chore/release: open the sourcegraph MinimumVersion bump PR automatically

.github/workflows/goreleaser.yml

@@ -27,13 +27,14 @@ on:
 #
 # 1. Build and publish the new release to a versioned Homebrew formula
 #
-# This action contains 5 jobs to accommodate both cases:
+# This action contains 6 jobs to accommodate both cases:
 #
-# release_type    [always]      - checks tags, determines if we're case 1. or case 2.
-# goreleaser_pre  [if case 1.]  - copies the main formula to a versioned formula
-# goreleaser      [always]      - runs tests, builds + publishes with goreleaser
-# goreleaser_post [if case 1.]  - updates symlink to latest version
-# npm             [always]      - publishes to npm
+# release_type     [always]      - checks tags, determines if we're case 1. or case 2.
+# goreleaser_pre   [if case 1.]  - copies the main formula to a versioned formula
+# goreleaser       [always]      - runs tests, builds + publishes with goreleaser
+# goreleaser_post  [if case 1.]  - updates symlink to latest version
+# npm              [always]      - publishes to npm
+# sourcegraph_bump [if case 1.]  - opens the sourcegraph/sourcegraph PR that pins the new version
 jobs:
   # release_type compares the current tag to the highest versioned tag available on the
   # repo to determine if this release is for a new latest version or a patch of an older
@@ -259,3 +260,14 @@ jobs:
         working-directory: npm-distribution
         env:
           NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+
+  # sourcegraph_bump opens the sourcegraph/sourcegraph PR that raises MinimumVersion and
+  # the Bazel src-cli pins to this release, so instances start serving it from
+  # /.api/src-cli/. A patch of an older version does not change what instances serve.
+  sourcegraph_bump:
+    needs: goreleaser
+    if: needs.goreleaser.outputs.is_latest_version == 1
+    uses: ./.github/workflows/sourcegraph-bump.yml
+    with:
+      version: ${{ github.ref_name }}
+    secrets: inherit

.github/workflows/sourcegraph-bump.yml

@@ -0,0 +1,46 @@
+name: Open sourcegraph/sourcegraph version bump PR
+
+# Opens the sourcegraph/sourcegraph PR that pins a published src-cli release
+# (MinimumVersion, Bazel tool_deps, MODULE.bazel.lock) and asks the platform
+# team to review it. See dev/open-sourcegraph-bump-pr.sh.
+#
+# Called by goreleaser.yml after a new latest release, or run by hand for a
+# release whose bump PR was never opened:
+#   gh workflow run sourcegraph-bump.yml -R sourcegraph/src-cli -f version=8.0.0
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Published src-cli release tag, for example 8.0.0
+        required: true
+        type: string
+  workflow_call:
+    inputs:
+      version:
+        required: true
+        type: string
+
+jobs:
+  sourcegraph_bump:
+    name: Open sourcegraph/sourcegraph PR
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout src-cli
+        uses: actions/checkout@v7
+      - name: Checkout sourcegraph/sourcegraph
+        uses: actions/checkout@v7
+        with:
+          repository: sourcegraph/sourcegraph
+          path: sourcegraph
+          token: ${{ secrets.BOT_CROSS_REPO_PAT }}
+      - name: Configure git
+        run: |
+          git config user.name sourcegraph-bot
+          git config user.email sourcegraph-bot-github@sourcegraph.com
+        working-directory: sourcegraph
+      - name: Bump src-cli and open the PR
+        run: dev/open-sourcegraph-bump-pr.sh
+        env:
+          VERSION: ${{ inputs.version }}
+          SOURCEGRAPH_DIR: ${{ github.workspace }}/sourcegraph
+          GH_TOKEN: ${{ secrets.BOT_CROSS_REPO_PAT }}

DEVELOPMENT.md

@@ -79,22 +79,12 @@ We adhere to the general Sourcegraph principles for testing, as well as the Go s
         npm show @sourcegraph/src version
        ```
     3. The [releases section of the repo sidebar](https://github.com/sourcegraph/src-cli) shows the correct version.
-5.  Make the necessary updates to the main Sourcegraph repo:
-    1. Update the `MinimumVersion` constant in the [src-cli package](https://github.com/sourcegraph/sourcegraph/tree/main/internal/src-cli/consts.go).
-    2. Update the `SRC_CLI_VERSION` in [tool_deps.bzl](https://sourcegraph.sourcegraph.com/github.com/sourcegraph/sourcegraph@f88ee515885e1761f002f8adcc73560bcb2573ee/-/blob/dev/tool_deps.bzl?L6) 
-    3. Update the sha256 hashes for the two `src-cli-*` targets in [tool_deps.bzl](https://sourcegraph.sourcegraph.com/github.com/sourcegraph/sourcegraph/-/blob/dev/tool_deps.bzl). The easiest way to do this is to run the following command after updating `SRC_CLI_VERSION`, and extract the correct checksums for each target from the error message:
-        ```shell
-        $ bazel build @src-cli-linux-amd64//:src-cli-linux-amd64 \
-             @src-cli-darwin-arm64//:src-cli-darwin-arm64
-
-        ERROR: java.io.IOException: Error downloading [...]_linux-amd64.tar.gz [...] Checksum was <new linux-amd64 checksum>
-
-        [...]
-        ```
-        After updating the checksums, rerun the command to verify that the values are correct.
-    4. Run `sg generate bazel` and `sg bazel configure` (this may not result in any changes)
-    4. Commit the changes, and open a PR.
- 6. Once the version bump PR is merged and the commit is live on dotcom, check that the [curl commands in the README](README.md#installation) also fetch the new latest version.
+    4. The action opened a `src-cli-bump/$VERSION` pull request in [sourcegraph/sourcegraph](https://github.com/sourcegraph/sourcegraph/pulls?q=is%3Apr+head%3Asrc-cli-bump%2F) with the platform team as reviewer. It raises `MinimumVersion` in `internal/src-cli/consts.go`, which every instance serves from `/.api/src-cli/version`, and the `SRC_CLI_VERSION` pin and checksums in `dev/tool_deps.bzl`. If the job failed, rerun it with:
+       ```shell
+       gh workflow run sourcegraph-bump.yml -R sourcegraph/src-cli -f version=$VERSION
+       ```
+       or run [`dev/open-sourcegraph-bump-pr.sh`](dev/open-sourcegraph-bump-pr.sh) locally against a sourcegraph checkout.
+5.  Get the version bump PR merged. Once the commit is live on dotcom, check that the [curl commands in the README](README.md#installation) also fetch the new latest version.
 
 ### Patch releases
 

dev/open-sourcegraph-bump-pr.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+#
+# Opens the sourcegraph/sourcegraph pull request that pins a newly released src-cli version:
+#
+#   internal/src-cli/consts.go  MinimumVersion, served by /.api/src-cli/version on every instance
+#   dev/tool_deps.bzl           SRC_CLI_VERSION and the sha256 of the two release tarballs
+#   MODULE.bazel.lock           regenerated by `bazel mod tidy`
+#
+# Run by .github/workflows/goreleaser.yml after a new latest release. To run locally:
+#
+#   VERSION=8.0.0 SOURCEGRAPH_DIR=~/git/common-repos/sourcegraph/worktrees/main OPEN_PR=0 dev/open-sourcegraph-bump-pr.sh
+#
+# Environment:
+#   VERSION          src-cli release tag, already published on GitHub            (required)
+#   SOURCEGRAPH_DIR  checkout of sourcegraph/sourcegraph to edit                  (required)
+#   OPEN_PR          0 edits the checkout and stops, 1 also commits, pushes, and opens the PR (default 1)
+#   REVIEWER_TEAM    GitHub team requested as reviewer on the PR                  (default platform)
+#   GH_TOKEN         token with push access to sourcegraph/sourcegraph, used by git and gh when OPEN_PR=1
+
+set -euo pipefail
+
+: "${VERSION:?set VERSION to the src-cli release, for example 8.0.0}"
+: "${SOURCEGRAPH_DIR:?set SOURCEGRAPH_DIR to a sourcegraph/sourcegraph checkout}"
+OPEN_PR="${OPEN_PR:-1}"
+REVIEWER_TEAM="${REVIEWER_TEAM:-platform}"
+BRANCH="src-cli-bump/${VERSION}"
+RELEASE_ASSETS="https://github.com/sourcegraph/src-cli/releases/download/${VERSION}"
+
+echo "--- Reading tarball checksums from the ${VERSION} release"
+checksums=$(curl --silent --show-error --fail --location "${RELEASE_ASSETS}/src-cli_${VERSION}_checksums.txt")
+checksum_for() {
+  awk -v file="src-cli_${VERSION}_$1.tar.gz" '$2 == file { print $1 }' <<<"${checksums}"
+}
+linux_amd64_sha256=$(checksum_for linux_amd64)
+darwin_arm64_sha256=$(checksum_for darwin_arm64)
+if [[ -z ${linux_amd64_sha256} || -z ${darwin_arm64_sha256} ]]; then
+  echo "src-cli_${VERSION}_checksums.txt does not list both linux_amd64 and darwin_arm64 tarballs:" >&2
+  echo "${checksums}" >&2
+  exit 1
+fi
+echo "linux_amd64:  ${linux_amd64_sha256}"
+echo "darwin_arm64: ${darwin_arm64_sha256}"
+
+cd "${SOURCEGRAPH_DIR}"
+
+echo "--- Updating internal/src-cli/consts.go and dev/tool_deps.bzl"
+sed -i.bak -E "s/^const MinimumVersion = \"[^\"]+\"/const MinimumVersion = \"${VERSION}\"/" internal/src-cli/consts.go
+rm internal/src-cli/consts.go.bak
+# The sha256 to replace is the first one after each src-cli http_archive name.
+awk -v version="${VERSION}" -v linux="${linux_amd64_sha256}" -v darwin="${darwin_arm64_sha256}" '
+  /^SRC_CLI_VERSION = "/          { sub(/"[^"]*"/, "\"" version "\"") }
+  /name = "src-cli-linux-amd64"/  { pending = linux }
+  /name = "src-cli-darwin-arm64"/ { pending = darwin }
+  pending != "" && /sha256 = "/   { sub(/sha256 = "[^"]*"/, "sha256 = \"" pending "\""); pending = "" }
+  { print }
+' dev/tool_deps.bzl >dev/tool_deps.bzl.new && mv dev/tool_deps.bzl.new dev/tool_deps.bzl
+
+echo "--- Regenerating MODULE.bazel.lock"
+bazel mod tidy
+
+echo "--- Verifying the pinned tarballs download with the new checksums"
+bazel fetch @src-cli-linux-amd64//:src-cli-linux-amd64 @src-cli-darwin-arm64//:src-cli-darwin-arm64
+
+git --no-pager diff --stat
+if [[ ${OPEN_PR} != 1 ]]; then
+  echo "OPEN_PR=${OPEN_PR}: leaving the changes uncommitted in ${SOURCEGRAPH_DIR}"
+  exit 0
+fi
+
+echo "--- Committing and pushing ${BRANCH}"
+git checkout -b "${BRANCH}"
+git add internal/src-cli/consts.go dev/tool_deps.bzl MODULE.bazel.lock
+git commit -m "chore/src-cli: update src-cli to ${VERSION}"
+git push --set-upstream origin "${BRANCH}"
+
+echo "--- Opening the pull request"
+pull_request_url=$(gh pr create \
+  --title "chore/src-cli: update src-cli to ${VERSION}" \
+  --label no-changelog \
+  --body "src-cli ${VERSION} is published on GitHub, Homebrew, and npm, but \`/.api/src-cli/version\` on every Sourcegraph instance keeps recommending the \`MinimumVersion\` pinned here. This raises the pin so instances serve the new release.
+
+Opened automatically by the src-cli [Build and Release](https://github.com/sourcegraph/src-cli/actions/workflows/goreleaser.yml) workflow for https://github.com/sourcegraph/src-cli/releases/tag/${VERSION}.
+
+- Raise \`MinimumVersion\` in \`internal/src-cli/consts.go\`
+- Update \`SRC_CLI_VERSION\` and the tarball checksums in \`dev/tool_deps.bzl\`
+- Regenerate \`MODULE.bazel.lock\` with \`bazel mod tidy\`
+
+## Test Plan
+
+CI. The workflow verified the checksums with:
+
+\`\`\`shell
+bazel fetch @src-cli-linux-amd64//:src-cli-linux-amd64 @src-cli-darwin-arm64//:src-cli-darwin-arm64
+\`\`\`")
+echo "${pull_request_url}"
+gh api --method POST "repos/sourcegraph/sourcegraph/pulls/${pull_request_url##*/}/requested_reviewers" \
+  -f "team_reviewers[]=${REVIEWER_TEAM}" >/dev/null
+echo "Requested review from @sourcegraph/${REVIEWER_TEAM}"