| 1 | #!/usr/bin/env bash |
| 2 | # Dispatch publication or recovery for a previously sealed release candidate. |
| 3 | # Tag creation belongs to the approved protected workflow, after provenance and |
| 4 | # artifact bytes have been verified. |
| 5 | set -euo pipefail |
| 6 | |
| 7 | if [ "$#" -lt 1 ] || [ "$#" -gt 2 ] || [[ ! "$1" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)-[0-9a-f]{12}-[0-9a-f]{12}$ ]]; then |
| 8 | echo "usage: scripts/release-stable.sh CANDIDATE_ID [publish|recover]" >&2 |
| 9 | exit 2 |
| 10 | fi |
| 11 | |
| 12 | candidate_id="$1" |
| 13 | operation="${2:-publish}" |
| 14 | case "$operation" in publish | recover) ;; *) echo "operation must be publish or recover" >&2; exit 2 ;; esac |
| 15 | repository="${RELEASE_REPOSITORY:-esengine/DeepSeek-Reasonix}" |
| 16 | |
| 17 | for command in gh jq; do |
| 18 | command -v "$command" >/dev/null || { echo "required command is unavailable: $command" >&2; exit 2; } |
| 19 | done |
| 20 | |
| 21 | payload="$(jq -cn --arg ref main-v2 --arg candidate_id "$candidate_id" --arg operation "$operation" \ |
| 22 | '{ref: $ref, inputs: {candidate_id: $candidate_id, operation: $operation}}')" |
| 23 | gh api -X POST "repos/$repository/actions/workflows/release-promote.yml/dispatches" --input - <<<"$payload" |
| 24 | |
| 25 | echo "Dispatched $operation for $candidate_id on protected main-v2." |
| 26 | echo "The workflow verifies the sealed candidate, then requests one release approval." |
| 27 |