yunchan/d3ro-voice
1
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

ci: allow protected mobile candidate

Browse source
This commit is contained in:
Yun Chan 2026-08-30 09:20:49 +09:00
parent 4872d6f6c5
commit 1f71cf6fae
3 changed files with 797 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

41
scripts/ci/verify-mobile-release-boundary.mjs
View file

@ -190,6 +190,47 @@ function verifySourceContracts() {
assert(releaseWorkflow.includes('test "$GITHUB_SHA" = "$(git rev-parse origin/main)"'), 'dispatch_main_sha_guard_missing')
assert(releaseWorkflow.includes('test "$RELEASE_TAG" = "v$VERSION_NAME"'), 'release_tag_identity_guard_missing')
const gitlabWorkflow = readWorkspaceFile('.gitlab-ci.yml')
const mobileProductionJobStart = gitlabWorkflow.indexOf('mobile-production-release:\n')
const publishReleaseJobStart = gitlabWorkflow.indexOf('\npublish-release:\n')
assert(mobileProductionJobStart >= 0, 'gitlab_mobile_production_job_missing')
assert(publishReleaseJobStart > mobileProductionJobStart, 'gitlab_publish_release_job_missing')
const mobileProductionJob = gitlabWorkflow.slice(mobileProductionJobStart, publishReleaseJobStart)
const publishReleaseJob = gitlabWorkflow.slice(publishReleaseJobStart)
for (const required of [
'git fetch --no-tags origin main:refs/remotes/origin/main',
'test "${CI_COMMIT_REF_PROTECTED:-}" = "true"',
'test -z "${CI_COMMIT_BRANCH:-}"',
'test "$CI_COMMIT_TAG" = "v${VERSION_NAME}"',
'test "$(git rev-parse "refs/tags/${CI_COMMIT_TAG}^{commit}")" = "$CI_COMMIT_SHA"',
'RELEASE_GIT_REF="refs/tags/${CI_COMMIT_TAG}"',
'test "${CI_COMMIT_BRANCH:-}" = "main"',
'test "$CI_COMMIT_SHA" = "$(git rev-parse origin/main)"',
'RELEASE_GIT_REF="refs/heads/main"',
'--git-ref "$RELEASE_GIT_REF"',
'--expected-git-ref "$RELEASE_GIT_REF"',
'$CI_COMMIT_REF_PROTECTED == "true" && $CI_COMMIT_TAG =~ /^v\\d+\\.\\d+\\.\\d+$/',
'$CI_COMMIT_REF_PROTECTED == "true" && $CI_COMMIT_BRANCH == "main"',
]) {
assert(
mobileProductionJob.includes(required),
`gitlab_mobile_candidate_contract_missing_${required.replace(/[^a-z0-9]+/gi, '_')}`,
)
}
assert(
(mobileProductionJob.match(/\n\s+when: manual/g) ?? []).length === 2,
'gitlab_mobile_candidate_manual_rules_invalid',
)
assert(
!mobileProductionJob.includes('--git-ref "refs/tags/$CI_COMMIT_TAG"'),
'gitlab_mobile_evidence_ref_tag_only',
)
assert(
publishReleaseJob.includes('$CI_COMMIT_TAG =~ /^v\\d+\\.\\d+\\.\\d+.*$/'),
'gitlab_public_release_stable_tag_rule_missing',
)
assert(!publishReleaseJob.includes('CI_COMMIT_BRANCH'), 'gitlab_public_release_branch_trigger_enabled')
const packageJson = JSON.parse(readWorkspaceFile('package.json'))
assert(
packageJson.scripts?.['release:mobile:boundary'] === 'node scripts/ci/verify-mobile-release-boundary.mjs',