From 8b22da1b8feebdd9d553b40b4a30813ba50ced0e Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Tue, 3 Nov 2026 21:46:14 -0600 Subject: [PATCH] chore/release: open the sourcegraph MinimumVersion bump PR automatically Every Sourcegraph instance serves the src-cli version pinned in sourcegraph/sourcegraph `internal/src-cli/consts.go` (`MinimumVersion`) from `/.api/src-cli/version`, so a release is invisible to instances until someone also hand-edits that constant, `dev/tool_deps.bzl`, and `MODULE.bazel.lock`. That step is easy to forget: src-cli 8.0.0 shipped in September and sourcegraph.com still recommends 7.6.0. The release workflow now runs a `sourcegraph_bump` job after every new latest release. It checks out sourcegraph/sourcegraph, applies the three edits with the tarball checksums from the release's `checksums.txt`, regenerates the lockfile with `bazel mod tidy`, verifies the pins with `bazel fetch`, and opens a `src-cli-bump/` PR with the platform team as reviewer. The job lives in its own workflow so it can also be run by hand for a release whose PR was never opened. ## Test Plan Ran `dev/open-sourcegraph-bump-pr.sh` locally with `VERSION=8.0.0` and `OPEN_PR=0` against a sourcegraph checkout at `16a472ea69e`: the diff matched the shape of sourcegraph/sourcegraph#14574 (3 files, 11 lines, including the regenerated `bzlTransitiveDigest` entries) and `bazel fetch` pulled both tarballs with the new checksums. The GitHub job itself only runs on a tag, so it has not been exercised yet. Co-authored-by: Amp Amp-Thread-ID: https://ampcode.com/threads/T-01a1a3bd-c619-7427-a499-52a596adc40b --- .github/workflows/goreleaser.yml | 24 +++++-- .github/workflows/sourcegraph-bump.yml | 46 ++++++++++++ DEVELOPMENT.md | 22 ++---- dev/open-sourcegraph-bump-pr.sh | 98 ++++++++++++++++++++++++++ 4 files changed, 168 insertions(+), 22 deletions(-) create mode 100644 .github/workflows/sourcegraph-bump.yml create mode 100755 dev/open-sourcegraph-bump-pr.sh diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml index 35e3125826..ff510bb37e 100644 --- a/.github/workflows/goreleaser.yml +++ b/.github/workflows/goreleaser.yml @@ -27,13 +27,14 @@ on: # # 1. Build and publish the new release to a versioned Homebrew formula # -# This action contains 5 jobs to accommodate both cases: +# This action contains 6 jobs to accommodate both cases: # -# release_type [always] - checks tags, determines if we're case 1. or case 2. -# goreleaser_pre [if case 1.] - copies the main formula to a versioned formula -# goreleaser [always] - runs tests, builds + publishes with goreleaser -# goreleaser_post [if case 1.] - updates symlink to latest version -# npm [always] - publishes to npm +# release_type [always] - checks tags, determines if we're case 1. or case 2. +# goreleaser_pre [if case 1.] - copies the main formula to a versioned formula +# goreleaser [always] - runs tests, builds + publishes with goreleaser +# goreleaser_post [if case 1.] - updates symlink to latest version +# npm [always] - publishes to npm +# sourcegraph_bump [if case 1.] - opens the sourcegraph/sourcegraph PR that pins the new version jobs: # release_type compares the current tag to the highest versioned tag available on the # repo to determine if this release is for a new latest version or a patch of an older @@ -259,3 +260,14 @@ jobs: working-directory: npm-distribution env: NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}} + + # sourcegraph_bump opens the sourcegraph/sourcegraph PR that raises MinimumVersion and + # the Bazel src-cli pins to this release, so instances start serving it from + # /.api/src-cli/. A patch of an older version does not change what instances serve. + sourcegraph_bump: + needs: goreleaser + if: needs.goreleaser.outputs.is_latest_version == 1 + uses: ./.github/workflows/sourcegraph-bump.yml + with: + version: ${{ github.ref_name }} + secrets: inherit diff --git a/.github/workflows/sourcegraph-bump.yml b/.github/workflows/sourcegraph-bump.yml new file mode 100644 index 0000000000..252963ff01 --- /dev/null +++ b/.github/workflows/sourcegraph-bump.yml @@ -0,0 +1,46 @@ +name: Open sourcegraph/sourcegraph version bump PR + +# Opens the sourcegraph/sourcegraph PR that pins a published src-cli release +# (MinimumVersion, Bazel tool_deps, MODULE.bazel.lock) and asks the platform +# team to review it. See dev/open-sourcegraph-bump-pr.sh. +# +# Called by goreleaser.yml after a new latest release, or run by hand for a +# release whose bump PR was never opened: +# gh workflow run sourcegraph-bump.yml -R sourcegraph/src-cli -f version=8.0.0 +on: + workflow_dispatch: + inputs: + version: + description: Published src-cli release tag, for example 8.0.0 + required: true + type: string + workflow_call: + inputs: + version: + required: true + type: string + +jobs: + sourcegraph_bump: + name: Open sourcegraph/sourcegraph PR + runs-on: ubuntu-latest + steps: + - name: Checkout src-cli + uses: actions/checkout@v7 + - name: Checkout sourcegraph/sourcegraph + uses: actions/checkout@v7 + with: + repository: sourcegraph/sourcegraph + path: sourcegraph + token: ${{ secrets.BOT_CROSS_REPO_PAT }} + - name: Configure git + run: | + git config user.name sourcegraph-bot + git config user.email sourcegraph-bot-github@sourcegraph.com + working-directory: sourcegraph + - name: Bump src-cli and open the PR + run: dev/open-sourcegraph-bump-pr.sh + env: + VERSION: ${{ inputs.version }} + SOURCEGRAPH_DIR: ${{ github.workspace }}/sourcegraph + GH_TOKEN: ${{ secrets.BOT_CROSS_REPO_PAT }} diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md index 07fc74233c..d51958dd43 100644 --- a/DEVELOPMENT.md +++ b/DEVELOPMENT.md @@ -79,22 +79,12 @@ We adhere to the general Sourcegraph principles for testing, as well as the Go s npm show @sourcegraph/src version ``` 3. The [releases section of the repo sidebar](https://github.com/sourcegraph/src-cli) shows the correct version. -5. Make the necessary updates to the main Sourcegraph repo: - 1. Update the `MinimumVersion` constant in the [src-cli package](https://github.com/sourcegraph/sourcegraph/tree/main/internal/src-cli/consts.go). - 2. Update the `SRC_CLI_VERSION` in [tool_deps.bzl](https://sourcegraph.sourcegraph.com/github.com/sourcegraph/sourcegraph@f88ee515885e1761f002f8adcc73560bcb2573ee/-/blob/dev/tool_deps.bzl?L6) - 3. Update the sha256 hashes for the two `src-cli-*` targets in [tool_deps.bzl](https://sourcegraph.sourcegraph.com/github.com/sourcegraph/sourcegraph/-/blob/dev/tool_deps.bzl). The easiest way to do this is to run the following command after updating `SRC_CLI_VERSION`, and extract the correct checksums for each target from the error message: - ```shell - $ bazel build @src-cli-linux-amd64//:src-cli-linux-amd64 \ - @src-cli-darwin-arm64//:src-cli-darwin-arm64 - - ERROR: java.io.IOException: Error downloading [...]_linux-amd64.tar.gz [...] Checksum was - - [...] - ``` - After updating the checksums, rerun the command to verify that the values are correct. - 4. Run `sg generate bazel` and `sg bazel configure` (this may not result in any changes) - 4. Commit the changes, and open a PR. - 6. Once the version bump PR is merged and the commit is live on dotcom, check that the [curl commands in the README](README.md#installation) also fetch the new latest version. + 4. The action opened a `src-cli-bump/$VERSION` pull request in [sourcegraph/sourcegraph](https://github.com/sourcegraph/sourcegraph/pulls?q=is%3Apr+head%3Asrc-cli-bump%2F) with the platform team as reviewer. It raises `MinimumVersion` in `internal/src-cli/consts.go`, which every instance serves from `/.api/src-cli/version`, and the `SRC_CLI_VERSION` pin and checksums in `dev/tool_deps.bzl`. If the job failed, rerun it with: + ```shell + gh workflow run sourcegraph-bump.yml -R sourcegraph/src-cli -f version=$VERSION + ``` + or run [`dev/open-sourcegraph-bump-pr.sh`](dev/open-sourcegraph-bump-pr.sh) locally against a sourcegraph checkout. +5. Get the version bump PR merged. Once the commit is live on dotcom, check that the [curl commands in the README](README.md#installation) also fetch the new latest version. ### Patch releases diff --git a/dev/open-sourcegraph-bump-pr.sh b/dev/open-sourcegraph-bump-pr.sh new file mode 100755 index 0000000000..7621e4010d --- /dev/null +++ b/dev/open-sourcegraph-bump-pr.sh @@ -0,0 +1,98 @@ +#!/usr/bin/env bash +# +# Opens the sourcegraph/sourcegraph pull request that pins a newly released src-cli version: +# +# internal/src-cli/consts.go MinimumVersion, served by /.api/src-cli/version on every instance +# dev/tool_deps.bzl SRC_CLI_VERSION and the sha256 of the two release tarballs +# MODULE.bazel.lock regenerated by `bazel mod tidy` +# +# Run by .github/workflows/goreleaser.yml after a new latest release. To run locally: +# +# VERSION=8.0.0 SOURCEGRAPH_DIR=~/git/common-repos/sourcegraph/worktrees/main OPEN_PR=0 dev/open-sourcegraph-bump-pr.sh +# +# Environment: +# VERSION src-cli release tag, already published on GitHub (required) +# SOURCEGRAPH_DIR checkout of sourcegraph/sourcegraph to edit (required) +# OPEN_PR 0 edits the checkout and stops, 1 also commits, pushes, and opens the PR (default 1) +# REVIEWER_TEAM GitHub team requested as reviewer on the PR (default platform) +# GH_TOKEN token with push access to sourcegraph/sourcegraph, used by git and gh when OPEN_PR=1 + +set -euo pipefail + +: "${VERSION:?set VERSION to the src-cli release, for example 8.0.0}" +: "${SOURCEGRAPH_DIR:?set SOURCEGRAPH_DIR to a sourcegraph/sourcegraph checkout}" +OPEN_PR="${OPEN_PR:-1}" +REVIEWER_TEAM="${REVIEWER_TEAM:-platform}" +BRANCH="src-cli-bump/${VERSION}" +RELEASE_ASSETS="https://github.com/sourcegraph/src-cli/releases/download/${VERSION}" + +echo "--- Reading tarball checksums from the ${VERSION} release" +checksums=$(curl --silent --show-error --fail --location "${RELEASE_ASSETS}/src-cli_${VERSION}_checksums.txt") +checksum_for() { + awk -v file="src-cli_${VERSION}_$1.tar.gz" '$2 == file { print $1 }' <<<"${checksums}" +} +linux_amd64_sha256=$(checksum_for linux_amd64) +darwin_arm64_sha256=$(checksum_for darwin_arm64) +if [[ -z ${linux_amd64_sha256} || -z ${darwin_arm64_sha256} ]]; then + echo "src-cli_${VERSION}_checksums.txt does not list both linux_amd64 and darwin_arm64 tarballs:" >&2 + echo "${checksums}" >&2 + exit 1 +fi +echo "linux_amd64: ${linux_amd64_sha256}" +echo "darwin_arm64: ${darwin_arm64_sha256}" + +cd "${SOURCEGRAPH_DIR}" + +echo "--- Updating internal/src-cli/consts.go and dev/tool_deps.bzl" +sed -i.bak -E "s/^const MinimumVersion = \"[^\"]+\"/const MinimumVersion = \"${VERSION}\"/" internal/src-cli/consts.go +rm internal/src-cli/consts.go.bak +# The sha256 to replace is the first one after each src-cli http_archive name. +awk -v version="${VERSION}" -v linux="${linux_amd64_sha256}" -v darwin="${darwin_arm64_sha256}" ' + /^SRC_CLI_VERSION = "/ { sub(/"[^"]*"/, "\"" version "\"") } + /name = "src-cli-linux-amd64"/ { pending = linux } + /name = "src-cli-darwin-arm64"/ { pending = darwin } + pending != "" && /sha256 = "/ { sub(/sha256 = "[^"]*"/, "sha256 = \"" pending "\""); pending = "" } + { print } +' dev/tool_deps.bzl >dev/tool_deps.bzl.new && mv dev/tool_deps.bzl.new dev/tool_deps.bzl + +echo "--- Regenerating MODULE.bazel.lock" +bazel mod tidy + +echo "--- Verifying the pinned tarballs download with the new checksums" +bazel fetch @src-cli-linux-amd64//:src-cli-linux-amd64 @src-cli-darwin-arm64//:src-cli-darwin-arm64 + +git --no-pager diff --stat +if [[ ${OPEN_PR} != 1 ]]; then + echo "OPEN_PR=${OPEN_PR}: leaving the changes uncommitted in ${SOURCEGRAPH_DIR}" + exit 0 +fi + +echo "--- Committing and pushing ${BRANCH}" +git checkout -b "${BRANCH}" +git add internal/src-cli/consts.go dev/tool_deps.bzl MODULE.bazel.lock +git commit -m "chore/src-cli: update src-cli to ${VERSION}" +git push --set-upstream origin "${BRANCH}" + +echo "--- Opening the pull request" +pull_request_url=$(gh pr create \ + --title "chore/src-cli: update src-cli to ${VERSION}" \ + --label no-changelog \ + --body "src-cli ${VERSION} is published on GitHub, Homebrew, and npm, but \`/.api/src-cli/version\` on every Sourcegraph instance keeps recommending the \`MinimumVersion\` pinned here. This raises the pin so instances serve the new release. + +Opened automatically by the src-cli [Build and Release](https://github.com/sourcegraph/src-cli/actions/workflows/goreleaser.yml) workflow for https://github.com/sourcegraph/src-cli/releases/tag/${VERSION}. + +- Raise \`MinimumVersion\` in \`internal/src-cli/consts.go\` +- Update \`SRC_CLI_VERSION\` and the tarball checksums in \`dev/tool_deps.bzl\` +- Regenerate \`MODULE.bazel.lock\` with \`bazel mod tidy\` + +## Test Plan + +CI. The workflow verified the checksums with: + +\`\`\`shell +bazel fetch @src-cli-linux-amd64//:src-cli-linux-amd64 @src-cli-darwin-arm64//:src-cli-darwin-arm64 +\`\`\`") +echo "${pull_request_url}" +gh api --method POST "repos/sourcegraph/sourcegraph/pulls/${pull_request_url##*/}/requested_reviewers" \ + -f "team_reviewers[]=${REVIEWER_TEAM}" >/dev/null +echo "Requested review from @sourcegraph/${REVIEWER_TEAM}"