eric
b8e9b65995
curl drops the Authorization header when -L follows Gitea's 308 redirect from http server_url to https, so the API replied 'token is required' and publish failed with no release id. Add --location-trusted to every publish curl.
118 lines
4.5 KiB
YAML
118 lines
4.5 KiB
YAML
name: release
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
tags:
|
|
- 'v*'
|
|
|
|
jobs:
|
|
# Gateway contract gate: the plugin must bind and wire against the REAL
|
|
# Hermes gateway API (pinned to the deployed image source) before any
|
|
# release can be built or published. Without this, adapter/API drift used
|
|
# to surface only as a gateway crash after deploy (the set_message_handler
|
|
# AttributeError). HERMES_CONTRACT_REQUIRED=1 turns a missing hermes-agent
|
|
# into a hard failure so this gate can never silently skip.
|
|
contract-test:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Python 3.13 (matches Hermes image)
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: '3.13'
|
|
|
|
- name: Install uv
|
|
run: pip install uv
|
|
|
|
- name: Clone pinned Hermes gateway source (deployed image tag)
|
|
run: |
|
|
git clone --depth 1 --branch v2026.8.31 \
|
|
https://github.com/NousResearch/hermes-agent.git plugin/.hermes-src
|
|
test "$(git -C plugin/.hermes-src rev-parse HEAD)" = \
|
|
"29112bef099274229cadff79cdff7bf7b99c4b77"
|
|
|
|
- name: Editable install hermes-agent + pytest
|
|
run: |
|
|
uv venv --python 3.13 plugin/.venv-contract
|
|
uv pip install --python plugin/.venv-contract/bin/python -e plugin/.hermes-src
|
|
uv pip install --python plugin/.venv-contract/bin/python pytest
|
|
|
|
- name: Run gateway contract tests
|
|
env:
|
|
HERMES_CONTRACT_REQUIRED: '1'
|
|
run: |
|
|
cd plugin
|
|
.venv-contract/bin/python -m pytest tests/contract -q
|
|
|
|
test-and-release:
|
|
runs-on: ubuntu-latest
|
|
needs: contract-test
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Python venv & dependencies
|
|
run: |
|
|
python3 -m venv .venv
|
|
. .venv/bin/activate
|
|
pip install --upgrade pip
|
|
pip install uv pytest
|
|
|
|
- name: Run unit tests
|
|
run: |
|
|
. .venv/bin/activate
|
|
PYTHONPATH=plugin pytest plugin/tests
|
|
|
|
- name: Build wheel and sdist
|
|
run: |
|
|
. .venv/bin/activate
|
|
uv build plugin/
|
|
|
|
- name: Publish Gitea Release
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
tag_name="${GITHUB_REF#refs/tags/}"
|
|
echo "Publishing release for $tag_name"
|
|
wheel_file=$(ls plugin/dist/*.whl | head -n 1)
|
|
tar_file=$(ls plugin/dist/*.tar.gz | head -n 1)
|
|
api_url="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
|
|
|
|
# server_url is http and Gitea answers with a 308 redirect to https.
|
|
# curl needs -L to follow, AND --location-trusted: without it curl
|
|
# drops the Authorization header on the scheme-changing redirect and
|
|
# Gitea replies "token is required". Release may already exist
|
|
# (retried run) — reuse it instead of failing.
|
|
fetch_id() { python3 -c "import json,sys;print(json.load(sys.stdin).get('id') or '')" 2>/dev/null; }
|
|
|
|
response=$(curl -s -k -L --location-trusted -H "Authorization: token $GITEA_TOKEN" \
|
|
"$api_url/releases/tags/$tag_name")
|
|
release_id=$(printf '%s' "$response" | fetch_id)
|
|
|
|
if [ -z "$release_id" ]; then
|
|
response=$(curl -s -k -L --location-trusted -X POST "$api_url/releases" \
|
|
-H "Authorization: token $GITEA_TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{\"tag_name\": \"$tag_name\", \"name\": \"$tag_name\", \"body\": \"Release $tag_name for hermes-meshtastic plugin\"}")
|
|
release_id=$(printf '%s' "$response" | fetch_id)
|
|
fi
|
|
|
|
if [ -n "$release_id" ]; then
|
|
curl -s -k -L --location-trusted -X POST "$api_url/releases/$release_id/assets?name=$(basename "$wheel_file")" \
|
|
-H "Authorization: token $GITEA_TOKEN" \
|
|
-H "Content-Type: application/octet-stream" \
|
|
--data-binary "@$wheel_file"
|
|
curl -s -k -L --location-trusted -X POST "$api_url/releases/$release_id/assets?name=$(basename "$tar_file")" \
|
|
-H "Authorization: token $GITEA_TOKEN" \
|
|
-H "Content-Type: application/octet-stream" \
|
|
--data-binary "@$tar_file"
|
|
else
|
|
echo "ERROR: could not create or fetch release $tag_name" >&2
|
|
exit 1
|
|
fi
|