Merge pull request 'fix(release): recover a tag whose release never published' (#27) from fix/release-tag-without-release into main

Reviewed-on: #27

.gitea/workflows/release.yml

@@ -28,6 +28,11 @@
 #                     write:package; THIS workflow additionally needs
 #                     `write:repository` so it can push the bump commit + tag
 #                     and create the release. Grant that scope to the token.
+#                     The final step also dispatches RunicGateway/installer's
+#                     bundle workflow, so the token ideally has write there too
+#                     — but that is a nicety, not a requirement: without it the
+#                     step warns and the installer's nightly cron picks the
+#                     release up instead.
 #   Also: `main` must accept a direct push from that user (disable branch
 #   protection for it, or add it as an exception) — the bump commit lands on main.
 #
@@ -51,6 +56,13 @@ env:
   BIN: uo-link-sidecar
   LINUX_TARGET: x86_64-unknown-linux-gnu
   WINDOWS_TARGET: x86_64-pc-windows-gnu
+  # Ampere/Graviton instances and Pi-class boxes are a realistic ServUO home,
+  # and the shard dials the sidecar out on loopback — so wherever the shard
+  # runs, this binary has to run too (installer PLAN.md §5.2).
+  ARM64_TARGET: aarch64-unknown-linux-gnu
+  # Notified after a release so the installer's compat matrix picks up this
+  # version immediately rather than at its next nightly run (PLAN.md §7.2).
+  INSTALLER_REPO: RunicGateway/installer
 
 jobs:
   release:
@@ -68,6 +80,8 @@ jobs:
       # ── RELEASE ENGINE: decide the next version + changelog ──────────────
       - name: Plan the release (version + changelog)
         id: plan
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
           set -euo pipefail
           mkdir -p dist
@@ -105,21 +119,59 @@ jobs:
             VERSION="$(bump "${LAST_TAG#v}" "$BUMP")"
           fi
 
+          # An existing tag is NOT automatically "nothing to do". A tag with no
+          # release behind it means a previous run tagged and then died before
+          # publishing — which is exactly what happened on servuo-plugins' first
+          # release, where absent REGISTRY_* secrets took the release API call to
+          # 401 after the tag had already been pushed. Standing down on the tag
+          # alone makes that state permanent: every later run sees the tag, sets
+          # RELEASE=false, and the release never appears. Note this deliberately
+          # OVERRIDES the RELEASE=false decided just above — with the tag in
+          # place there are no releasable commits after it, so the normal path
+          # would stand down, which is exactly why it could never self-heal.
+          REUSE_TAG=false
           if git rev-parse -q --verify "refs/tags/v${VERSION}" >/dev/null; then
-            echo "Tag v${VERSION} already exists — nothing to release."
+            CI_TOKEN="$(printf '%s' "${REGISTRY_TOKEN:-}" | tr -d '\r\n')"
+            REL_HTTP="$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: token ${CI_TOKEN}" "https://${GITEA_HOST}/api/v1/repos/${REPO}/releases/tags/v${VERSION}" || echo 000)"
+            if [ "$REL_HTTP" = "200" ]; then
+              echo "Tag v${VERSION} already has a release — nothing to do."
               RELEASE=false
+            elif [ "$REL_HTTP" = "404" ]; then
+              echo "::warning::Tag v${VERSION} exists but has no release — a previous run failed after tagging. Reusing the tag and publishing the release it is missing."
+              REUSE_TAG=true
+              RELEASE=true
+            else
+              # Anything else (000 from a network failure, 401/403 from a bad
+              # token) is not evidence of absence. Guessing "no release" would
+              # re-publish over a good one, so refuse instead.
+              echo "::error::Could not determine whether a release exists for v${VERSION} (HTTP ${REL_HTTP}). Refusing to guess."
+              exit 1
             fi
+          fi
+
+          # Changelog range. A recovery run has nothing after the tag, so
+          # summarize what the tag itself contains rather than emitting an empty
+          # list: the range that produced it, i.e. previous-tag..this-tag.
+          if [ "$REUSE_TAG" = true ]; then
+            PREV_TAG="$(git describe --tags --match 'v*' --abbrev=0 "v${VERSION}^" 2>/dev/null || true)"
+            if [ -n "$PREV_TAG" ]; then CL_RANGE="${PREV_TAG}..v${VERSION}"; else CL_RANGE="v${VERSION}"; fi
+            SINCE="$PREV_TAG"
+          else
+            CL_RANGE="$RANGE"
+            SINCE="$LAST_TAG"
+          fi
+          CL_SUBJECTS="$(git log --no-merges --format='%s' $CL_RANGE || true)"
 
           {
             echo "## ${BIN} v${VERSION}"
             echo
-            FEATS="$(echo "$SUBJECTS" | grep -E '^feat'        || true)"
+            FEATS="$(echo "$CL_SUBJECTS" | grep -E '^feat'        || true)"
-            FIXES="$(echo "$SUBJECTS" | grep -E '^(fix|perf)'  || true)"
+            FIXES="$(echo "$CL_SUBJECTS" | grep -E '^(fix|perf)'  || true)"
             [ -n "$FEATS" ] && { echo "### Features";  echo "$FEATS" | sed 's/^/- /'; echo; }
             [ -n "$FIXES" ] && { echo "### Fixes";     echo "$FIXES" | sed 's/^/- /'; echo; }
             echo "### All changes"
-            if [ -n "$LAST_TAG" ]; then echo "Since ${LAST_TAG}:"; fi
+            if [ -n "$SINCE" ]; then echo "Since ${SINCE}:"; fi
-            echo "$SUBJECTS" | sed 's/^/- /'
+            echo "$CL_SUBJECTS" | sed 's/^/- /'
           } > dist/CHANGELOG.md
 
           echo "version=${VERSION}"   >> "$GITHUB_OUTPUT"
@@ -129,14 +181,26 @@ jobs:
           echo "==> release=${RELEASE} version=${VERSION} bump=${BUMP} last_tag=${LAST_TAG:-<none>}"
 
       # ── RUST ADAPTER: toolchain + cross-compile deps ─────────────────────
-      - name: Install Rust toolchain, Windows target, and MinGW linker
+      - name: Install Rust toolchain, cross targets, and their linkers
         if: ${{ steps.plan.outputs.release == 'true' }}
         run: |
           set -euo pipefail
           SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo"
           $SUDO apt-get update
+          # The arm64 cross toolchain is not optional for this crate: sqlx's
+          # sqlite feature pulls libsqlite3-sys, which compiles bundled SQLite
+          # from C, so a Rust-only cross build fails at the first .c file.
+          #
+          # libc6-dev-arm64-cross is named explicitly because gcc-aarch64-linux-gnu
+          # only *recommends* it, and this install is --no-install-recommends: the
+          # compiler arrives without arm64 libc headers and SQLite's build dies on
+          # `bits/libc-header-start.h: No such file or directory`. Verified by
+          # reproducing both the failure and the fix in a rust:1-slim-bookworm
+          # container.
           $SUDO apt-get install -y --no-install-recommends \
-            build-essential gcc-mingw-w64-x86-64 curl ca-certificates git jq
+            build-essential gcc-mingw-w64-x86-64 \
+            gcc-aarch64-linux-gnu libc6-dev-arm64-cross \
+            curl ca-certificates git jq
 
           if ! command -v cargo >/dev/null 2>&1; then
             curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
@@ -146,6 +210,7 @@ jobs:
           export PATH="${HOME}/.cargo/bin:${PATH}"
           rustup component add rustfmt
           rustup target add "${WINDOWS_TARGET}"
+          rustup target add "${ARM64_TARGET}"
 
       - name: Set the crate version to match the release
         if: ${{ steps.plan.outputs.release == 'true' }}
@@ -187,14 +252,30 @@ jobs:
           AR_x86_64_pc_windows_gnu: x86_64-w64-mingw32-ar
         run: cargo build --release --locked --target "${WINDOWS_TARGET}"
 
+      # Same shape as the Windows step: a linker for Rust's output and a CC/AR
+      # pair for the cc-crate build of bundled SQLite.
+      - name: cargo build --release (Linux arm64, cross via aarch64-linux-gnu)
+        if: ${{ steps.plan.outputs.release == 'true' }}
+        working-directory: sidecar
+        env:
+          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
+          CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
+          AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar
+        run: cargo build --release --locked --target "${ARM64_TARGET}"
+
       # ── RUST ADAPTER: package artifacts (+ checksums) ────────────────────
       - name: Package artifacts and SHA256SUMS
         if: ${{ steps.plan.outputs.release == 'true' }}
         run: |
           set -euo pipefail
           cp "${WORKDIR}/target/${LINUX_TARGET}/release/${BIN}"        "dist/${BIN}-linux-x86_64"
+          cp "${WORKDIR}/target/${ARM64_TARGET}/release/${BIN}"        "dist/${BIN}-linux-aarch64"
           cp "${WORKDIR}/target/${WINDOWS_TARGET}/release/${BIN}.exe"  "dist/${BIN}-windows-x86_64.exe"
-          ( cd dist && sha256sum "${BIN}-linux-x86_64" "${BIN}-windows-x86_64.exe" > SHA256SUMS )
+          # Every artifact must appear here: the installer verifies its download
+          # against these sums, and `sha256sum -c` passes silently over a file
+          # this list does not mention.
+          ( cd dist && sha256sum "${BIN}-linux-x86_64" "${BIN}-linux-aarch64" \
+              "${BIN}-windows-x86_64.exe" > SHA256SUMS )
           ls -l dist && echo "----" && cat dist/SHA256SUMS
 
       # ── RELEASE ENGINE: commit the bump, tag, push ───────────────────────
@@ -225,7 +306,16 @@ jobs:
           else
             echo "Version unchanged (first release) — no bump commit needed."
           fi
+          # The tag may already exist when finishing a run that died after tagging
+          # (see the plan step). `git tag` on an existing name fails under
+          # `set -e`; pushing an identical existing tag is a harmless no-op. A
+          # push that fails here means the remote tag points somewhere else,
+          # which SHOULD stop the run.
+          if git rev-parse -q --verify "refs/tags/${TAG}" >/dev/null; then
+            echo "Tag ${TAG} already exists — reusing it."
+          else
             git tag "${TAG}"
+          fi
           git push origin "${TAG}"
 
       # ── RELEASE ENGINE: create the Gitea release + upload assets ─────────
@@ -250,9 +340,51 @@ jobs:
             | jq -r '.id')"
           echo "Created release ${TAG} (id=${REL_ID})"
 
-          for f in "${BIN}-linux-x86_64" "${BIN}-windows-x86_64.exe" SHA256SUMS; do
+          for f in "${BIN}-linux-x86_64" "${BIN}-linux-aarch64" "${BIN}-windows-x86_64.exe" SHA256SUMS; do
             curl -sSf -X POST "${API}/releases/${REL_ID}/assets?name=${f}" \
               -H "Authorization: token ${CI_TOKEN}" \
               -F "attachment=@dist/${f}" >/dev/null
             echo "  uploaded ${f}"
           done
+
+      # ── Recompose the installer's bundle manifest ────────────────────────
+      # The installer does not resolve "latest" at run time — it installs the
+      # exact combination named by a published bundle (docs/installer/PLAN.md
+      # §7.1). So a sidecar release that nobody recomposes around is a release
+      # no operator will ever be offered. This step tells the installer repo to
+      # rebuild that manifest now, instead of leaving the new version invisible
+      # until its nightly cron.
+      #
+      # DISPATCH, DON'T WAIT (PLAN.md §7.3). Gitea's workflow-dispatch endpoint
+      # returns no run handle, so there is nothing to poll: a waiting step would
+      # have to guess which run is its own and hold a runner idle to do it. The
+      # bundle job runs its own gates regardless of who started it.
+      #
+      # A failure here is a WARNING, never a failure of this job. The release is
+      # already published and correct by this point; failing the run would
+      # misreport that. The installer's nightly cron recomposes from whatever
+      # the latest releases actually are, so a dropped dispatch self-heals — it
+      # costs latency, not correctness.
+      #
+      # `repository_dispatch` is deliberately not used: support for it is
+      # uncertain on this Gitea version, while dispatching an existing
+      # workflow_dispatch workflow via the API works today.
+      - name: Ask the installer repo to recompose its bundle
+        if: ${{ steps.plan.outputs.release == 'true' }}
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -euo pipefail
+          CI_TOKEN="$(printf '%s' "${REGISTRY_TOKEN}" | tr -d '\r\n')"
+          HTTP="$(curl -s -o /dev/null -w '%{http_code}' -X POST \
+            -H "Authorization: token ${CI_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d '{"ref":"main"}' \
+            "https://${GITEA_HOST}/api/v1/repos/${INSTALLER_REPO}/actions/workflows/bundle.yml/dispatches" || echo 000)"
+          case "$HTTP" in
+            20*) echo "Dispatched ${INSTALLER_REPO} bundle.yml (HTTP ${HTTP}) — not waiting for it." ;;
+            403|404)
+              echo "::warning::Could not dispatch ${INSTALLER_REPO} bundle.yml (HTTP ${HTTP}). REGISTRY_TOKEN likely lacks write:repository on that repo. Release ${{ steps.plan.outputs.tag }} is published and fine; its bundle will be composed by the installer's nightly cron instead." ;;
+            *)
+              echo "::warning::Dispatching ${INSTALLER_REPO} bundle.yml returned HTTP ${HTTP}. Release ${{ steps.plan.outputs.tag }} is published and fine; the nightly cron will recompose the bundle." ;;
+          esac