Exercise publisher draft preservation and immediate retry.

Author: samuel-williams-shopify

.github/workflows/draft-release-test.yaml

@@ -16,3 +16,12 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           RELEASE_TARGET: a93ad87cf4f5235452935767bd7e2abde753b069
         run: python3 scripts/draft-release-probe.py
+      - uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+      - name: Test publisher preservation and retry
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TARGET: a93ad87cf4f5235452935767bd7e2abde753b069
+        run: bundle exec ruby -Ilib scripts/publisher-draft-probe.rb

lib/bake/gem/github/publisher.rb

@@ -120,7 +120,16 @@ def github_release(tag)
 					pages = JSON.parse(readlines("gh", "api", "--paginate", "--slurp", "repos/#{@repository}/releases?per_page=100", chdir: @root).join)
 					matches = pages.flatten(1).select{|release| release.fetch("tag_name") == tag}
 					raise "Multiple GitHub releases have the same tag." if matches.size > 1
-					matches.first
+					if release = matches.first
+						return api("releases/#{release.fetch('id')}")
+					end
+					# Resolve pending tags directly when the REST list has not caught up:
+					owner, name = @repository.split("/", 2)
+					query = "query($owner: String!, $name: String!, $tag: String!) { repository(owner: $owner, name: $name) { release(tagName: $tag) { databaseId } } }"
+					result = JSON.parse(readlines("gh", "api", "graphql", "-f", "query=#{query}", "-f", "owner=#{owner}", "-f", "name=#{name}", "-f", "tag=#{tag}", chdir: @root).join)
+					if release = result.fetch("data").fetch("repository").fetch("release")
+						api("releases/#{release.fetch('databaseId')}")
+					end
 				end
 
 				def guard_release(release, commit)
@@ -137,12 +146,15 @@ def preserve_release(receipt)
 					tag = "v#{receipt.fetch(:version)}"
 					release = github_release(tag)
 					unless release
-						Tempfile.create("release-notes") do |file|
-							file.write("#{receipt.fetch(:pull_request_url)}\n\nSource: #{receipt.fetch(:commit)}\nSHA256: #{receipt.fetch(:sha256)}\n\nSee releases.md at the release tag for release notes.\n")
+						Tempfile.create("release") do |file|
+							file.write(JSON.generate(
+								tag_name: tag, draft: true, target_commitish: receipt.fetch(:commit), name: "#{receipt.fetch(:name)} #{tag}",
+								body: "#{receipt.fetch(:pull_request_url)}\n\nSource: #{receipt.fetch(:commit)}\nSHA256: #{receipt.fetch(:sha256)}\n\nSee releases.md at the release tag for release notes.\n"
+							))
 							file.flush
-							system("gh", "release", "create", tag, "--repo", @repository, "--draft", "--target", receipt.fetch(:commit), "--title", "#{receipt.fetch(:name)} #{tag}", "--notes-file", file.path, chdir: @root)
+							# The release list can remain stale after a successful creation:
+							release = JSON.parse(readlines("gh", "api", "repos/#{@repository}/releases", "--method", "POST", "--input", file.path, chdir: @root).join)
 						end
-						release = github_release(tag) or raise "Draft release was not retained."
 					end
 					guard_release(release, receipt.fetch(:commit))
 					assets = release.fetch("assets")

scripts/publisher-draft-probe.rb

@@ -0,0 +1,36 @@
+require "bake/gem/github/publisher"
+require "tmpdir"
+
+Dir.mktmpdir do |root|
+	FileUtils.mkdir_p(File.join(root, "config"))
+	FileUtils.mkdir_p(File.join(root, "pkg"))
+	File.write(File.join(root, "config", "release.yaml"), YAML.dump("schema" => 1, "repository" => ENV.fetch("GITHUB_REPOSITORY"), "branch" => "main", "signing" => false))
+	publisher = Bake::Gem::GitHub::Publisher.new(root)
+	receipt = {
+		name: "draft-probe", version: "0.0.0-probe-#{ENV.fetch('GITHUB_RUN_ID')}",
+		commit: ENV.fetch("RELEASE_TARGET"), file: "draft-probe.gem", sha256: Digest::SHA256.hexdigest("Probe bytes"),
+		pull_request_url: "Temporary publisher API test; no gem is published."
+	}
+	tag = "v#{receipt.fetch(:version)}"
+	File.write(File.join(root, "pkg", "draft-probe.gem"), "Probe bytes")
+	File.write(File.join(root, "pkg", "draft-probe.gem.sigstore.json"), "{}")
+	File.write(File.join(root, "pkg", "provenance.sigstore.json"), "{}")
+	File.write(File.join(root, "pkg", "release.json"), JSON.generate(receipt))
+	begin
+		raise "Probe release already exists" if publisher.send(:github_release, tag)
+		first = publisher.send(:preserve_release, receipt)
+		second = publisher.send(:preserve_release, receipt)
+		raise "Created another draft on retry" unless first.fetch("id") == second.fetch("id")
+		raise "Wrong number of assets" unless second.fetch("assets").size == 4
+		download = File.join(root, "restored")
+		publisher.system("gh", "release", "download", tag, "--repo", ENV.fetch("GITHUB_REPOSITORY"), "--dir", download, chdir: root)
+		Dir.children(File.join(root, "pkg")).each do |name|
+			raise "Restored file differs" unless File.binread(File.join(download, name)) == File.binread(File.join(root, "pkg", name))
+		end
+		puts "Publisher preserved four files, reused the same draft on immediate retry, and restored identical bytes."
+	ensure
+		if release = publisher.send(:github_release, tag)
+			publisher.system("gh", "api", "repos/#{ENV.fetch('GITHUB_REPOSITORY')}/releases/#{release.fetch('id')}", "--method", "DELETE", chdir: root)
+		end
+	end
+end