chore: auto manifest on version bump; local manual script only

contrib/manifest/generate.py + pre-commit hook; install-git-hooks.sh creates .local/build-release-manifest.sh (gitignored). Remove scripts/ from remote.
2026-07-08 12:05:21 +10:00
parent 0399a6d384
commit 5ac4792c3c
10 changed files with 253 additions and 113 deletions
@@ -0,0 +1,55 @@
+#!/bin/bash
+# Автогенерация release/manifest-VERSION.json при bump версии (version.txt / SSH_MONITOR_VERSION).
+set -euo pipefail
+
+ROOT="$(git rev-parse --show-toplevel)"
+cd "$ROOT"
+
+_staged() {
+	git diff --cached --name-only -- "$@"
+}
+
+_version_bump_staged() {
+	if _staged version.txt | grep -q .; then
+		return 0
+	fi
+	if _staged ssh-monitor | grep -q .; then
+		if git diff --cached -- ssh-monitor | grep -qE '^[+-].*SSH_MONITOR_VERSION='; then
+			return 0
+		fi
+	fi
+	return 1
+}
+
+_agent_files_staged() {
+	local f
+	for f in ssh-monitor sac-client.sh update_ssh_monitor.sh ssh-monitor-watchdog ssh-monitor-perms.sh; do
+		if _staged "$f" | grep -q .; then
+			return 0
+		fi
+	done
+	return 1
+}
+
+_version_bump_staged || _agent_files_staged || exit 0
+
+if ! command -v python3 >/dev/null 2>&1; then
+	echo "pre-commit: python3 нужен для manifest" >&2
+	exit 1
+fi
+
+python3 "$ROOT/contrib/manifest/generate.py"
+VER="$(tr -d '\r\n' <"$ROOT/version.txt")"
+[ -n "$VER" ] || {
+	echo "pre-commit: version.txt пуст — не могу добавить manifest" >&2
+	exit 1
+}
+
+MANIFEST="release/manifest-${VER}.json"
+if [ ! -f "$MANIFEST" ]; then
+	echo "pre-commit: не создан $MANIFEST" >&2
+	exit 1
+fi
+
+git add "$MANIFEST"
+echo "pre-commit: обновлён $MANIFEST (версия $VER)"
@@ -0,0 +1,31 @@
+#!/bin/bash
+# Установка git hooks и локального скрипта ручной генерации manifest (не в git).
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+HOOK_SRC="$ROOT/contrib/hooks/pre-commit"
+HOOK_DST="$ROOT/.git/hooks/pre-commit"
+LOCAL_DIR="$ROOT/.local"
+LOCAL_SCRIPT="$LOCAL_DIR/build-release-manifest.sh"
+
+if [ ! -d "$ROOT/.git" ]; then
+	echo "ERROR: не git-репозиторий: $ROOT" >&2
+	exit 1
+fi
+
+mkdir -p "$LOCAL_DIR"
+cat >"$LOCAL_SCRIPT" <<'EOF'
+#!/bin/bash
+# Локальный wrapper (не коммитится). Ручная генерация manifest.
+set -euo pipefail
+ROOT="$(git rev-parse --show-toplevel)"
+exec python3 "$ROOT/contrib/manifest/generate.py" "$@"
+EOF
+chmod +x "$LOCAL_SCRIPT"
+
+cp "$HOOK_SRC" "$HOOK_DST"
+chmod +x "$HOOK_DST"
+
+echo "OK: pre-commit hook → $HOOK_DST"
+echo "OK: ручной скрипт → $LOCAL_SCRIPT (в .gitignore, не уйдёт в Gitea/GitHub)"
+echo "После clone выполните: ./contrib/install-git-hooks.sh"
@@ -0,0 +1,117 @@
+#!/usr/bin/env python3
+"""Генерация release/manifest-VERSION.json (SHA256 git blob = checkout на Linux)."""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+MANIFEST_FILES = (
+    "ssh-monitor",
+    "sac-client.sh",
+    "update_ssh_monitor.sh",
+    "ssh-monitor-watchdog",
+    "ssh-monitor-perms.sh",
+)
+
+
+def repo_root() -> Path:
+    return Path(
+        subprocess.check_output(["git", "rev-parse", "--show-toplevel"], text=True).strip()
+    )
+
+
+def read_version(root: Path, explicit: str | None) -> str:
+    if explicit:
+        return explicit.strip()
+    vt = root / "version.txt"
+    if vt.is_file():
+        v = vt.read_text(encoding="utf-8").strip()
+        if v:
+            return v
+    ssh = root / "ssh-monitor"
+    if ssh.is_file():
+        for line in ssh.read_text(encoding="utf-8", errors="replace").splitlines():
+            if line.strip().startswith("SSH_MONITOR_VERSION="):
+                v = line.split("=", 1)[1].strip().strip("\"'")
+                if v:
+                    return v
+    raise SystemExit("ERROR: укажите VERSION или заполните version.txt / SSH_MONITOR_VERSION")
+
+
+def file_bytes_from_git(root: Path, name: str) -> bytes | None:
+    for ref in (f":{name}", f"HEAD:{name}"):
+        try:
+            return subprocess.check_output(["git", "-C", str(root), "show", ref])
+        except subprocess.CalledProcessError:
+            continue
+    return None
+
+
+def sha256_bytes(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def sha256_release_file(root: Path, name: str) -> str:
+    blob = file_bytes_from_git(root, name)
+    if blob is not None:
+        return sha256_bytes(blob)
+    path = root / name
+    if not path.is_file():
+        raise SystemExit(f"ERROR: нет файла {name} (ни в git index/HEAD, ни на диске)")
+    h = hashlib.sha256()
+    with path.open("rb") as f:
+        for chunk in iter(lambda: f.read(1024 * 1024), b""):
+            h.update(chunk)
+    return h.hexdigest()
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description="Сгенерировать release/manifest-VERSION.json")
+    parser.add_argument("version", nargs="?", help="Версия (по умолчанию из version.txt)")
+    parser.add_argument(
+        "--pin-commit",
+        action="store_true",
+        help="Записать git_commit=HEAD (после коммита; в pre-commit не используется)",
+    )
+    args = parser.parse_args()
+
+    root = repo_root()
+    version = read_version(root, args.version)
+
+    for name in MANIFEST_FILES:
+        if file_bytes_from_git(root, name) is None and not (root / name).is_file():
+            raise SystemExit(f"ERROR: нет файла {name}")
+
+    git_commit = ""
+    if args.pin_commit:
+        try:
+            git_commit = subprocess.check_output(
+                ["git", "-C", str(root), "rev-parse", "HEAD"], text=True
+            ).strip()
+        except subprocess.CalledProcessError:
+            pass
+
+    manifest = {
+        "version": version,
+        "git_commit": git_commit,
+        "files": {name: f"sha256:{sha256_release_file(root, name)}" for name in MANIFEST_FILES},
+    }
+
+    out = root / "release" / f"manifest-{version}.json"
+    out.parent.mkdir(parents=True, exist_ok=True)
+    with out.open("w", encoding="utf-8") as f:
+        json.dump(manifest, f, indent=2, ensure_ascii=False)
+        f.write("\n")
+
+    pin = git_commit[:12] if git_commit else "(empty)"
+    print(f"Wrote {out.relative_to(root)} git_commit={pin}")
+
+
+if __name__ == "__main__":
+    main()