Fix release notes being escaped properly

The release notes can contain special characters that will be expanded
by bash if not escaped properly, such as the dollar sign (`$`) or the
backtick (`\``).
This PR replaces setting the `RELEASENOTES` environment variable using
double quotes by a heredoc that does not perform any shell-related
expansion.

.forgejo/workflows/integration.yml

@@ -21,6 +21,12 @@ jobs:
           export FORGEJO_RUNNER_LOGS="${{ steps.forgejo.outputs.runner-logs }}"
           forgejo-test-helper.sh run_workflow testdata/upload-download http://testuser:admin1234@${{ steps.forgejo.outputs.host-port }} testuser upload-download forgejo-release "${{ steps.forgejo.outputs.token }}"
 
+      - name: testdata/upload-download-private
+        run: |
+          export FORGEJO_RUNNER_LOGS="${{ steps.forgejo.outputs.runner-logs }}"
+          curl -X 'POST' 'http://testuser:admin1234@${{ steps.forgejo.outputs.host-port }}/api/v1/user/repos' -H 'accept: application/json' -H 'Content-Type: application/json' -d '{"name": "upload-download-private","private": true}'
+          forgejo-test-helper.sh run_workflow testdata/upload-download http://testuser:admin1234@${{ steps.forgejo.outputs.host-port }} testuser upload-download-private forgejo-release "${{ steps.forgejo.outputs.token }}"
+
       - name: testdata/nested-upload-download
         run: |
           export FORGEJO_RUNNER_LOGS="${{ steps.forgejo.outputs.runner-logs }}"

README.md

@@ -1,30 +1,32 @@
 # forgejo-release
 
-<!-- action-docs-description -->
+<!-- action-docs-description source="action.yml" -->
 ## Description
 
 Upload or download the assets of a release to a Forgejo instance.
-<!-- action-docs-description -->
+<!-- action-docs-description source="action.yml" -->
-<!-- action-docs-inputs -->
+<!-- action-docs-inputs source="action.yml" -->
 ## Inputs
 
-| parameter | description | required | default |
+| name | description | required | default |
 | --- | --- | --- | --- |
-| url | URL of the Forgejo instance | `false` |  |
+| `url` | <p>URL of the Forgejo instance</p> | `false` | `""` |
-| repo | owner/project relative to the URL | `false` |  |
+| `repo` | <p>owner/project relative to the URL</p> | `false` | `""` |
-| tag | Tag of the release | `false` |  |
+| `tag` | <p>Tag of the release</p> | `false` | `""` |
-| sha | SHA of the release | `false` |  |
+| `title` | <p>Title of the release</p> | `false` | `""` |
-| token | Forgejo application token | `true` |  |
+| `sha` | <p>SHA of the release</p> | `false` | `""` |
-| release-dir | Directory in whichs release assets are uploaded or downloaded | `true` |  |
+| `token` | <p>Forgejo application token</p> | `true` | `""` |
-| release-notes | Release notes | `false` |  |
+| `release-dir` | <p>Directory in whichs release assets are uploaded or downloaded</p> | `true` | `""` |
-| direction | Can either be download or upload | `true` |  |
+| `release-notes` | <p>Release notes</p> | `false` | `""` |
-| gpg-private-key | GPG Private Key to sign the release artifacts | `false` |  |
+| `direction` | <p>Can either be download or upload</p> | `true` | `""` |
-| gpg-passphrase | Passphrase of the GPG Private Key | `false` |  |
+| `gpg-private-key` | <p>GPG Private Key to sign the release artifacts</p> | `false` | `""` |
-| download-retry | Number of times to retry if the release is not ready (default 1) | `false` |  |
+| `gpg-passphrase` | <p>Passphrase of the GPG Private Key</p> | `false` | `""` |
-| verbose | Increase the verbosity level | `false` | false |
+| `download-retry` | <p>Number of times to retry if the release is not ready (default 1)</p> | `false` | `""` |
-| override | Override an existing release by the same {tag} | `false` | false |
+| `download-latest` | <p>Download the latest release</p> | `false` | `false` |
-| prerelease | Mark Release as Pre-Release | `false` | false |
+| `verbose` | <p>Increase the verbosity level</p> | `false` | `false` |
-<!-- action-docs-inputs -->
+| `override` | <p>Override an existing release by the same {tag}</p> | `false` | `false` |
+| `prerelease` | <p>Mark Release as Pre-Release</p> | `false` | `false` |
+<!-- action-docs-inputs source="action.yml" -->
 
 ## Example
 
@@ -39,8 +41,8 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/forgejo-release@v1
         with:
-	        direction: upload
+          direction: upload
-	        url: https://code.forgejo.org
+          url: https://code.forgejo.org
           release-dir: dist/release
           release-notes: "MY RELEASE NOTES"
 ```
@@ -58,8 +60,8 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/forgejo-release@v1
         with:
-	        direction: download
+          direction: download
-	        url: https://code.forgejo.org
+          url: https://code.forgejo.org
           repo: forgejo/forgejo
           tag: v1.21.4-0
           release-dir: ./  # by default, files are downloaded into dist/release

action.yml

@@ -10,6 +10,8 @@ inputs:
     description: 'owner/project relative to the URL'
   tag:
     description: 'Tag of the release'
+  title:
+    description: 'Title of the release (defaults to tag)'
   sha:
     description: 'SHA of the release'
   token:
@@ -29,6 +31,9 @@ inputs:
     description: 'Passphrase of the GPG Private Key'
   download-retry:
     description: 'Number of times to retry if the release is not ready (default 1)'
+  download-latest:
+    description: 'Download the latest release'
+    default: 'false'
   verbose:
     description: 'Increase the verbosity level'
     default: 'false'
@@ -66,13 +71,20 @@ runs:
           TAG=${TAG##refs/tags/}
         fi
 
+        export TITLE="${{ inputs.title }}"
+
+        export DOWNLOAD_LATEST="${{ inputs.download-latest }}"
+
         export PRERELEASE="${{ inputs.prerelease }}"
 
         export TOKEN="${{ inputs.token }}"
 
         export RELEASE_DIR="${{ inputs.release-dir }}"
 
-        export RELEASENOTES="${{ inputs.release-notes }}"
+        export RELEASENOTES=$(cat << 'EOF'
+        ${{ inputs.release-notes }}
+        EOF
+        )
 
         export SHA="${{ inputs.sha }}"
         if test -z "$SHA"; then

forgejo-release.sh

@@ -7,7 +7,9 @@ if ${VERBOSE:-false}; then set -x; fi
 
 : ${FORGEJO:=https://codeberg.org}
 : ${REPO:=forgejo-integration/forgejo}
+: ${TITLE:=$TAG}
 : ${RELEASE_DIR:=dist/release}
+: ${DOWNLOAD_LATEST:=false}
 : ${TMP_DIR:=$(mktemp -d)}
 : ${GNUPGHOME:=$TMP_DIR}
 : ${BIN_DIR:=$TMP_DIR}
@@ -20,7 +22,8 @@ export GNUPGHOME
 
 setup_tea() {
     if ! test -f $BIN_DIR/tea ; then
-	curl -sL https://dl.gitea.io/tea/$TEA_VERSION/tea-$TEA_VERSION-linux-amd64 > $BIN_DIR/tea
+	ARCH=$(dpkg --print-architecture)
+	curl -sL https://dl.gitea.io/tea/$TEA_VERSION/tea-$TEA_VERSION-linux-$ARCH > $BIN_DIR/tea
 	chmod +x $BIN_DIR/tea
     fi
 }
@@ -45,11 +48,11 @@ upload_release() {
     test ${releasetype+false} || echo "Uploading as Stable"
     ensure_tag
     anchor=$(echo $TAG | sed -e 's/^v//' -e 's/[^a-zA-Z0-9]/-/g')
-    if ! $BIN_DIR/tea release create $assets --repo $REPO --note "$RELEASENOTES" --tag $TAG --title $TAG --draft ${releasetype} >& $TMP_DIR/tea.log ; then
+    if ! $BIN_DIR/tea release create $assets --repo $REPO --note "$RELEASENOTES" --tag $TAG --title "$TITLE" --draft ${releasetype} >& $TMP_DIR/tea.log ; then
 	if grep --quiet 'Unknown API Error: 500' $TMP_DIR/tea.log && grep --quiet services/release/release.go:194 $TMP_DIR/tea.log ; then
 	    echo "workaround v1.20 race condition https://codeberg.org/forgejo/forgejo/issues/1370"
 	    sleep 10
-	    $BIN_DIR/tea release create $assets --repo $REPO --note "$RELEASENOTES" --tag $TAG --title $TAG --draft ${releasetype}
+	    $BIN_DIR/tea release create $assets --repo $REPO --note "$RELEASENOTES" --tag $TAG --title "$TITLE" --draft ${releasetype}
 	else
 	    cat $TMP_DIR/tea.log
 	    return 1
@@ -106,7 +109,7 @@ upload() {
 setup_api() {
     if ! which jq curl ; then
 	apt-get -qq update
-	apt-get install -y -qq jq curl wget
+	apt-get install -y -qq jq curl
     fi
 }
 
@@ -142,18 +145,23 @@ wait_release() {
 
 download() {
     setup_api
-    wait_release
     (
 	mkdir -p $RELEASE_DIR
 	cd $RELEASE_DIR
-	api GET repos/$REPO/releases/tags/$TAG > $TMP_DIR/assets.json
+    if [[ ${DOWNLOAD_LATEST} == "true" ]] ; then
+        echo "Downloading the latest release"
+        api GET repos/$REPO/releases/latest > $TMP_DIR/assets.json
+    elif [[ ${DOWNLOAD_LATEST} == "false" ]] ; then
+        wait_release
+        echo "Downloading tagged release ${TAG}"
+	    api GET repos/$REPO/releases/tags/$TAG > $TMP_DIR/assets.json
+    fi
 	jq --raw-output '.assets[] | "\(.name) \(.browser_download_url)"' < $TMP_DIR/assets.json | while read name url ; do
-	    wget --quiet -O $name $url
+	    curl --fail -H "Authorization: token $TOKEN" -o $name -L $url
 	done
     )
 }
 
-
 missing() {
     echo need upload or download argument got nothing
     exit 1

testdata/nested-upload-download/.forgejo/workflows/test.yml

@@ -35,6 +35,31 @@ jobs:
           release-dir: upload-dir
           release-notes: "RELEASE NOTES"
           verbose: true
+      - id: release-upload-override
+        uses: SELF@vTest
+        with:
+          direction: upload
+          url: ${{ steps.forgejo.outputs.url }}
+          repo: testuser/testrepo
+          tag: v1.0
+          sha: ${{ steps.testrepo.outputs.sha }}
+          token: ${{ steps.forgejo.outputs.token }}
+          release-dir: upload-dir
+          release-notes: "RELEASE NOTES"
+          override: true
+          verbose: true
+      - id: release-upload-v2
+        uses: SELF@vTest
+        with:
+          direction: upload
+          url: ${{ steps.forgejo.outputs.url }}
+          repo: testuser/testrepo
+          tag: v2.0
+          sha: ${{ steps.testrepo.outputs.sha }}
+          token: ${{ steps.forgejo.outputs.token }}
+          release-dir: upload-dir-v2
+          release-notes: "RELEASE NOTES V2"
+          verbose: true
       - id: release-download
         uses: SELF@vTest
         with:
@@ -47,5 +72,17 @@ jobs:
           verbose: true
       - run: |
           diff -u upload-dir download-dir
+      - id: release-download-latest
+        uses: SELF@vTest
+        with:
+          direction: download
+          url: ${{ steps.forgejo.outputs.url }}
+          repo: testuser/testrepo
+          token: ${{ steps.forgejo.outputs.token }}
+          release-dir: download-dir-v2
+          download-latest: true
+          verbose: true
+      - run: |
+          diff -u upload-dir-v2 download-dir-v2
       - if: failure()
         run: docker logs forgejo

testdata/nested-upload-download/upload-dir-v2/file1-v2.txt

@@ -0,0 +1 @@
+FILE1-V2

testdata/nested-upload-download/upload-dir-v2/file2-v2.txt

@@ -0,0 +1 @@
+FILE2-V2

testdata/upload-download/.forgejo/workflows/test.yml

@@ -18,7 +18,7 @@ jobs:
           release-notes: "RELEASE NOTES"
           verbose: true
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
-        id: release-upload
+        id: release-upload-override
         uses: SELF@vTest
         with:
           direction: upload
@@ -26,7 +26,17 @@ jobs:
           token: FORGEJO_TOKEN
           release-dir: upload-dir
           release-notes: "RELEASE NOTES"
-          override: "true"
+          override: true
+          verbose: true
+      - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+        id: release-upload-v2
+        uses: SELF@vTest
+        with:
+          direction: upload
+          tag: v2.0
+          token: FORGEJO_TOKEN
+          release-dir: upload-dir-v2
+          release-notes: "RELEASE NOTES V2"
           verbose: true
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         id: release-download
@@ -40,3 +50,17 @@ jobs:
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         run: |
           diff -u upload-dir download-dir
+      - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+        id: release-download-latest
+        uses: SELF@vTest
+        with:
+          direction: download
+          token: FORGEJO_TOKEN
+          release-dir: download-dir-v2
+          download-latest: true
+          verbose: true
+      - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+        run: |
+          diff -u upload-dir-v2 download-dir-v2
+      - if: failure()
+        run: docker logs forgejo

testdata/upload-download/upload-dir-v2/file1-v2.txt

@@ -0,0 +1 @@
+FILE1-V2

testdata/upload-download/upload-dir-v2/file2-v2.txt

@@ -0,0 +1 @@
+FILE2-V2