dist: work on wiring up the continuous-deployment release

Now that Cranko has gained a couple of utility commands, we should
be able to reproduce this functionality ...

dist/azure-ci-cd.yml

@@ -246,4 +246,5 @@ stages:
           steps:
             - template: azure-deployment.yml
               parameters:
-                rcBuild: ${{ eq(variables['Build.SourceBranchName'], 'rc') }}
+                isMainDev: ${{ eq(variables['Build.SourceBranchName'], 'master') }}
+                isRelease: ${{ eq(variables['Build.SourceBranchName'], 'rc') }}

dist/azure-deployment.yml

@@ -2,78 +2,148 @@
 # Licensed under the MIT License.
 #
 # Deployment pipeline, run when all CI tests pass on `master` or `rc`.
+# Parameters:
+#
+# - `isMainDev`: this is an update to the main development branch; update
+#   continuous-deployment release
+# - `isRelease`: this is an update to the `rc` branch; run the Official Release
+#   machinery
 
 parameters:
-- name: rcBuild
+- name: isMainDev
+  type: boolean
+  default: false
+- name: isRelease
   type: boolean
   default: false
 
 steps:
 
-# if we're on the `rc` branch, the release has been fully vetted and the
-# internal artifacts have been gathered -- time to lock in a new `release`
-# commit and invoke the full release processes.
+- checkout: self
 
-- ${{ if eq(parameters.rcBuild, true) }}:
-  - checkout: self
+- bash: |
+    d="$(mktemp -d /tmp/cranko.XXXXXX)"
+    cd "$d"
+    curl --proto '=https' --tlsv1.2 -sSf https://pkgw.github.io/cranko/fetch-latest.sh | sh
+    echo "##vso[task.prependpath]$d"
+  displayName: Install latest Cranko
 
+- bash: |
+    git switch -c release
+    git pull --ff-only $(Pipeline.Workspace)/git-release/release.bundle
+    git show
+  displayName: Restore release commit
+
+# We determine a "toplevel" release mode that affects things like updates to the
+# book. The $TOPLEVEL_MODE variabe has three settings:
+#
+# - "latest" if this is continuous deployment/delivery, i.e. a push to the
+#   `master` branch. In this case we update things like the book under the
+#   version code "latest"
+# - "skip" if this is an RC update that does *not* update the main `tectonic`
+#   project. In this case we do not update things.
+# - Otherwise, the text of the variable is the version string of a new official
+#   release of the `tectonic` project. Things like the book should be updated
+#   with a real version number.
+- bash: |
+    if ${isMainDev} ; then
+      version_text=latest
+    else if cranko show if-released --exit-code tectonic ; then
+      version_text="$(cranko show version tectonic)"
+    else
+      version_text=skip
+    fi
+
+    echo "toplevel version: $isMainDev, $isRelease => $version_text"
+    echo "##vso[task.setvariable variable=TOPLEVEL_MODE;]$version_text"
+  displayName: Set toplevel release mode
+
+# Because we want to create GitHub releases for any Cranko project that gets
+# released, we always need the GitHub credential helper to be set up, even when
+# TOPLEVEL_MODE is "skip".
+- bash: |
+    git config --global user.email "notifications@github.com"
+    git config --global user.name "Tectonic CI"
+    cranko github install-credential-helper
+  displayName: Set up GitHub push credentials
+  env:
+    GITHUB_TOKEN: $(GITHUB_TOKEN)
+
+# Things that only happen when the toplevel mode is not "skip":
+- bash: |
+    set -xeuo pipefail
+
+    # Worth adding better Cranko support for this? reboot-branch is close
+    dist/force-push-tree.sh \
+      $(Pipeline.Workspace)/book \
+      https://github.com/tectonic-typesetting/book.git \
+      "$TOPLEVEL_MODE" \
+      "docs mdbook"
+  displayName: Update book HTML
+  condition: and(succeeded(), ne(variables['TOPLEVEL_MODE'], 'skip'))
+  env:
+    GITHUB_TOKEN: $(GITHUB_TOKEN)
+
+# Things that only happen in main-dev mode:
+- ${{ if parameters.isRelease }}:
   - bash: |
-      d="$(mktemp -d /tmp/cranko.XXXXXX)"
-      cd "$d"
-      curl --proto '=https' --tlsv1.2 -sSf https://pkgw.github.io/cranko/fetch-latest.sh | sh
-      echo "##vso[task.prependpath]$d"
-    displayName: Install latest Cranko
+      set -xeuo pipefail
+      cranko github delete-release continuous
+      git tag -f continuous HEAD
+      git push -f --tags origin continuous
+      cranko github create-custom-release \
+        --name "Continuous Deployment" \
+        --prerelease \
+        --desc "Continuous deployment of commit $(git rev-parse --short HEAD)" \
+        continuous
+      cranko github upload-artifacts continuous \
+        $(Pipeline.Workspace)/binary-*/* \
+        $(Pipeline.Workspace)/appimage/*
+    displayName: Recreate continuous-deployment GitHub release
+    env:
+      GITHUB_TOKEN: $(GITHUB_TOKEN)
 
+# Things that only happen in full-official-release mode:
+- ${{ if parameters.isRelease }}:
   - bash: |
-      git switch -c release
-      git pull --ff-only $(Pipeline.Workspace)/git-release/release.bundle
-      git show
       cranko release-workflow tag
-    displayName: Prepare release commit and tags
+    displayName: Create release tags
 
   - bash: |
-      cranko github install-credential-helper
       git push --tags origin release:release
     displayName: Update release branch
     env:
       GITHUB_TOKEN: $(GITHUB_TOKEN)
 
   - bash: |
-      cranko cargo foreach-released publish --no-verify
+      cranko cargo foreach-released -- publish --no-verify
     displayName: Publish updated Cargo crates
     env:
       CARGO_REGISTRY_TOKEN: $(CARGO_REGISTRY_TOKEN)
 
+  # The `if-released` check currently here could be folded in to an examination
+  # of $TOPLEVEL_MODE, but maybe one day we'll have other projects with
+  # associated artifacts, in which case I think the best approach will be to add
+  # more logic analogous to what we've got now.
   - bash: |
       cranko github create-releases
+
       if cranko show if-released --exit-code tectonic; then
         cranko github upload-artifacts tectonic \
           $(Pipeline.Workspace)/binary-*/* \
           $(Pipeline.Workspace)/appimage/*
       fi
-    displayName: Create GitHub releases
+    displayName: Create per-project GitHub releases
     env:
       GITHUB_TOKEN: $(GITHUB_TOKEN)
 
+  # Things that only happen in full-official-release mode, plus a new release of
+  # the toplevel project was made:
   - bash: |
-      if cranko show if-released --exit-code tectonic; then
-        # Worth adding better Cranko support for this? reboot-branch is close
-        dist/force-push-tree.sh \
-          $(Pipeline.Workspace)/book \
-          https://github.com/tectonic-typesetting/book.git \
-          "$(cranko show version tectonic)" \
-          "docs mdbook"
-      fi
-    displayName: Update book HTML
-    env:
-      GITHUB_TOKEN: $(GITHUB_TOKEN)
-
-  - bash: |
-      if cranko show if-released --exit-code tectonic; then
-        keypath=$(mktemp)
-        echo "$ARCHLINUX_DEPLOY_KEY_BASE64" |base64 -d >"$keypath"
-        bash dist/arch/deploy.sh "$keypath" "$(cranko show version tectonic)"
-      fi
+      keypath=$(mktemp)
+      echo "$ARCHLINUX_DEPLOY_KEY_BASE64" |base64 -d >"$keypath"
+      bash dist/arch/deploy.sh "$keypath" "$(cranko show version tectonic)"
     displayName: Update ArchLinux package
+    condition: and(succeeded(), ne(variables['TOPLEVEL_MODE'], 'skip'))
     env:
       ARCHLINUX_DEPLOY_KEY_BASE64: $(ARCHLINUX_DEPLOY_KEY_BASE64)

dist/force-push-tree.sh

@@ -15,13 +15,8 @@
 # $4 - brief free text identifying the commit/version of what's being deployed
 #      (used in the Git logs)
 #
-# Environment:
-#
-# $GITHUB_TOKEN - a bearer-token authentication token that can be used to
-#   authenticate writes to the repository specified by $2.
-#
-# See the code for how the token authentication is set up -- it is somewhat
-# magical.
+# We assume that GitHub commit creation and push authentication have been set up
+# externally.
 
 set -e
 
@@ -32,20 +27,6 @@ dest_repo_url="$2"
 dest_repo_path="$3"
 commit_desc="$4"
 
-# Configuration that we expect to be stable.
-
-git_user_email="notifications@github.com"
-git_user_name="Tectonic CI"
-
-# Set up Git and authentication.
-# Derived from: https://www.appveyor.com/docs/how-to/git-push/
-
-echo "Setting up Git ..."
-git config --global credential.helper store
-echo "https://$GITHUB_TOKEN:x-oauth-basic@github.com" >~/.git-credentials
-git config --global user.email "$git_user_email"
-git config --global user.name "$git_user_name"
-
 # Set up the target repo.
 
 echo "Cloning target repository $dest_repo_url ..."