ci(release): read package versions from root version files

.github/scripts/release/get-release-tag-context.sh

@@ -39,7 +39,7 @@ workflow_push_paths() {
 }
 
 main() {
-  local version release_type message tag_type previous_tag="" file_version changed="false" diff_output
+  local version release_type message tag_type previous_tag="" file_version changed="false" diff_output versioned="false"
   local -a patterns=() files=()
 
   if [[ ! "$TAG_NAME" =~ ^$TAG_PREFIX-([0-9]{8})$ ]]; then
@@ -81,7 +81,12 @@ main() {
     if [[ -n "$diff_output" ]]; then
       mapfile -t files <<< "$diff_output"
     fi
+    for pattern in "${patterns[@]}"; do
+      [[ "$pattern" == .version.* ]] && versioned="true"
+    done
     for file in "${files[@]}"; do
+      # a versioned package ships through its root .version.* file: its ci changes alone don't make a release
+      [[ "$versioned" == "true" && "$file" == .github/* ]] && continue
       for pattern in "${patterns[@]}"; do
         # unquoted pattern: glob match where * also spans /, so ** behaves like the workflow filter
         # shellcheck disable=SC2053

.github/scripts/release/release-new.sh

@@ -120,9 +120,65 @@ check_tags() {
     fail "release_number $RELEASE_NUMBER must be greater than latest release tag $latest."
   else
     info "previous release tag is $latest"
+    PREVIOUS_TAG="$latest"
   fi
 }
 
+# prints VERSION-RELEASE of a root .version.<package> file at a commit
+package_version() {
+  local content
+  content="$(git show "$1:$2")"
+  echo "$(sed -n 's/^VERSION=//p' <<< "$content")-$(sed -n 's/^RELEASE=//p' <<< "$content")"
+}
+
+# packages with a fixed version: "<root version file> <content pathspecs...>"; the version file must go up
+# when the content changed since the previous release tag, else the build would reuse a released version
+VERSIONED_PACKAGES=(
+  ".version.stream-connectors-lib modules/centreon-stream-connectors-lib packaging/connectors-lib"
+  ".version.lua-base64 dependencies/lua-base64"
+  ".version.lua-cffi dependencies/lua-cffi"
+  ".version.lua-lsqlite3 dependencies/lua-lsqlite3"
+  ".version.lua-openssl dependencies/lua-openssl"
+  ".version.lua-sql-mysql dependencies/lua-sql-mysql"
+  ".version.lua-tz dependencies/lua-tz"
+)
+
+check_version_bumps() {
+  local package version_file content_paths changed previous_version new_version missing=() unchecked=()
+  local -a content
+  [[ -n "${PREVIOUS_TAG:-}" ]] || return 0
+  git fetch --quiet --depth=1 "$REMOTE" "+refs/tags/$PREVIOUS_TAG:refs/tags/$PREVIOUS_TAG" \
+    || fail "cannot fetch $PREVIOUS_TAG."
+
+  for package in "${VERSIONED_PACKAGES[@]}"; do
+    read -r version_file content_paths <<< "$package"
+    read -ra content <<< "$content_paths"
+    git cat-file -e "$RELEASE_SHA:$version_file" 2> /dev/null || fail "$version_file does not exist on $RELEASE_BRANCH."
+    if ! git cat-file -e "refs/tags/$PREVIOUS_TAG:$version_file" 2> /dev/null; then
+      unchecked+=("$version_file")
+      continue
+    fi
+    changed="$(git -c core.quotePath=false diff --no-renames --name-only "refs/tags/$PREVIOUS_TAG" "$RELEASE_SHA" -- "${content[@]}")" \
+      || fail "cannot diff $PREVIOUS_TAG and $RELEASE_BRANCH."
+    [[ -n "$changed" ]] || continue
+    previous_version="$(package_version "refs/tags/$PREVIOUS_TAG" "$version_file")"
+    new_version="$(package_version "$RELEASE_SHA" "$version_file")"
+    # the version must go up: a forward-ported hotfix rebuilt under an older version would be refused or shadowed
+    if [[ "$new_version" == "$previous_version" ]] \
+      || [[ "$(printf '%s\n%s\n' "$previous_version" "$new_version" | sort -V | tail -n 1)" != "$new_version" ]]; then
+      missing+=("$version_file $previous_version -> $new_version ($(echo "$changed" | head -n 3 | paste -sd ' ' -))")
+    fi
+  done
+
+  if (( ${#unchecked[@]} > 0 )); then
+    warn "not checked, no version file in $PREVIOUS_TAG: ${unchecked[*]}"
+  fi
+  if (( ${#missing[@]} > 0 )); then
+    fail "content changed since $PREVIOUS_TAG without a higher version: ${missing[*]}"
+  fi
+  info "versions are bumped for every changed package"
+}
+
 create_tag() {
   info "tagging $RELEASE_SHA ($RELEASE_BRANCH) with $RELEASE_TAG: \"$RELEASE_TYPE $RELEASE_TAG\""
   run git -c user.name="Centreon" -c user.email="release@centreon.com" \
@@ -189,6 +245,7 @@ main() {
   check_branch
   check_versions
   check_tags
+  check_version_bumps
 
   create_tag
   create_github_release

.github/workflows/lua-base64.yml

@@ -9,6 +9,7 @@ on:
   pull_request:
     paths:
       - '.github/workflows/lua-base64.yml'
+      - '.version.lua-base64'
       - 'dependencies/lua-base64/**'
   push:
     branches:
@@ -18,6 +19,7 @@ on:
       - 'centreon-stream-connectors-[0-9]+'
     paths:
       - '.github/workflows/lua-base64.yml'
+      - '.version.lua-base64'
       - 'dependencies/lua-base64/**'
 
 jobs:
@@ -80,15 +82,28 @@ jobs:
           cp base64-src/base64.lua dependencies/lua-base64/lbase64/base64.lua
         shell: bash
 
+      - name: Get package version
+        id: package-version
+        run: |
+          VERSION="$(sed -n 's/^VERSION=//p' .version.lua-base64)"
+          RELEASE="$(sed -n 's/^RELEASE=//p' .version.lua-base64)"
+          if [[ ! "$VERSION" =~ ^[0-9][0-9A-Za-z.]*$ || ! "$RELEASE" =~ ^[0-9]+$ ]]; then
+            echo "::error::.version.lua-base64 must hold VERSION=<version> and RELEASE=<number> (got '$VERSION' and '$RELEASE')"
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "release=$RELEASE" >> "$GITHUB_OUTPUT"
+        shell: bash
+
       - name: Package
         uses: ./.github/actions/package-nfpm
         with:
           nfpm_file_pattern: "dependencies/lua-base64/packaging/*.yaml"
           distrib: ${{ matrix.distrib }}
           package_extension: ${{ matrix.package_extension }}
           arch: all
-          version: "1.5.3"
-          release: "1"
+          version: ${{ steps.package-version.outputs.version }}
+          release: ${{ steps.package-version.outputs.release }}
           commit_hash: ${{ github.sha }}
           cache_key: ${{ github.sha }}-${{ github.run_id }}-${{ matrix.package_extension }}-lua-base64-${{ matrix.distrib }}
           rpm_gpg_key: ${{ secrets.RPM_GPG_SIGNING_KEY }}

.github/workflows/lua-cffi.yml

@@ -9,6 +9,7 @@ on:
   pull_request:
     paths:
       - '.github/workflows/lua-cffi.yml'
+      - '.version.lua-cffi'
       - 'dependencies/lua-cffi/**'
   push:
     branches:
@@ -18,6 +19,7 @@ on:
       - 'centreon-stream-connectors-[0-9]+'
     paths:
       - '.github/workflows/lua-cffi.yml'
+      - '.version.lua-cffi'
       - 'dependencies/lua-cffi/**'
 
 jobs:
@@ -106,15 +108,28 @@ jobs:
           mv cffi-lua-src/build/cffi.so dependencies/lua-cffi/lua-cffi/
         shell: bash
 
+      - name: Get package version
+        id: package-version
+        run: |
+          VERSION="$(sed -n 's/^VERSION=//p' .version.lua-cffi)"
+          RELEASE="$(sed -n 's/^RELEASE=//p' .version.lua-cffi)"
+          if [[ ! "$VERSION" =~ ^[0-9][0-9A-Za-z.]*$ || ! "$RELEASE" =~ ^[0-9]+$ ]]; then
+            echo "::error::.version.lua-cffi must hold VERSION=<version> and RELEASE=<number> (got '$VERSION' and '$RELEASE')"
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "release=$RELEASE" >> "$GITHUB_OUTPUT"
+        shell: bash
+
       - name: Package
         uses: ./.github/actions/package-nfpm
         with:
           nfpm_file_pattern: "dependencies/lua-cffi/packaging/*.yaml"
           distrib: ${{ matrix.distrib }}
           package_extension: ${{ matrix.package_extension }}
           arch: amd64
-          version: "0.2.4"
-          release: "2"
+          version: ${{ steps.package-version.outputs.version }}
+          release: ${{ steps.package-version.outputs.release }}
           commit_hash: ${{ github.sha }}
           cache_key: ${{ github.sha }}-${{ github.run_id }}-${{ matrix.package_extension }}-lua-cffi-${{ matrix.distrib }}
           rpm_gpg_key: ${{ secrets.RPM_GPG_SIGNING_KEY }}

.github/workflows/lua-lsqlite3.yml

@@ -9,6 +9,7 @@ on:
   pull_request:
     paths:
       - '.github/workflows/lua-lsqlite3.yml'
+      - '.version.lua-lsqlite3'
       - 'dependencies/lua-lsqlite3/**'
   push:
     branches:
@@ -18,6 +19,7 @@ on:
       - 'centreon-stream-connectors-[0-9]+'
     paths:
       - '.github/workflows/lua-lsqlite3.yml'
+      - '.version.lua-lsqlite3'
       - 'dependencies/lua-lsqlite3/**'
 
 jobs:
@@ -98,15 +100,28 @@ jobs:
           gcc -O2 -fPIC -shared -o lsqlite3.so lsqlite3.c -DLSQLITE_VERSION='"${LSQLITE3_VERSION}"' $(pkg-config --cflags lua${LUA_VERSION}) $(pkg-config --cflags --libs sqlite3)
         shell: bash
 
+      - name: Get package version
+        id: package-version
+        run: |
+          VERSION="$(sed -n 's/^VERSION=//p' .version.lua-lsqlite3)"
+          RELEASE="$(sed -n 's/^RELEASE=//p' .version.lua-lsqlite3)"
+          if [[ ! "$VERSION" =~ ^[0-9][0-9A-Za-z.]*$ || ! "$RELEASE" =~ ^[0-9]+$ ]]; then
+            echo "::error::.version.lua-lsqlite3 must hold VERSION=<version> and RELEASE=<number> (got '$VERSION' and '$RELEASE')"
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "release=$RELEASE" >> "$GITHUB_OUTPUT"
+        shell: bash
+
       - name: Package
         uses: ./.github/actions/package-nfpm
         with:
           nfpm_file_pattern: "dependencies/lua-lsqlite3/packaging/*.yaml"
           distrib: ${{ matrix.distrib }}
           package_extension: ${{ matrix.package_extension }}
           arch: amd64
-          version: "0.9.7"
-          release: "1"
+          version: ${{ steps.package-version.outputs.version }}
+          release: ${{ steps.package-version.outputs.release }}
           commit_hash: ${{ github.sha }}
           cache_key: ${{ github.sha }}-${{ github.run_id }}-${{ matrix.package_extension }}-lua-lsqlite3-${{ matrix.distrib }}
           rpm_gpg_key: ${{ secrets.RPM_GPG_SIGNING_KEY }}

.github/workflows/lua-openssl.yml

@@ -9,6 +9,7 @@ on:
   pull_request:
     paths:
       - '.github/workflows/lua-openssl.yml'
+      - '.version.lua-openssl'
       - 'dependencies/lua-openssl/**'
   push:
     branches:
@@ -18,6 +19,7 @@ on:
       - 'centreon-stream-connectors-[0-9]+'
     paths:
       - '.github/workflows/lua-openssl.yml'
+      - '.version.lua-openssl'
       - 'dependencies/lua-openssl/**'
 
 jobs:
@@ -111,15 +113,28 @@ jobs:
           cp lua-openssl-src/build/openssl.so dependencies/lua-openssl/lua-openssl/
         shell: bash
 
+      - name: Get package version
+        id: package-version
+        run: |
+          VERSION="$(sed -n 's/^VERSION=//p' .version.lua-openssl)"
+          RELEASE="$(sed -n 's/^RELEASE=//p' .version.lua-openssl)"
+          if [[ ! "$VERSION" =~ ^[0-9][0-9A-Za-z.]*$ || ! "$RELEASE" =~ ^[0-9]+$ ]]; then
+            echo "::error::.version.lua-openssl must hold VERSION=<version> and RELEASE=<number> (got '$VERSION' and '$RELEASE')"
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "release=$RELEASE" >> "$GITHUB_OUTPUT"
+        shell: bash
+
       - name: Package
         uses: ./.github/actions/package-nfpm
         with:
           nfpm_file_pattern: "dependencies/lua-openssl/packaging/*.yaml"
           distrib: ${{ matrix.distrib }}
           package_extension: ${{ matrix.package_extension }}
           arch: amd64
-          version: "0.11.1"
-          release: "1"
+          version: ${{ steps.package-version.outputs.version }}
+          release: ${{ steps.package-version.outputs.release }}
           commit_hash: ${{ github.sha }}
           cache_key: ${{ github.sha }}-${{ github.run_id }}-${{ matrix.package_extension }}-lua-openssl-${{ matrix.distrib }}
           rpm_gpg_key: ${{ secrets.RPM_GPG_SIGNING_KEY }}

.github/workflows/lua-sql-mysql.yml

@@ -9,6 +9,7 @@ on:
   pull_request:
     paths:
       - '.github/workflows/lua-sql-mysql.yml'
+      - '.version.lua-sql-mysql'
       - 'dependencies/lua-sql-mysql/**'
   push:
     branches:
@@ -18,6 +19,7 @@ on:
       - 'centreon-stream-connectors-[0-9]+'
     paths:
       - '.github/workflows/lua-sql-mysql.yml'
+      - '.version.lua-sql-mysql'
       - 'dependencies/lua-sql-mysql/**'
 
 jobs:
@@ -92,15 +94,28 @@ jobs:
           sed -i "s/@mysql_version@/${MYSQL_VERSION}/g" dependencies/lua-sql-mysql/packaging/lua-sql-mysql.yaml
         shell: bash
 
+      - name: Get package version
+        id: package-version
+        run: |
+          VERSION="$(sed -n 's/^VERSION=//p' .version.lua-sql-mysql)"
+          RELEASE="$(sed -n 's/^RELEASE=//p' .version.lua-sql-mysql)"
+          if [[ ! "$VERSION" =~ ^[0-9][0-9A-Za-z.]*$ || ! "$RELEASE" =~ ^[0-9]+$ ]]; then
+            echo "::error::.version.lua-sql-mysql must hold VERSION=<version> and RELEASE=<number> (got '$VERSION' and '$RELEASE')"
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "release=$RELEASE" >> "$GITHUB_OUTPUT"
+        shell: bash
+
       - name: Package
         uses: ./.github/actions/package-nfpm
         with:
           nfpm_file_pattern: "dependencies/lua-sql-mysql/packaging/*.yaml"
           distrib: ${{ matrix.distrib }}
           package_extension: rpm
           arch: amd64
-          version: "2.7.0"
-          release: "1"
+          version: ${{ steps.package-version.outputs.version }}
+          release: ${{ steps.package-version.outputs.release }}
           commit_hash: ${{ github.sha }}
           cache_key: ${{ github.sha }}-${{ github.run_id }}-rpm-lua-sql-mysql-${{ matrix.distrib }}
           rpm_gpg_key: ${{ secrets.RPM_GPG_SIGNING_KEY }}

.github/workflows/lua-tz.yml

@@ -9,6 +9,7 @@ on:
   pull_request:
     paths:
       - '.github/workflows/lua-tz.yml'
+      - '.version.lua-tz'
       - 'dependencies/lua-tz/**'
   push:
     branches:
@@ -18,6 +19,7 @@ on:
       - 'centreon-stream-connectors-[0-9]+'
     paths:
       - '.github/workflows/lua-tz.yml'
+      - '.version.lua-tz'
       - 'dependencies/lua-tz/**'
 
 jobs:
@@ -78,15 +80,28 @@ jobs:
         run: cp -r luatz-src/luatz dependencies/lua-tz/lua-tz
         shell: bash
 
+      - name: Get package version
+        id: package-version
+        run: |
+          VERSION="$(sed -n 's/^VERSION=//p' .version.lua-tz)"
+          RELEASE="$(sed -n 's/^RELEASE=//p' .version.lua-tz)"
+          if [[ ! "$VERSION" =~ ^[0-9][0-9A-Za-z.]*$ || ! "$RELEASE" =~ ^[0-9]+$ ]]; then
+            echo "::error::.version.lua-tz must hold VERSION=<version> and RELEASE=<number> (got '$VERSION' and '$RELEASE')"
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "release=$RELEASE" >> "$GITHUB_OUTPUT"
+        shell: bash
+
       - name: Package
         uses: ./.github/actions/package-nfpm
         with:
           nfpm_file_pattern: "dependencies/lua-tz/packaging/*.yaml"
           distrib: ${{ matrix.distrib }}
           package_extension: ${{ matrix.package_extension }}
           arch: all
-          version: "0.5"
-          release: "1"
+          version: ${{ steps.package-version.outputs.version }}
+          release: ${{ steps.package-version.outputs.release }}
           commit_hash: ${{ github.sha }}
           cache_key: ${{ github.sha }}-${{ github.run_id }}-${{ matrix.package_extension }}-lua-tz-${{ matrix.distrib }}
           rpm_gpg_key: ${{ secrets.RPM_GPG_SIGNING_KEY }}