ci: promote immutable C++ packages

.github/scripts/pack-conan-candidate.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if [[ $# -lt 3 ]]; then
+  echo "usage: $0 <destination> <source-sha> <package-pattern>..." >&2
+  exit 1
+fi
+
+destination=$1
+source_sha=$2
+shift 2
+
+if [[ -e "$destination" ]]; then
+  echo "candidate destination already exists: ${destination}" >&2
+  exit 1
+fi
+
+temporary=$(mktemp -d)
+trap 'rm -rf "$temporary"' EXIT
+mkdir -p "$destination"
+
+lists=()
+index=0
+for pattern in "$@"; do
+  list="$temporary/packages-${index}.json"
+  conan list "$pattern" --format=json > "$list"
+  if jq --exit-status '[.[] | keys[]] | length > 0' "$list" >/dev/null; then
+    lists+=(--list "$list")
+  fi
+  index=$((index + 1))
+done
+
+if [[ ${#lists[@]} -eq 0 ]]; then
+  echo "no Conan packages matched the candidate patterns" >&2
+  exit 1
+fi
+
+conan pkglist merge "${lists[@]}" --format=json > "$destination/packages.json"
+conan cache check-integrity --list "$destination/packages.json"
+conan cache save --list "$destination/packages.json" --file "$destination/cache.tgz"
+jq -n --arg source "$source_sha" '{schema: 1, source: $source}' > "$destination/manifest.json"
+
+(
+  cd "$destination"
+  shasum -a 256 cache.tgz packages.json manifest.json > SHA256SUMS
+  shasum -a 256 -c SHA256SUMS
+)

.github/scripts/pack-release-candidate.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if [[ $# -ne 7 ]]; then
+  echo "usage: $0 <destination> <source-sha> <version> <channel> <os> <arch> <package-name>" >&2
+  exit 1
+fi
+
+destination=$1
+source_sha=$2
+version=$3
+channel=$4
+os=$5
+arch=$6
+package_name=$7
+
+if [[ -e "$destination" ]]; then
+  echo "candidate destination already exists: ${destination}" >&2
+  exit 1
+fi
+
+mkdir -p "$destination/package-api"
+cp -R out/release/. "$destination/package-api/"
+jq -n \
+  --arg source "$source_sha" \
+  --arg version "$version" \
+  --arg channel "$channel" \
+  --arg os "$os" \
+  --arg arch "$arch" \
+  --arg package_name "$package_name" \
+  '{schema: 1, source: $source, version: $version, channel: $channel, os: $os, arch: $arch, packageName: $package_name}' \
+  > "$destination/release.json"
+
+python3 - "$destination" <<'PY'
+from hashlib import sha256
+from pathlib import Path
+import sys
+
+root = Path(sys.argv[1])
+with (root / "SHA256SUMS").open("w", encoding="utf-8") as manifest:
+    files = (
+        item
+        for item in root.rglob("*")
+        if item.is_file() and item.name != "SHA256SUMS"
+    )
+    for path in sorted(files):
+        relative = path.relative_to(root).as_posix()
+        manifest.write(f"{sha256(path.read_bytes()).hexdigest()}  {relative}\n")
+PY
+
+(
+  cd "$destination"
+  shasum -a 256 -c SHA256SUMS
+)

.github/scripts/publish-conan-candidate.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if [[ $# -ne 3 ]]; then
+  echo "usage: $0 <candidate> <source-sha> <remote>" >&2
+  exit 1
+fi
+
+candidate=$1
+source_sha=$2
+remote=$3
+
+if [[ ! -f "$candidate/manifest.json" || "$(jq -r '.source' "$candidate/manifest.json")" != "$source_sha" ]]; then
+  echo "Conan candidate does not match the approved commit" >&2
+  exit 1
+fi
+
+(
+  cd "$candidate"
+  shasum -a 256 -c SHA256SUMS
+)
+
+conan cache restore "$candidate/cache.tgz"
+conan cache check-integrity --list "$candidate/packages.json"
+conan upload --list "$candidate/packages.json" -r "$remote" --check --confirm

.github/scripts/verify-release-candidate.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if [[ $# -ne 6 ]]; then
+  echo "usage: $0 <candidate> <source-sha> <version> <channel> <os> <arch>" >&2
+  exit 1
+fi
+
+candidate=$1
+source_sha=$2
+version=$3
+channel=$4
+os=$5
+arch=$6
+
+(
+  cd "$candidate"
+  shasum -a 256 -c SHA256SUMS
+)
+
+jq --exit-status \
+  --arg source "$source_sha" \
+  --arg version "$version" \
+  --arg channel "$channel" \
+  --arg os "$os" \
+  --arg arch "$arch" \
+  '.source == $source and .version == $version and .channel == $channel and .os == $os and .arch == $arch' \
+  "$candidate/release.json" >/dev/null

.github/workflows/build.yml

@@ -21,6 +21,15 @@ on:
 permissions:
   contents: read
 jobs:
+  release-workflow:
+    name: Release workflow
+    if: ${{ github.actor == vars.CI_ALLOWED_ACTOR }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
+      - run: python3 test/test_release_workflow.py
   build:
     name: Conan package
     if: ${{ github.actor == vars.CI_ALLOWED_ACTOR }}