[gha] better handling of release branches

.devenv/dist/gwt.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, unzip, patch, rsync, jdk17, ant, git, which, coreutils, gnused, gnugrep, gwtVersion, gitRev, gwtTools, customMacrodefs }:
+{ lib, stdenv, unzip, patch, rsync, jdk17, ant, git, which, coreutils, gnused, gnugrep, gwtVersion, gitRev, gwtTools }:
 
 stdenv.mkDerivation {
   pname = "gwt";

.devenv/flake.nix

@@ -16,7 +16,26 @@
         computeGitRev = pkgs.writeScriptBin "nix-git-rev" (builtins.readFile ./git-rev.sh);
         buildGwtPackage = pkgs.writeScriptBin "nix-build-gwt" (builtins.readFile ./build-gwt.sh);
         pushGwtPackage = pkgs.writeScriptBin "nix-push-gwt" (builtins.readFile ./push-gwt.sh);
-
+        shellHookScript = pkgs.writeTextFile {
+          name = "nix-shell-hook.rc";
+          text = builtins.readFile ./shell-hook.sh;
+        };
+
+        # Github Token
+        defaultGithubToken = "";
+        githubToken = builtins.getEnv "GITHUB_TOKEN";
+        effectiveGithubToken = if githubToken != "" then githubToken else defaultGithubToken;
+
+        # GH Token
+        ghToken = builtins.getEnv "GH_TOKEN";
+        effectiveGhToken = if ghToken != "" then ghToken else effectiveGithubToken;
+
+        # Cachix authentication token
+        defaultCachixAuthToken = "";
+        cachixAuthToken = builtins.getEnv "CACHIX_AUTH_TOKEN";
+        effectiveCachixAuthToken = if cachixAuthToken != "" then cachixAuthToken else defaultCachixAuthToken;
+
+
         # GWT version
         defaultGwtVersion = "0.0.0-dev";
         gwtVersion = builtins.getEnv "GWT_VERSION";
@@ -32,58 +51,58 @@
           gwtVersion = effectiveGwtVersion;
         };
         gwt = pkgs.callPackage ./dist/gwt.nix {
+          inherit gwtTools;
           gwtVersion = effectiveGwtVersion;
           gitRev = effectiveGitRev;
           jdk17 = pkgs.jdk17;
         };
 
         # shells
-        mkDevShell = { cachixAuthToken ? null }:
-          let
-            effectiveCachixAuthToken = if cachixAuthToken != null then cachixAuthToken else builtins.getEnv "CACHIX_AUTH_TOKEN";
-            shellHookContent = builtins.readFile ./shell-hook.sh;
-          in pkgs.mkShell {
-            buildInputs = with pkgs; [
-              cachix
-              jdk17
-              ant
-              maven
-              yq-go
-              git
-              gh
-              unixtools.column
-              gwtTools
-              computeGwtVersion
-              computeGitRev
-              buildGwtPackage
-              pushGwtPackage
-            ];
+        mkDevShell = pkgs.mkShell {
+          buildInputs = with pkgs; [
+            cachix
+            jdk17
+            ant
+            maven
+            yq-go
+            git
+            gh
+            unixtools.column
+            gwtTools
+            computeGwtVersion
+            computeGitRev
+            buildGwtPackage
+            pushGwtPackage
+            shellHookScript
+          ];
 
-            shellHook = ''
-              cachix use gwt-nuxeo
-              export CACHIX_AUTH_TOKEN="${effectiveCachixAuthToken}"
-              export NIX_GWT_VERSION="${effectiveGwtVersion}"
-              export NIX_GWT_TOOLS="${gwtTools}"
-              export NIX_GIT_REV="${effectiveGitRev}"
-              
-              if [ -z "$CACHIX_AUTH_TOKEN" ]; then
-                echo "Warning: CACHIX_AUTH_TOKEN is not set. Cachix may not work correctly for private caches."
-              fi
-              
-              ${shellHookContent}
-            '';
-          };
+          shellHook = ''
+            cat <<! | cut -c 3-
+              Effective GitHub Token: ${effectiveGithubToken}
+              Effective GH Token: ${effectiveGhToken}
+              Effective Cachix Auth Token: ${effectiveCachixAuthToken}
+              Effective GWT Version: ${effectiveGwtVersion}
+              Effective GWT Tools: ${gwtTools}
+              Effective Git Rev: ${effectiveGitRev}
+            !
+            NIX_GITHUB_TOKEN="${effectiveGithubToken}"
+            NIX_GH_TOKEN="${effectiveGhToken}"
+            NIX_CACHIX_AUTH_TOKEN="${effectiveCachixAuthToken}"
+            NIX_GWT_VERSION="${effectiveGwtVersion}"
+            NIX_GWT_TOOLS="${gwtTools}"
+            NIX_GIT_REV="${effectiveGitRev}"
+
+            source ${shellHookScript}
+          '';
+        };
       in
       {
         apps.build-gwt = flake-utils.lib.mkApp { drv = buildGwtPackage; };
-
+        
         devShells = {
-          default = mkDevShell {};
-          withEnv = mkDevShell {
-            cachixAuthToken = builtins.getEnv "CACHIX_AUTH_TOKEN";
-          };
+          default = mkDevShell;
         };
-
+        
         packages = {
           inherit gwt gwtTools;
         };

.devenv/gwt-version.sh

@@ -1,18 +1,38 @@
-#!/usr/bin/env -S bash -e -o pipefail
-
-[[ -n "${RUNNER_DEBUG}" ]] &&
-  set -x
+#!/usr/bin/env -S bash -ex -o pipefail
 
 process_branch_name() {
   local BRANCH_NAME=$1
-  if [[ $BRANCH_NAME =~ ^[0-9]+\.[0-9]+\.[0-9]+-nuxeo$ ]]; then
-    echo "${BRANCH_NAME}-beta"
-  else
-    echo "Unable to determine version from branch name: $BRANCH_NAME" >&2
-    return 1
+  local PR_BASE_REF=$2  # Add this parameter for pull request base branch
+
+  # Check if it's a pull request
+  if [[ -n "$PR_BASE_REF" ]]; then
+    # Use the base branch of the pull request
+    BRANCH_NAME=$PR_BASE_REF
   fi
+
+  case "$BRANCH_NAME" in
+    main-nuxeo)
+      echo "0.0.0-nuxeo"
+      ;;
+    *-nuxeo | *-test)
+      echo "${BRANCH_NAME}"
+      ;;
+    *)
+      echo "Unsupported branch name: $BRANCH_NAME" >&2
+      return 1
+      ;;
+  esac
 }
 
+# Always try to get the current Git branch first
+if BRANCH_NAME=$(git rev-parse --abbrev-ref HEAD 2>/dev/null); then
+  if [[ "$BRANCH_NAME" != "HEAD" ]]; then
+    process_branch_name "$BRANCH_NAME"
+    exit 0
+  fi
+fi
+
+# Fall back to GITHUB_REF if we couldn't get the branch from Git
 if [ -n "$GITHUB_REF" ]; then
   case $GITHUB_REF in
     refs/tags/*)
@@ -27,10 +47,6 @@ if [ -n "$GITHUB_REF" ]; then
       ;;
   esac
 else
-  if TAG=$(git describe --exact-match --tags HEAD 2>/dev/null); then
-    echo "$TAG"
-  else
-    BRANCH_NAME=$(git rev-parse --abbrev-ref HEAD)
-    process_branch_name "$BRANCH_NAME"
-  fi
+  echo "Unable to determine version: no Git branch and no GITHUB_REF" >&2
+  exit 1
 fi

.devenv/shell-hook.sh

@@ -1,15 +1,24 @@
-#!/usr/bin/env -S bash -e -o pipefail
+set -ax
+[[ -n "${NIX_GITHUB_TOKEN:-}" ]] &&
+  GITHUB_TOKEN="${NIX_GITHUB_TOKEN}"
+[[ -n "${NIX_GITHUB_TOKEN:-}" ]] &&
+  GH_TOKEN="${NIX_GITHUB_TOKEN}"
+[[ -n "${NIX_CACHIX_AUTH_TOKEN:-}" ]] &&
+  CACHIX_AUTH_TOKEN="${NIX_CACHIX_AUTH_TOKEN}"
+GWT_VERSION=$( [[ -d .git ]] && nix-gwt-version || echo "${NIX_GWT_VERSION:-}" )
+GWT_TOOLS="${NIX_GWT_TOOLS:-}"
+GIT_REV=$( [[ -d .git ]] && nix-git-rev || echo "${NIX_GIT_REV:-}" )
+set +ax
 
-[[ -n "${RUNNER_DEBUG}" ]] &&
-  set -x
-
-set -a
-GWT_VERSION=$( [[ -d .git ]] && echo "$(nix-gwt-version)" || echo "${NIX_GWT_VERSION}" )
-GWT_TOOLS="${NIX_GWT_TOOLS}"
-GIT_REV=$( [[ -d .git ]] && echo "$(nix-git-rev)" || echo "${NIX_GIT_REV}" )
-set +a
+if [ -z "${CACHIX_AUTH_TOKEN:-}" ]; then
+  echo "Warning: CACHIX_AUTH_TOKEN is not set. Cachix may not work correctly for private caches."
+else
+  cachix use gwt-nuxeo
+fi
 
 cat <<EOF
+GITHUB_TOKEN is ${GITHUB_TOKEN:+set}${GITHUB_TOKEN:-not set}, GH_TOKEN is ${GH_TOKEN:+set}${GH_TOKEN:-not set}
+
 GWT version: $GWT_VERSION. Git revision: $GIT_REV
 Using GWT tools from: $GWT_TOOLS
 To build the GWT distribution package, run 'nix-build-gwt' and to deploy the maven artifacts 'nix-push-gwt'.

.github/actions/maven-deploy/action.yml

@@ -1,46 +1,45 @@
 name: 'Push maven artifacts'
 description: 'Deploy maven artifacts to a remote repository'
 inputs:
-  working_directory:
-    description: 'calling workflow working directory'
-    default: '.'
-  distribution:
-    description: 'GWT distribution artifact descriptor in JSON format including (version, name)'
-    required: true
   server:
     description: 'Maven server configuration in YAML format'
     required: true
-  cachix_auth_token:
+  cachix-auth-token:
     description: 'Cachix auth token'
     required: false
+  github-token:
+    description: 'GitHub token'
+    required: false
 runs:
   using: "composite"
   steps:
-    - uses: ./main/.github/actions/nix-develop
+    - uses: ./.github/actions/nix-develop
       with:
-        cachix_auth_token: ${{ inputs.cachix_auth_token }}
+        cachix-auth-token: ${{ inputs.cachix-auth-token }}
+        github-token: ${{ inputs.github-token }}
+
+    - name: Delete artifacts
+      run: |
+        gh extension install nxmatic/gh-maven # should go in flake later
+        gh maven delete org.gwtproject %
+      shell: nix develop .devenv -c bash -xe -o pipefail {0}
 
-    - name: Check GWT distribution availability
+    - name: Build the distribution and load the environment
       run: |
-        cat <<~ | cut -c 3- | tee -a "${GITHUB_OUTPUT}"
-          isAvailable=$( [[ -r "${GWT_DIST_FILE}" ]] && echo 'true' || echo 'false' )
-        ~
+        : build the distribution
+        nix-build-gwt
+
+        : export the environment variables
+        GWT_DIST_NAME=gwt-${GWT_VERSION}.zip
+        GWT_DIST_FILE=$( realpath . )/.devenv/dist/result/${GWT_DIST_NAME}
+
         cat <<~ | cut -c 3- | tee -a "${GITHUB_ENV}"
+          GWT_VERSION=${GWT_VERSION}
+          GWT_DIST_NAME=${GWT_DIST_NAME}
           GWT_DIST_FILE=${GWT_DIST_FILE}
         ~
-      shell: bash -xe -o pipefail {0}
-      env:
-        GWT_DIST_FILE: |
-          ${{ steps.gwt-distribution-download.outputs.download-path }}/${{ fromJson(inputs.distribution).name }}
-      id: gwt-distribution-availability
-
-    - name: Download GWT distribution
-      uses: actions/download-artifact@v4
-      with:
-        name: ${{ fromJson(inputs.distribution).name }}
-        path: ${{ github.workspace }}/.artifacts
-      if: ${{ steps.gwt-distribution-availability.outputs.isAvailable != 'true' }}
-      id: gwt-distribution-download
+      shell: nix develop .devenv -c bash -xe -o pipefail {0}
+      id: build
 
     - name: Deploy artifacts
       env:
@@ -65,4 +64,4 @@ runs:
 
         : Push the artifacts
         nix-push-gwt
-      shell: nix develop main/.devenv -c bash -xe -o pipefail {0}
+      shell: nix develop .devenv -c bash -xe -o pipefail {0}

.github/actions/nix-develop/action.yml

@@ -1,9 +1,12 @@
 name: 'Setup GWT Dev Environment'
 description: 'Checks out GWT and GWT Tools, sets up Nix and Cachix'
 inputs:
-  cachix_auth_token:
+  cachix-auth-token:
     description: 'Cachix auth token'
     required: true
+  github-token:
+    description: 'Github token'
+    required: true
 runs:
   using: "composite"
   steps:
@@ -21,11 +24,14 @@ runs:
         !
         cat <<! | cut -c 3- | tee -a "$GITHUB_ENV"
           NIX_PATH=$HOME/.nix-profile/bin
+          NIX_CONFIG=access-tokens = github.com=${GITHUB_TOKEN}
           CACHIX_AUTH_TOKEN=${CACHIX_AUTH_TOKEN}
+          GITHUB_TOKEN=${GITHUB_TOKEN}
         !
       shell: bash -xe -o pipefail {0}
       env:
-        CACHIX_AUTH_TOKEN: ${{ inputs.cachix_auth_token }}
+        CACHIX_AUTH_TOKEN: ${{ inputs.cachix-auth-token }}
+        GITHUB_TOKEN: ${{ inputs.github-token }}
 
     - name: Install Nix
       uses: cachix/install-nix-action@v27
@@ -34,9 +40,3 @@ runs:
         nix_path: nixpkgs=channel:nixos-unstable
         extra_nix_config: |
           experimental-features = nix-command flakes
-
-    # - name: Install Cachix
-    #   uses: cachix/cachix-action@v15
-    #   with:
-    #     name: gwt-nuxeo
-    #     authToken: '${{ inputs.cachix_auth_token }}'