Merge branch 'improve-desktop-release-scripts'

8 files changed, 134 insertions, 76 deletions

diff --git a/desktop/scripts/prepare-release.sh b/desktop/scripts/release/1-prepare-release
index 18859d260d..4becc19d06 100755
--- a/desktop/scripts/prepare-release.sh
+++ b/desktop/scripts/release/1-prepare-release
@@ -1,22 +1,21 @@
 #!/usr/bin/env bash
 
 # This script prepares for a release. Run it with the release version as the first argument and it
-# will update version numbers, commit and add a signed tag.
+# will update version numbers, update the changelog, and update copyright year.
 
 set -eu
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 cd "$SCRIPT_DIR"
 
-REPO_ROOT=../../
+REPO_ROOT=../../../
 
 source $REPO_ROOT/scripts/utils/log
+source $REPO_ROOT/scripts/utils/print-and-run
 
-PUSH_TAG="false"
 
 for argument in "$@"; do
     case "$argument" in
-        --push-tag) PUSH_TAG="true" ;;
         -*)
             log_error "Unknown option \"$argument\""
             exit 1
@@ -27,15 +26,10 @@ for argument in "$@"; do
     esac
 done
 
-changes_path=../packages/mullvad-vpn/changes.txt
+changes_path=$REPO_ROOT/desktop/packages/mullvad-vpn/changes.txt
 changelog_path=$REPO_ROOT/CHANGELOG.md
 product_version_path=$REPO_ROOT/dist-assets/desktop-product-version.txt
 
-function print_and_run {
-    echo "+ $*"
-    "$@"
-}
-
 function checks {
     if [[ -z ${PRODUCT_VERSION+x} ]]; then
         log_error "Please give the release version as an argument to this script."
@@ -88,7 +82,9 @@ function check_changelog {
 
 function update_copyright_year {
     $REPO_ROOT/scripts/update-copyright
-    print_and_run git commit -A -S -m "Update copyright year in project files and code"
+    if [[ $(git diff --shortstat 2> /dev/null | tail -n1) != "" ]]; then
+        print_and_run git commit -a -S -m "Update copyright year in project files and code"
+    fi
 }
 
 function update_changelog {
@@ -107,31 +103,18 @@ function update_product_version {
         $product_version_path
 }
 
-function push_tag {
-    product_version=$(echo -n "$(cat $product_version_path)")
-    echo "Tagging current git commit with release tag $product_version..."
-    print_and_run git tag -s "$product_version" -m "$product_version"
-    print_and_run git push origin "$product_version"
-    log_success "\nTag pushed!"
-}
-
-if [[ $PUSH_TAG == "true" ]]; then
-    check_commit_signature
-    push_tag
-else
-    checks
-    check_commit_signature
-    check_changelog
-    update_changelog
-    update_copyright_year
-    update_product_version
+checks
+check_commit_signature
+check_changelog
+update_changelog
+update_copyright_year
+update_product_version
 
-    log_success "\n================================================="
-    log_success "| DONE preparing for a release!                 |"
-    log_success "|    Now verify that everything looks correct   |"
-    log_success "|    and then create and push the tag by        |"
-    log_success "|    running:                                   |"
-    log_success "|    $ $0 \\ "
-    log_success "|        --push-tag                             |"
-    log_success "================================================="
-fi
+log_success "\n================================================="
+log_success "| DONE preparing for a release!                 |"
+log_success "|    Now verify that everything looks correct   |"
+log_success "|    and then create and push the tag by        |"
+log_success "|    running:                                   |"
+log_success "|    $ $0 \\ "
+log_success "|        --push-tag                             |"
+log_success "================================================="
diff --git a/desktop/scripts/release/2-push-release-tag b/desktop/scripts/release/2-push-release-tag
new file mode 100755
index 0000000000..a5115ed860
--- /dev/null
+++ b/desktop/scripts/release/2-push-release-tag
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+
+# This script creates and pushes a signed release tag. This should be run after `1-prepare-release`.
+
+set -eu
+
+SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+cd "$SCRIPT_DIR"
+
+REPO_ROOT=../../../
+PRODUCT_VERSION_PATH=$REPO_ROOT/dist-assets/desktop-product-version.txt
+PRODUCT_VERSION=$(cat $PRODUCT_VERSION_PATH)
+
+source $REPO_ROOT/scripts/utils/print-and-run
+source $REPO_ROOT/scripts/utils/log
+
+function push_tag {
+    product_version=$(echo -n "$PRODUCT_VERSION")
+    echo "Tagging current git commit with release tag $product_version..."
+    print_and_run git tag -s "$product_version" -m "$product_version"
+    git push
+    print_and_run git push origin "$product_version"
+    log_success "\nTag pushed!"
+}
+
+git verify-commit HEAD
+push_tag
diff --git a/desktop/scripts/release/3-verify-build b/desktop/scripts/release/3-verify-build
new file mode 100755
index 0000000000..be8ebde50d
--- /dev/null
+++ b/desktop/scripts/release/3-verify-build
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+# This script verifies the build produced by the buildserver. It helps the user verify the staging
+# repository versions and triggers a e2e run with a small subset of the tests to verify the build.
+# This should be be run after `2-push-release-tag` and after the build server has finished building.
+
+set -eu
+
+SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+cd "$SCRIPT_DIR"
+
+REPO_ROOT=../../../
+PRODUCT_VERSION_PATH=$REPO_ROOT/dist-assets/desktop-product-version.txt
+PRODUCT_VERSION=$(cat $PRODUCT_VERSION_PATH)
+
+$REPO_ROOT/scripts/utils/gh-ready-check
+source $REPO_ROOT/scripts/utils/log
+
+function verify_repository_versions {
+  print_versions_args=( --staging )
+
+  if [[ "$PRODUCT_VERSION" == *-beta* ]]; then
+    print_versions_args+=( --beta )
+  fi
+
+  ./print-package-versions "${print_versions_args[@]}"
+  read -r -n 1 -p "Does the versions look correct? (y/N): " response
+  printf "\n\n"
+
+  if [[ "$response" =~ ^[Yy]$ ]]; then
+      return
+  elif [[ "$response" =~ ^[Nn]$ ]]; then
+      log_info "Aborting"
+      exit 1
+  else
+      log_error "Invalid response"
+      exit 1
+  fi
+}
+
+verify_repository_versions
+gh workflow run desktop-e2e.yml --ref "$PRODUCT_VERSION" \
+    -f oses="fedora41 ubuntu2404 windows11 macos15" \
+    -f tests="test_quantum_resistant_tunnel test_ui_tunnel_settings"
diff --git a/desktop/scripts/make-release b/desktop/scripts/release/4-make-release
index 8af3a94119..0f421e30b1 100755
--- a/desktop/scripts/make-release
+++ b/desktop/scripts/release/4-make-release
@@ -1,23 +1,19 @@
 #!/usr/bin/env bash
 
+# This script downloads the build artifacts along with the signatures, verifies the signatures and
+# creates a GitHub draft release. This should be run after `3-verify-build`.
+
 set -eu
 
-if ! command -v gh > /dev/null; then
-    echo >&2 "gh (GitHub CLI) is required to run this script"
-    exit 1
-fi
+SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+cd "$SCRIPT_DIR"
 
-if ! gh auth status > /dev/null; then
-    echo >&2 "Authentication through gh (GitHub CLI) is required to run this script"
-    exit 1
-fi
+REPO_ROOT=../../../
+PRODUCT_VERSION_PATH=$REPO_ROOT/dist-assets/desktop-product-version.txt
+PRODUCT_VERSION=$(cat $PRODUCT_VERSION_PATH)
 
-if [[ $# != 1 ]]; then
-    echo "!!! Please pass the app version as the first and only argument"
-    exit 1
-fi
+$REPO_ROOT/scripts/utils/gh-ready-check
 
-PRODUCT_VERSION=$1
 REPO_URL="git@github.com:mullvad/mullvadvpn-app"
 ARTIFACT_DIR=$(mktemp -d)
 REPO_DIR=$(mktemp -d)
diff --git a/desktop/scripts/print-package-versions.sh b/desktop/scripts/release/print-package-versions
index 9d255f5fac..2170f5417c 100755
--- a/desktop/scripts/print-package-versions.sh
+++ b/desktop/scripts/release/print-package-versions
@@ -27,9 +27,9 @@ SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 cd "$SCRIPT_DIR"
 
 # shellcheck source=ci/linux-repository-builder/build-linux-repositories-config.sh
-source build-linux-repositories-config.sh
+source ../../../ci/linux-repository-builder/build-linux-repositories-config.sh
 # shellcheck source=scripts/utils/log
-source ../../scripts/utils/log
+source ../../../scripts/utils/log
 
 deb="false"
 rpm="false"
diff --git a/desktop/scripts/test-release-artifacts b/desktop/scripts/test-release-artifacts
deleted file mode 100755
index fb5ffe6ccb..0000000000
--- a/desktop/scripts/test-release-artifacts
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-
-set -eu
-
-if ! command -v gh > /dev/null; then
-    echo >&2 "gh (GitHub CLI) is required to run this script"
-    exit 1
-fi
-
-if ! gh auth status > /dev/null; then
-    echo >&2 "Authentication through gh (GitHub CLI) is required to run this script"
-    exit 1
-fi
-
-if [[ $# != 1 ]]; then
-    echo "!!! Please pass the app version as the first and only argument"
-    exit 1
-fi
-
-PRODUCT_VERSION=$1
-gh workflow run desktop-e2e.yml --ref "$PRODUCT_VERSION" \
-    -f oses="fedora41 ubuntu2404 windows11 macos15" \
-    -f tests="test_quantum_resistant_tunnel test_ui_tunnel_settings"
diff --git a/scripts/utils/gh-ready-check b/scripts/utils/gh-ready-check
new file mode 100755
index 0000000000..164b5de903
--- /dev/null
+++ b/scripts/utils/gh-ready-check
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+# This script controls that the gh (GitHub CLI) command is installed and authenticated. This can be
+# called in the beginning of all scripts depending on gh.
+
+set -eu
+
+SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+cd "$SCRIPT_DIR"
+
+# shellcheck source=scripts/utils/log
+source ./log
+
+if ! command -v gh > /dev/null; then
+    log_error "gh (GitHub CLI) is required to run this script"
+    exit 1
+fi
+
+if ! gh auth status > /dev/null; then
+    log_error "Authentication through gh (GitHub CLI) is required to run this script"
+    exit 1
+fi
diff --git a/scripts/utils/print-and-run b/scripts/utils/print-and-run
new file mode 100755
index 0000000000..b323040f3c
--- /dev/null
+++ b/scripts/utils/print-and-run
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+# This is a small utility script that can be sourced to provide a function that prints its arguments
+# and then calls them as a command, e.g. `print_and_run sleep 5`.
+
+function print_and_run {
+    echo "+ $*"
+    "$@"
+}