0.4.0 - Reject Secret environment reviewer teams before applying release settings, and verify that GitHub retained the requested reviewers and existing protections after updating the environment. diff --git a/releases.md b/releases.md index 0cc96e0..9da4293 100644 --- a/releases.md +++ b/releases.md @@ -1,5 +1,9 @@ # Releases +## Unreleased + + - Support rebase merging by requiring each release PR to contain exactly one commit, while leaving ordinary PRs unrestricted. Generated rules allow merge, squash, and rebase methods according to repository settings. + ## v0.4.0 - Reject Secret environment reviewer teams before applying release settings, and verify that GitHub retained the requested reviewers and existing protections after updating the environment. diff --git a/templates/release-validate.yaml.erb b/templates/release-validate.yaml.erb index 993ef08..bcf0e70 100644 --- a/templates/release-validate.yaml.erb +++ b/templates/release-validate.yaml.erb @@ -27,6 +27,6 @@ jobs: - name: Regenerate release content env: RELEASE_BASE: ${{ github.event.pull_request.base.sha }} - run: bundle exec bake gem:release:validate "base=$RELEASE_BASE" optional=true + run: bundle exec bake gem:github:release:validate "base=$RELEASE_BASE" - name: Build unsigned package run: bundle exec bake gem:build signing_key=false diff --git a/test/bake/gem/github/project/inspect_commit.rb b/test/bake/gem/github/project/inspect_commit.rb index 390c382..39db91e 100644 --- a/test/bake/gem/github/project/inspect_commit.rb +++ b/test/bake/gem/github/project/inspect_commit.rb @@ -129,18 +129,36 @@ def configure_pull end end - with "squash merges" do - before do - isolated_project('Bake::Gem::GitHub::ProjectClient.new(Dir.pwd).prepare(Bake::Context.load(Dir.pwd), "patch")') + %w[squash rebase merge].each do |method| + it "resolves the actual release commit after merging", unique: method do + isolated_project('Bake::Context.load.call("gem:release:branch:patch")') + original = git("rev-parse", "HEAD") git("checkout", "--quiet", "main") - git("merge", "--quiet", "--squash", "releases/v1.0.1") - git("commit", "--quiet", "-m", "Squash release") - git("push", "--quiet", "origin", "main") + + case method + when "squash" + git("merge", "--quiet", "--squash", "releases/v1.0.1") + git("commit", "--quiet", "-m", "Squash release") + when "rebase" + git("commit", "--quiet", "--allow-empty", "-m", "Advance main") + git("checkout", "--quiet", "releases/v1.0.1") + git("rebase", "--quiet", "main") + git("checkout", "--quiet", "main") + git("merge", "--quiet", "--ff-only", "releases/v1.0.1") + when "merge" + git("merge", "--quiet", "--no-ff", "releases/v1.0.1", "-m", "Merge release") + end + + base = git("rev-parse", "HEAD^1") + pull["head"] = {"sha" => original} configure_pull - end - - it "resolves the squash commit to its release PR" do - expect(project.inspect_commit(commit)).to have_keys(version: be == "1.0.1", commit: be == commit, pull_request: be == 42) + git("commit", "--quiet", "--allow-empty", "-m", "Later development") + git("push", "--quiet", "origin", "main") + + expect(commit).not.to be == original + expect(project.inspect_commit(commit)).to have_keys( + version: be == "1.0.1", commit: be == commit, base: be == base, pull_request: be == 42, + ) end end end diff --git a/test/bake/gem/github/project/prepare.rb b/test/bake/gem/github/project/prepare.rb index 5990b82..782898d 100644 --- a/test/bake/gem/github/project/prepare.rb +++ b/test/bake/gem/github/project/prepare.rb @@ -56,6 +56,15 @@ def advance_main expect(git("rev-parse", "releases/v1.0.1", chdir: File.join(root, "remote"))).to be == original end + it "rejects multiple release commits before pushing or opening a PR" do + isolated_project('Bake::Context.load.call("gem:release:branch:patch")') + git("commit", "--quiet", "--allow-empty", "-m", "Extra release commit") + git("checkout", "--quiet", "main") + + expect{prepare}.to raise_exception(RuntimeError, message: be =~ /exactly one commit/) + expect(git("ls-remote", "--heads", "origin", "releases/v1.0.1")).to be == "" + end + it "rejects stale generated content without changing the release branch" do prepare original = git("rev-parse", "HEAD") diff --git a/test/bake/gem/github/project/validate.rb b/test/bake/gem/github/project/validate.rb new file mode 100644 index 0000000..1dae713 --- /dev/null +++ b/test/bake/gem/github/project/validate.rb @@ -0,0 +1,65 @@ +# frozen_string_literal: true + +# Released under the MIT License. +# Copyright, 2026, by Samuel Williams. + +require "bake/gem/github/repository_context" +require "bake/gem/github/project_client" + +describe Bake::Gem::GitHub::Project do + include Bake::Gem::GitHub::RepositoryContext + + let(:project) {Bake::Gem::GitHub::ProjectClient.new(repository)} + + with "#validate" do + it "accepts a single generated release commit through the public task" do + isolated_project('Bake::Context.load.call("gem:release:branch:patch")') + commit = git("rev-parse", "HEAD") + git("checkout", "--quiet", "main") + result = isolated_project('Bake::Context.load.call("gem:github:release:validate", "base=main", "candidate=releases/v1.0.1")') + + expect(result).to have_keys(version: be == "1.0.1", bump: be == "patch", commit: be == commit, base: be == git("rev-parse", "main")) + end + + it "accepts ordinary PRs containing multiple commits without GitHub access" do + git("checkout", "--quiet", "-b", "feature") + 2.times do |index| + File.write(File.join(repository, "readme.md"), "Change #{index}.\n") + git("add", "readme.md") + git("commit", "--quiet", "-m", "Change #{index}") + end + + expect(project.validate(base: "main")).to be_nil + expect(project.requests).to be == [] + end + + it "rejects a correct release tree split across multiple commits" do + isolated_project('Bake::Context.load.call("gem:release:branch:patch")') + expected_tree = git("rev-parse", "HEAD^{tree}") + git("reset", "--quiet", "--mixed", "main") + git("add", "lib/example/version.rb") + git("commit", "--quiet", "-m", "Bump version") + git("add", "releases.md") + git("commit", "--quiet", "-m", "Update release notes") + + expect(git("rev-parse", "HEAD^{tree}")).to be == expected_tree + expect{project.validate(base: "main")}.to raise_exception(RuntimeError, message: be =~ /exactly one commit/) + end + + it "rejects an extra empty commit on a release PR" do + isolated_project('Bake::Context.load.call("gem:release:branch:patch")') + git("commit", "--quiet", "--allow-empty", "-m", "Extra commit") + + expect{project.validate(base: "main")}.to raise_exception(RuntimeError, message: be =~ /Amend or regenerate/) + end + + it "still rejects unrelated changes in a single release commit" do + isolated_project('Bake::Context.load.call("gem:release:branch:patch")') + File.write(File.join(repository, "unrelated.md"), "Unrelated content.\n") + git("add", "unrelated.md") + git("commit", "--quiet", "--amend", "--no-edit") + + expect{project.validate(base: "main")}.to raise_exception(RuntimeError, message: be =~ /stale or contains unrelated changes/) + end + end +end diff --git a/test/bake/gem/github/setup.rb b/test/bake/gem/github/setup.rb index 8177687..b65b0ea 100644 --- a/test/bake/gem/github/setup.rb +++ b/test/bake/gem/github/setup.rb @@ -26,7 +26,7 @@ def generate expect(config.fetch("signing")).to be == false expect(config.fetch("approvals")).to be == 2 expect(config.fetch("reviewers")).to be == ["socketry/managers", "ioquatix"] - %w[resolve build publish resume patch minor major].each do |name| + %w[validate resolve build publish resume patch minor major].each do |name| expect(context.lookup("gem:github:release:#{name}")).not.to be_nil end end @@ -47,6 +47,9 @@ def generate expect(checks.dig("rules", 0, "parameters", "strict_required_status_checks_policy")).to be == true expect(checks.dig("bypass_actors", 0, "bypass_mode")).to be == "pull_request" + reviews = JSON.parse(File.read(File.join(root, ".github/release-rules/reviews.json"))) + + expect(reviews.dig("rules", 0, "parameters", "allowed_merge_methods")).to be == ["merge", "squash", "rebase"] end [nil, [], "socketry/managers", [nil], [""], ["@socketry/managers"], ["socketry/managers/other"], ["invalid?name"], Array.new(7, "ioquatix")].each do |reviewers| @@ -73,6 +76,8 @@ def generate expect(validation).not.to be(:include?, "secrets.") expect(validation).not.to be(:include?, "id-token") expect(validation).not.to be(:include?, "pull_request_target") + expect(validation).to be(:include?, 'bundle exec bake gem:github:release:validate "base=$RELEASE_BASE"') + expect(validation).to be(:include?, "bundle exec bake gem:build signing_key=false") publish = File.read(File.join(root, ".github/workflows/release-publish.yaml")) expect(publish).not.to be(:include?, "pull_request_target")