ci: consolidate CI workflows and package with bazel (#29)

Rework the CI pipeline so that it is easier to test packaging
and package only essentials.

In the future it would be also good to test the packaged archive
with a bazel integration test, but I'll leave this for the next
PR.

.bazelrc

@@ -2,7 +2,7 @@ test --test_output=errors
 
 # Fix the excessive rebuilding when using anything that depends on protobuf rules
 # See https://github.com/bazelbuild/buildtools/issues/744
-build --incompatible_strict_action_env
-run --incompatible_strict_action_env
+common --incompatible_strict_action_env
+common --enable_bzlmod
 
 try-import user.bazelrc

.github/workflows/workflow.yml

@@ -1,7 +1,15 @@
+---
 name: CI
 
-on:
-  push: {}
+on:  # yamllint disable rule:truthy
+  push:
+    branches:
+      - master
+    tags:
+      - "*.*.*"
+  pull_request:
+    branches:
+      - master
 
 jobs:
   build:
@@ -24,3 +32,64 @@ jobs:
 
       - name: Test
         run: bazel test //...
+
+  examples:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        example:
+          - bzlmod
+          - check_glob
+          - released_example
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Test
+        run: bazel test //...
+        working-directory: examples/${{ matrix.example }}
+
+  pkg:
+    runs-on: ubuntu-latest
+    needs:
+      - build
+      - test-mac
+      - examples
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Create release archive and notes
+        run: |
+          # Set by GH actions, see
+          # https://docs.github.com/en/actions/learn-github-actions/environment-variables#default-environment-variables
+          bazel run \
+            --stamp --embed_label "${{ github.ref_name }}" \
+            //:release -- release
+
+      - name: Archive release artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: release
+          path: release/*
+          retention-days: 5
+
+  release:
+    if: ${{ github.event_name != 'pull_request' }}
+    runs-on: ubuntu-latest
+    needs: pkg
+    steps:
+      - name: Download release artifacts
+        uses: actions/download-artifact@v3
+        with:
+          name: release
+
+      - name: Release
+        uses: softprops/action-gh-release@v1
+        with:
+          # Use GH feature to populate the changelog automatically
+          generate_release_notes: true
+          body_path: release_notes.md
+          fail_on_unmatched_files: true
+          files: rules_shellcheck-*.tar.gz

.gitignore

@@ -1,2 +1,3 @@
 bazel-*
 user.bazelrc
+/release/

BUILD.bazel

@@ -1,3 +1,23 @@
+filegroup(
+    name = "distribution",
+    srcs = [
+        "BUILD.bazel",
+        "CHANGELOG.md",
+        "LICENSE",
+        "MODULE.bazel",
+        "README.md",
+        "WORKSPACE",
+        "//internal:distribution",
+    ],
+    visibility = ["//internal/pkg:__pkg__"],
+)
+
+alias(
+    name = "release",
+    actual = "//internal/pkg:release",
+    visibility = ["//:__subpackages__"],
+)
+
 config_setting(
     name = "darwin_x86_64",
     constraint_values = [

CHANGELOG.md

@@ -9,7 +9,9 @@ This document is maintaining changes since the last released version (0.1.1)
 
 ## Unreleased
 
-Nothing yet.
+### Changed
+
+* Packaging is now partially done with `bazel`.
 
 ## v0.2.4
 

MODULE.bazel

@@ -13,3 +13,5 @@ use_repo(
     "shellcheck_linux_amd64",
     "shellcheck_linux_arm64",
 )
+
+bazel_dep(name = "rules_pkg", version = "0.9.1", dev_dependency = True)

internal/BUILD.bazel

@@ -1,16 +1,5 @@
-load(":rules.bzl", "shellcheck_test")
-
-shellcheck_test(
-    name = "fail_test",
-    data = [
-        "testdata/bad.sh",
-    ],
-    expect_fail = True,
-)
-
-shellcheck_test(
-    name = "success_test",
-    data = [
-        "testdata/good.sh",
-    ],
+filegroup(
+    name = "distribution",
+    srcs = glob(["*"]),
+    visibility = ["//:__pkg__"],
 )

internal/pkg/BUILD.bazel

@@ -0,0 +1,56 @@
+load("@rules_pkg//pkg:mappings.bzl", "pkg_files", "strip_prefix")
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
+load("//:def.bzl", "shellcheck_test")
+
+pkg_files(
+    name = "files",
+    srcs = [
+        "//:distribution",
+    ],
+    strip_prefix = strip_prefix.from_root(),
+)
+
+pkg_tar(
+    name = "tar",
+    srcs = [
+        ":files",
+    ],
+    out = "rules_shellcheck.tar",
+)
+
+genrule(
+    name = "archive",
+    srcs = [":tar"],
+    outs = ["rules_shellcheck.tar.gz"],
+    cmd = "gzip -c $< > $@",
+)
+
+genrule(
+    name = "release_stamped",
+    srcs = ["release.sh"],
+    outs = ["release_stamped.sh"],
+    cmd = "; ".join([
+        "BUILD_EMBED_LABEL=$$(grep ^BUILD_EMBED_LABEL bazel-out/stable-status.txt | cut -d' ' -f2)",
+        "sed \"s|{BUILD_EMBED_LABEL}|$$BUILD_EMBED_LABEL|g\" $< >$@",
+    ]),
+    stamp = 1,
+)
+
+sh_binary(
+    name = "release",
+    srcs = ["release_stamped"],
+    data = [
+        ":archive",
+        ":release_notes.tmpl.md",
+    ],
+    env = {
+        "ARCHIVE": "$(location :archive)",
+        "RELEASE_NOTES_TEMPLATE": "$(location :release_notes.tmpl.md)",
+    },
+    visibility = ["//:__pkg__"],
+)
+
+shellcheck_test(
+    name = "release.shellcheck",
+    data = [":release"],
+)

internal/pkg/release.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+DST="${BUILD_WORKSPACE_DIRECTORY}/$1"
+GITHUB_REF_NAME="${2:-{BUILD_EMBED_LABEL}}"
+
+# GH PRs will have the `BUILD_EMBED_LABEL` as `<number>/merge` and
+# in order to keep the logic of manipulating the GITHUB_REF_NAME
+# we have it here. This makes it easier to test.
+#
+# https://docs.github.com/en/actions/learn-github-actions/contexts#github-context
+if [[ "$GITHUB_REF_NAME" == *"/merge" ]]; then
+  GITHUB_REF_NAME="PR${GITHUB_REF_NAME%%\/*}"
+fi
+
+mkdir -p "$DST"
+
+RELEASE_ARCHIVE="$DST/rules_shellcheck-$GITHUB_REF_NAME.tar.gz"
+RELEASE_NOTES="$DST/release_notes.md"
+
+cp -v "$ARCHIVE" "$RELEASE_ARCHIVE"
+SHA=$(sha256sum "$RELEASE_ARCHIVE" | awk '{print $1}')
+
+sed \
+  -e "s/%%TAG%%/$GITHUB_REF_NAME/g" \
+  -e "s/%%SHA256%%/$SHA/g" \
+  "${RELEASE_NOTES_TEMPLATE}" \
+  > "$RELEASE_NOTES"

internal/pkg/release_notes.tmpl.md

@@ -0,0 +1,27 @@
+## Using Bzlmod with Bazel 6
+
+**NOTE: bzlmod support is still beta. APIs subject to change.**
+
+Add to your `MODULE.bazel` file:
+
+```starlark
+bazel_dep(name = "rules_shellcheck", version = "%%TAG%%")
+```
+
+## Legacy: using WORKSPACE
+
+Paste this snippet into your `WORKSPACE` file:
+
+```starlark
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+http_archive(
+    name = "rules_shellcheck",
+    sha256 = "%%SHA256%%",
+    url = "https://github.com/aignas/rules_shellcheck/releases/download/%%TAG%%/rules_shellcheck-%%TAG%%.tar.gz",
+)
+
+load("@rules_shellcheck//:deps.bzl", "shellcheck_dependencies")
+
+shellcheck_dependencies()
+```

tests/BUILD.bazel

@@ -0,0 +1,16 @@
+load("//internal:rules.bzl", "shellcheck_test")
+
+shellcheck_test(
+    name = "fail_test",
+    data = [
+        "testdata/bad.sh",
+    ],
+    expect_fail = True,
+)
+
+shellcheck_test(
+    name = "success_test",
+    data = [
+        "testdata/good.sh",
+    ],
+)