Fix and harden the LuaRocks publish pipeline

.github/workflows/build.yml

@@ -17,6 +17,9 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           persist-credentials: false
+          fetch-depth: 0
+      - name: Check rockspec version
+        run: ./check_rockspec_version.sh
       - name: Test
         run: |
           docker build --target test -t lua-resty-netacea-test .

.github/workflows/publish-luarocks.yml

@@ -34,8 +34,12 @@ jobs:
           wget -O - https://openresty.org/package/pubkey.gpg | sudo gpg --dearmor -o /usr/share/keyrings/openresty-archive-keyring.gpg
           echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/openresty-archive-keyring.gpg] http://openresty.org/package/ubuntu $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/openresty.list
           sudo apt-get update
-          sudo apt-get install -y openresty zip
+          sudo apt-get install -y openresty zip luarocks
           echo "/usr/local/openresty/luajit/bin:/usr/local/openresty/nginx/sbin:/usr/local/openresty/bin" >> "$GITHUB_PATH"
+          # luarocks itself needs a JSON library for `luarocks upload`; the
+          # project's own lua-cjson dependency only lands in the throwaway
+          # test tree, not luarocks' own Lua environment.
+          sudo luarocks install dkjson
 
       - name: Verify the rockspec installs a working module
         run: ./test_rockspec_install.sh

CONTRIBUTING.md

@@ -69,10 +69,9 @@ When releasing a new version, update all version references together:
 1. Update [`src/lua_resty_netacea.lua`](/home/user/github/lua_resty_netacea/src/lua_resty_netacea.lua) and change `_N._VERSION` to the new library version, for example `1.2.2`.
 2. Rename the rockspec file to match the new release, for example `lua_resty_netacea-1.2.2-0.rockspec`.
 3. Update the `version = "..."` field inside the rockspec to the same value.
-4. Update any build files that reference the rockspec filename:
-   - [`Dockerfile`](/home/user/github/lua_resty_netacea/Dockerfile)
-   - [`Dockerfile.nginx_lua`](/home/user/github/lua_resty_netacea/Dockerfile.nginx_lua)
-5. Update any other hardcoded version references you introduce in future changes.
+4. Update any other hardcoded version references you introduce in future changes.
+
+`Dockerfile` and `Dockerfile.nginx_lua` pick up the rockspec via a `*.rockspec` glob, so they don't need updating for a version bump — as long as exactly one rockspec file exists in the repo root.
 
 The package version and the rockspec version should stay in sync, with the rockspec using the `-0` release suffix.
 

Dockerfile

@@ -9,9 +9,9 @@ RUN apt-get install -y libssl-dev
 
 
 FROM base AS build
-COPY ./lua_resty_netacea-1.6.0-0.rockspec ./
+COPY ./*.rockspec ./
 COPY ./src ./src
-RUN /usr/local/openresty/luajit/bin/luarocks make ./lua_resty_netacea-1.6.0-0.rockspec
+RUN /usr/local/openresty/luajit/bin/luarocks make ./*.rockspec
 
 FROM build AS test
 

Dockerfile.nginx_lua

@@ -69,9 +69,9 @@ RUN cd /usr/src && \
     make install
 
 # Set up Netacea module
-COPY ./lua_resty_netacea-1.6.0-0.rockspec ./
+COPY ./*.rockspec ./
 COPY ./src ./src
-RUN luarocks make ./lua_resty_netacea-1.6.0-0.rockspec
+RUN luarocks make ./*.rockspec
 
 # Link CA certs so they match expected filename
 RUN ln -s /etc/ssl/certs/ca-bundle.crt /etc/ssl/certs/ca-certificates.crt

check_rockspec_version.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Confirms the checked-in rockspec's filename and its internal `version`
+# field agree, and that the version hasn't already been released as a git
+# tag, so a PR can't ship a rockspec that installs under one version while
+# claiming another, or silently reuse a version that's already out.
+#
+# Usage: ./check_rockspec_version.sh [path-to-rockspec]
+
+ROCKSPEC="${1:-$(ls ./lua_resty_netacea-*.rockspec 2>/dev/null | head -n1)}"
+
+if [ -z "$ROCKSPEC" ] || [ ! -f "$ROCKSPEC" ]; then
+  echo "No rockspec found (expected ./lua_resty_netacea-*.rockspec)." >&2
+  exit 1
+fi
+
+BASENAME="$(basename "$ROCKSPEC")"
+if [[ ! "$BASENAME" =~ ^lua_resty_netacea-([0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9]+)?)-([0-9]+)\.rockspec$ ]]; then
+  echo "Rockspec filename '$BASENAME' doesn't match the expected lua_resty_netacea-<version>-<revision>.rockspec pattern." >&2
+  exit 1
+fi
+RELEASE_VERSION="${BASH_REMATCH[1]}"
+REVISION="${BASH_REMATCH[3]}"
+FILE_VERSION="${RELEASE_VERSION}-${REVISION}"
+
+FIELD_VERSION="$(grep -E '^version[[:space:]]*=' "$ROCKSPEC" | head -n1 | sed -E 's/^version[[:space:]]*=[[:space:]]*"([^"]+)".*/\1/')"
+
+if [ -z "$FIELD_VERSION" ]; then
+  echo "Could not find a version = \"...\" field in $ROCKSPEC." >&2
+  exit 1
+fi
+
+if [ "$FILE_VERSION" != "$FIELD_VERSION" ]; then
+  echo "Rockspec filename version ($FILE_VERSION) doesn't match its version field ($FIELD_VERSION)." >&2
+  exit 1
+fi
+
+TAG="v${RELEASE_VERSION}"
+if git rev-parse -q --verify "refs/tags/$TAG" >/dev/null; then
+  echo "Tag $TAG already exists; bump the version in $ROCKSPEC before merging." >&2
+  exit 1
+fi
+
+echo "OK: $BASENAME matches version field ($FIELD_VERSION) and tag $TAG is unused."

lua_resty_netacea-1.6.0-0.rockspec → lua_resty_netacea-1.6.2-0.rockspec

@@ -1,5 +1,5 @@
 package = "lua_resty_netacea"
-version = "1.6.0-0"
+version = "1.6.2-0"
 source = {
   url = "git://github.com/Netacea/lua_resty_netacea",
   branch = "master"