internal/ci: update trybot workflow to also do releases

We plan to do releases as part of CI/CD for the VSCode extension. That
will be triggered by tagging the repository with a semantic version
string, e.g. 'v0.0.5'. This version must correspond to the declared
version of the extension in extension.cue.

This CL extends the trybot workflow to perform such a release on the
event of a 'v*' tag. It includes a CUE workflow command that performs
the check to ensure the tag on the repo matches the declared version
(noting that the declared version is only semver-like).

We set the VSCODE_PAT env var based on the cueckoo credentials establish
for the purpose of publishing.

Signed-off-by: Paul Jolly <[email protected]>
Change-Id: I1cf4993017a67769f970bd7d727c4f23e69a6077

.github/workflows/trybot.yaml

@@ -3,6 +3,8 @@
 name: TryBot
 "on":
   push:
+    tags:
+      - v*
     branches:
       - ci/test
       - master
@@ -140,3 +142,13 @@ jobs:
       - if: always()
         name: Check that git is clean at the end of the job
         run: test -z "$(git status --porcelain)" || (git status; git diff; false)
+      - working-directory: extension
+        if: github.repository == 'cue-lang/vscode-cue' && (startsWith(github.ref, 'refs/tags/v'))
+        name: Check version match
+        run: cue cmd -t tag=${GITHUB_REF##refs/tags/} checkReleaseVersion
+      - working-directory: extension
+        if: github.repository == 'cue-lang/vscode-cue' && (startsWith(github.ref, 'refs/tags/v') || (github.ref == 'refs/heads/ci/test'))
+        name: Release package
+        run: npm run publish -- -p $VSCODE_PAT
+        env:
+          VSCODE_PAT: ${{ secrets.CUECKOO_VSCODE_PAT }}

extension/extension_tool.cue

@@ -62,3 +62,23 @@ command: writebackPackageJSON: {
 		contents: place.stdout
 	}
 }
+
+// checkReleaseVersion ensures that the extension-configured version (which is
+// not actually a true semver version) corresponds to the string "argument"
+// passed via the attribute named tag are equal. We use a rather unpleasant
+// hack to force a failure because cue cmd has no such primitive.
+command: checkReleaseVersion: {
+	_version: string @tag(tag)
+
+	let commitVersion = "v" + extension.npm.version
+
+	if commitVersion != _version {
+		msg: exec.Run & {
+			cmd: ["echo", "commitVersion \(commitVersion) != tag version \(_version)", "&&", "false"]
+		}
+		error: exec.Run & {
+			$after: msg
+			cmd:    "false"
+		}
+	}
+}

internal/ci/github/trybot.cue

@@ -27,6 +27,7 @@ workflows: trybot: _repo.bashWorkflow & {
 
 	on: {
 		push: {
+			tags: [_repo.releaseTagPattern]
 			branches: list.Concat([[_repo.testDefaultBranch], _repo.protectedBranchPatterns]) // do not run PR branches
 		}
 		pull_request: {}
@@ -70,6 +71,12 @@ workflows: trybot: _repo.bashWorkflow & {
 		let extensionStep = {
 			"working-directory": "extension"
 		}
+		let releaseStep = extensionStep & {
+			if: "github.repository == '\(_repo.githubRepositoryPath)' && (\(_repo.isReleaseTag))"
+		}
+		let releaseOrTestDefaultStep = extensionStep & {
+			if: "github.repository == '\(_repo.githubRepositoryPath)' && (\(_repo.isReleaseTag) || \(_repo.isTestDefaultBranch))"
+		}
 
 		steps: [
 			for v in _repo.checkoutCode {v},
@@ -133,10 +140,26 @@ workflows: trybot: _repo.bashWorkflow & {
 
 			// Final checks
 			_repo.checkGitClean,
+
+			// Release steps
+			releaseStep & {
+				name: "Check version match"
+				run:  "cue cmd -t tag=\(_versionRef) checkReleaseVersion"
+			},
+			releaseOrTestDefaultStep & {
+				name: "Release package"
+				run:  "npm run publish -- -p $VSCODE_PAT"
+				env: VSCODE_PAT: "${{ secrets.CUECKOO_VSCODE_PAT }}"
+			},
+
 		]
 	}
 }
 
+// _versionRef is a workflow job-runtime expression that evaluates to the git
+// tag (version) that is being released
+_versionRef: "${GITHUB_REF##refs/tags/}"
+
 _installNode: githubactions.#Step & {
 	name: "Install Node"
 	uses: "actions/setup-node@v4"