feuerwehr-vereinsshop/scripts/create-release-zip.sh

#!/usr/bin/env bash
#
# Builds a release package of this shop for the Manage server.
#
# Run it from the project root:
#
#     ./scripts/create-release-zip.sh v1.1.0
#
# It writes the version into includes/version.php, packs every git-tracked file
# minus the exclusions below, and prints the SHA-256 and size. Upload the
# resulting ZIP in the Manage server under "Releases"; the shop then offers it
# on Admin -> Einstellungen.
#
# The root of the ZIP is the shop root - no wrapping directory, otherwise the
# update would create a subfolder instead of updating anything.
#
# See docs/BACKUP_UPDATE.md.

set -euo pipefail

# --- CONFIGURATION ----------------------------------------------------------

# Package name prefix. Must match MANAGE_PACKAGE_PREFIX on the Manage server.
PRODUCT="feuerwehr-shop"

# File holding the installed version, relative to the project root.
VERSION_FILE="includes/version.php"

# Name of the constant inside that file. Empty means a plain text file that
# contains nothing but the version.
VERSION_CONSTANT="APP_VERSION"

# Output directory for built packages, relative to the project root.
BUILD_DIR="build/releases"

# Paths excluded from the package. Anything holding credentials or runtime data
# of the target installation MUST be listed here.
# config.php holds this installation's admin hashes, cookie secret and Manage
# token; data/ holds the operational data of whoever built the package. Both are
# additionally covered by MANAGE_UPDATE_PROTECTED_PATHS, but they must not end
# up in a package that gets downloaded from the Manage server in the first place.
EXCLUDES=(
    ".gitignore"
    "config.php"
    "data/"
    "build/"
    "scripts/"
    ".codex/"
)

# --- END CONFIGURATION ------------------------------------------------------

usage() {
    cat <<USAGE
Usage: $(basename "$0") vX.Y.Z

Builds ${BUILD_DIR}/${PRODUCT}-vX.Y.Z.zip from the git-tracked files of the
current repository and writes the version into ${VERSION_FILE}.
USAGE
}

VERSION="${1:-}"

if [[ -z "$VERSION" || "$VERSION" == "-h" || "$VERSION" == "--help" ]]; then
    usage
    exit 1
fi

if [[ ! "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
    echo "Error: version must look like v1.3.0" >&2
    exit 1
fi

for tool in git zip sed awk; do
    if ! command -v "$tool" >/dev/null 2>&1; then
        echo "Error: required tool not found: $tool" >&2
        exit 1
    fi
done

if ! git rev-parse --show-toplevel >/dev/null 2>&1; then
    echo "Error: not inside a git repository. Run this from the project root." >&2
    exit 1
fi

REPO_ROOT="$(git rev-parse --show-toplevel)"
cd "$REPO_ROOT"

if [[ ! -f "$VERSION_FILE" ]]; then
    echo "Error: version file not found: $VERSION_FILE" >&2
    exit 1
fi

# The file list comes from `git ls-files`, so anything uncommitted silently
# stays out of the package. Warn rather than refuse: building from a dirty tree
# is sometimes deliberate.
if [[ -n "$(git status --porcelain --untracked-files=no)" ]]; then
    echo "Warning: the working tree has uncommitted changes." >&2
    echo "         Only committed content is packaged." >&2
fi

# Untracked files are the nastier case: a new file added by the release but
# never `git add`ed is missing from the package with nothing else to show for it.
UNTRACKED="$(git ls-files --others --exclude-standard)"
if [[ -n "$UNTRACKED" ]]; then
    echo "Warning: untracked files will NOT be in the package:" >&2
    printf '         %s\n' $UNTRACKED >&2
fi

# --- write the version ------------------------------------------------------

write_version() {
    if [[ -n "$VERSION_CONSTANT" ]]; then
        # PHP file with a define(). Replace only the version literal.
        sed -i.bak -E \
            "s/(define\\(\\s*[\"']${VERSION_CONSTANT}[\"']\\s*,\\s*[\"'])[^\"']*([\"'])/\\1${VERSION}\\2/" \
            "$VERSION_FILE"
        rm -f "${VERSION_FILE}.bak"
    else
        printf '%s\n' "$VERSION" > "$VERSION_FILE"
    fi
}

read_version() {
    if [[ -n "$VERSION_CONSTANT" ]]; then
        grep -oE "define\\(\\s*[\"']${VERSION_CONSTANT}[\"']\\s*,\\s*[\"']v[0-9]+\\.[0-9]+\\.[0-9]+[\"']" \
            "$VERSION_FILE" | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+' | head -1
    else
        tr -d '[:space:]' < "$VERSION_FILE"
    fi
}

write_version

WRITTEN="$(read_version)"
if [[ "$WRITTEN" != "$VERSION" ]]; then
    echo "Error: could not write the version into $VERSION_FILE (found: '${WRITTEN}')." >&2
    echo "       Check VERSION_CONSTANT and the file's format." >&2
    exit 1
fi

echo "Version written to ${VERSION_FILE}: ${VERSION}"

# --- collect the files ------------------------------------------------------

is_excluded() {
    local path="$1"
    local pattern
    for pattern in "${EXCLUDES[@]}"; do
        if [[ "$pattern" == */ ]]; then
            [[ "$path" == "${pattern}"* ]] && return 0
        else
            [[ "$path" == "$pattern" ]] && return 0
        fi
    done
    return 1
}

FILE_LIST="$(mktemp)"
trap 'rm -f "$FILE_LIST"' EXIT

COUNT=0
while IFS= read -r path; do
    if is_excluded "$path"; then
        continue
    fi
    [[ -f "$path" ]] || continue
    printf '%s\n' "$path" >> "$FILE_LIST"
    COUNT=$((COUNT + 1))
done < <(git ls-files)

if [[ "$COUNT" -eq 0 ]]; then
    echo "Error: no files to package." >&2
    exit 1
fi

# --- build ------------------------------------------------------------------

mkdir -p "$BUILD_DIR"
ARCHIVE="${BUILD_DIR}/${PRODUCT}-${VERSION}.zip"
rm -f "$ARCHIVE"

zip -q -X "$ARCHIVE" -@ < "$FILE_LIST"

if command -v sha256sum >/dev/null 2>&1; then
    SHA="$(sha256sum "$ARCHIVE" | awk '{print $1}')"
else
    SHA="$(shasum -a 256 "$ARCHIVE" | awk '{print $1}')"
fi

SIZE="$(wc -c < "$ARCHIVE" | tr -d '[:space:]')"

cat <<SUMMARY

Package:  ${ARCHIVE}
Files:    ${COUNT}
Size:     ${SIZE} bytes
SHA-256:  ${SHA}

Next: upload it in the Manage server under "Releases" with version ${VERSION}.
      Checksum and size are recomputed there; the values above are for checking.
SUMMARY