Use Git tags for version pinning with clean URLs

Author: sghosh23

.github/scripts/pin-version.sh

@@ -17,12 +17,25 @@ Pin wire-server and all related charts to a specific version.
 OPTIONS:
     -v, --version VERSION    Wire-server version to pin to (required)
     -f, --file FILE          Path to build.json (default: build.json)
-    -b, --branch BRANCH      Git branch to push to (default: current branch)
+    -b, --base-branch BRANCH Base branch to branch from (default: current branch)
     -h, --help               Show this help message
 
+DESCRIPTION:
+    Creates a temporary branch with pinned build.json, tags it, and pushes the tag.
+    The root build.json on the base branch remains unchanged.
+
+    Pins wire-server and related charts to the specified version.
+    Creates a Git tag: pinned-<base-branch>-<version>
+
+    The tag name is output to stdout for use in workflows.
+
 EXAMPLE:
     $0 --version 5.23.0
-    $0 --version 5.23.0 --file path/to/build.json --branch offline
+    # Creates tag: pinned-offline-5.23.0
+    # URL: https://raw.githubusercontent.com/.../pinned-offline-5.23.0/build.json
+
+    $0 --version 5.23.0 --base-branch offline
+    # Creates tag: pinned-offline-5.23.0
 
 EOF
     exit 1
@@ -32,7 +45,7 @@ EOF
 parse_args() {
     PINNED_VERSION=""
     BUILD_FILE="build.json"
-    GIT_BRANCH=""
+    BASE_BRANCH=""
 
     while [[ $# -gt 0 ]]; do
         case $1 in
@@ -44,8 +57,8 @@ parse_args() {
                 BUILD_FILE="$2"
                 shift 2
                 ;;
-            -b|--branch)
-                GIT_BRANCH="$2"
+            -b|--base-branch)
+                BASE_BRANCH="$2"
                 shift 2
                 ;;
             -h|--help)
@@ -69,8 +82,8 @@ parse_args() {
     fi
 
     # Get current branch if not specified
-    if [ -z "$GIT_BRANCH" ]; then
-        GIT_BRANCH=$(git rev-parse --abbrev-ref HEAD)
+    if [ -z "$BASE_BRANCH" ]; then
+        BASE_BRANCH=$(git rev-parse --abbrev-ref HEAD)
     fi
 }
 
@@ -131,33 +144,72 @@ update_chart() {
     fi
 }
 
-# Commit and push changes
+# Create temporary branch, commit pinned build.json, tag it, and push tag
 commit_and_push() {
     local current_version="$1"
     local pinned_version="$2"
     local charts="$3"
-    local branch="$4"
+    local base_branch="$4"
+    local source_build_file="$5"
+
+    local temp_branch="temp-pin-${pinned_version}"
+    local tag_name="pinned-${base_branch}-${pinned_version}"
 
-    log_info "Committing changes..."
+    log_info "Creating temporary branch: $temp_branch"
 
+    # Ensure we're on base branch
+    git checkout "$base_branch"
+
+    # Create temp branch
+    git checkout -b "$temp_branch"
+
+    # Replace root build.json with pinned version
+    cp "$source_build_file" build.json
+
+    log_info "Committing pinned build.json..."
     git_config_bot
-    git add "$BUILD_FILE"
+    git add build.json
 
     # Build commit message
     cat > /tmp/pin-commit-msg.txt <<EOF
 Pin wire-server and related charts to $pinned_version
 
 Charts updated from $current_version to $pinned_version:
 $charts
+
+Base branch: $base_branch
+Tag: $tag_name
 EOF
 
     git commit -F /tmp/pin-commit-msg.txt
     rm -f /tmp/pin-commit-msg.txt
 
-    log_info "Pushing to branch: $branch"
-    git push origin "HEAD:refs/heads/$branch"
+    local commit_sha
+    commit_sha=$(git rev-parse HEAD)
+
+    log_info "Creating and pushing tag: $tag_name"
+
+    # Delete tag if it exists (for re-pinning same version)
+    if git ls-remote --tags origin | grep -q "refs/tags/$tag_name"; then
+        log_warning "Tag $tag_name already exists, deleting..."
+        git push origin --delete "$tag_name" || true
+    fi
+
+    # Create and push tag
+    git tag "$tag_name" "$commit_sha"
+    git push origin "$tag_name"
+
+    # Switch back to base branch and delete temp branch
+    log_info "Cleaning up temporary branch"
+    git checkout "$base_branch"
+    git branch -D "$temp_branch"
 
     log_success "Version pinning complete!"
+    log_success "Tag: $tag_name"
+    log_success "Commit SHA: $commit_sha"
+
+    # Output tag name (not commit SHA|path anymore)
+    echo "$tag_name"
 }
 
 # Main function
@@ -168,6 +220,12 @@ main() {
     log_info "Pinning wire-server and related charts to version $PINNED_VERSION"
     echo ""
 
+    # Create a temporary working file
+    local temp_build_file="/tmp/build-pinned-$PINNED_VERSION.json"
+    cp "$BUILD_FILE" "$temp_build_file"
+    local original_build_file="$BUILD_FILE"
+    BUILD_FILE="$temp_build_file"
+
     # Get current wire-server version
     local current_version
     current_version=$(get_current_version)
@@ -205,8 +263,11 @@ main() {
     done
     echo ""
 
-    # Commit and push
-    commit_and_push "$current_version" "$PINNED_VERSION" "$charts" "$GIT_BRANCH"
+    # Commit and push (returns commit SHA and file path)
+    commit_and_push "$current_version" "$PINNED_VERSION" "$charts" "$BASE_BRANCH" "$temp_build_file"
+
+    # Cleanup
+    rm -f "$temp_build_file"
 }
 
 # Run main function

.github/scripts/update-deploy-pr.sh

@@ -19,7 +19,7 @@ Usage: $0 [OPTIONS]
 Update wire-server-deploy repository with new wire-builds reference.
 
 OPTIONS:
-    -s, --sha SHA            Wire-builds commit SHA (required)
+    -r, --ref REF            Git reference (commit SHA or tag name) (required)
     -d, --deploy-dir DIR     Path to wire-server-deploy directory (required)
     -t, --token TOKEN        GitHub token for creating PRs (required)
     -h, --help               Show this help message
@@ -30,22 +30,23 @@ ENVIRONMENT:
     GITHUB_RUN_ID            Workflow run ID (for PR body link)
 
 EXAMPLE:
-    $0 --sha abc123 --deploy-dir ./wire-server-deploy --token \$ZEBOT_TOKEN
+    $0 --ref abc123 --deploy-dir ./wire-server-deploy --token \$ZEBOT_TOKEN
+    $0 --ref pinned-offline-5.23.0 --deploy-dir ./wire-server-deploy --token \$ZEBOT_TOKEN
 
 EOF
     exit 1
 }
 
 # Parse command line arguments
 parse_args() {
-    COMMIT_SHA=""
+    BUILD_REF=""
     DEPLOY_DIR=""
     GITHUB_TOKEN=""
 
     while [[ $# -gt 0 ]]; do
         case $1 in
-            -s|--sha)
-                COMMIT_SHA="$2"
+            -r|--ref)
+                BUILD_REF="$2"
                 shift 2
                 ;;
             -d|--deploy-dir)
@@ -67,8 +68,8 @@ parse_args() {
     done
 
     # Validate required arguments
-    if [ -z "$COMMIT_SHA" ]; then
-        log_error "Commit SHA is required"
+    if [ -z "$BUILD_REF" ]; then
+        log_error "Git reference is required"
         usage
     fi
 
@@ -302,9 +303,9 @@ main() {
 
     cd "$DEPLOY_DIR" || die "Failed to change to deploy directory"
 
-    local new_url="https://raw.githubusercontent.com/wireapp/wire-builds/$COMMIT_SHA/build.json"
+    local new_url="https://raw.githubusercontent.com/wireapp/wire-builds/$BUILD_REF/build.json"
 
-    log_info "Updating wire-server-deploy with commit: $COMMIT_SHA"
+    log_info "Updating wire-server-deploy with ref: $BUILD_REF"
     echo ""
 
     # Check if update is needed

.github/workflows/create-deploy-pr.yml

@@ -53,19 +53,28 @@ jobs:
           fetch-depth: 0
 
       - name: Pin wire-server version if specified
+        id: pin-version
         if: ${{ inputs.wire_server_version != 'none' && inputs.wire_server_version != '' }}
         run: |
-          .github/scripts/pin-version.sh \
+          TAG_NAME=$(.github/scripts/pin-version.sh \
             --version "${{ inputs.wire_server_version }}" \
             --file build.json \
-            --branch "${{ github.ref_name }}"
+            --base-branch "${{ github.ref_name }}" | tail -1)
+          echo "tag_name=$TAG_NAME" >> $GITHUB_OUTPUT
+          echo "Pinned tag: $TAG_NAME"
 
-      - name: Get current commit SHA
-        id: get-sha
+      - name: Get reference for build.json
+        id: get-ref
         run: |
-          COMMIT_SHA=$(git rev-parse HEAD)
-          echo "commit_sha=$COMMIT_SHA" >> $GITHUB_OUTPUT
-          echo "Current commit SHA: $COMMIT_SHA"
+          # Use pinned tag if pinning was performed, otherwise use current HEAD
+          if [ -n "${{ steps.pin-version.outputs.tag_name }}" ]; then
+            BUILD_REF="${{ steps.pin-version.outputs.tag_name }}"
+            echo "Using pinned tag: $BUILD_REF"
+          else
+            BUILD_REF=$(git rev-parse HEAD)
+            echo "Using commit SHA: $BUILD_REF"
+          fi
+          echo "build_ref=$BUILD_REF" >> $GITHUB_OUTPUT
 
       - name: Checkout wire-server-deploy
         uses: actions/checkout@v4
@@ -82,11 +91,11 @@ jobs:
           GITHUB_RUN_ID: ${{ github.run_id }}
         run: |
           .github/scripts/update-deploy-pr.sh \
-            --sha "${{ steps.get-sha.outputs.commit_sha }}" \
+            --ref "${{ steps.get-ref.outputs.build_ref }}" \
             --deploy-dir wire-server-deploy \
             --token "${{ secrets.ZEBOT_TOKEN || secrets.GITHUB_TOKEN }}"
 
       - name: Summary
         run: |
           echo "✅ Workflow completed successfully"
-          echo "   Commit SHA: ${{ steps.get-sha.outputs.commit_sha }}"
+          echo "   Build reference: ${{ steps.get-ref.outputs.build_ref }}"

README.md

@@ -39,11 +39,27 @@ gh run watch
 ```
 
 **How it works:**
-1. Workflow fetches the correct commit SHA from wire-server releases
-2. Updates all charts that match the current wire-server version to the pinned version
-3. Updates both version numbers and commit metadata
-4. Creates a new commit and pushes to the branch
-5. Triggers PR creation to wire-server-deploy
+1. Workflow creates a temporary branch from the base branch (e.g., `offline`)
+2. Fetches the correct commit SHA from wire-server releases
+3. Updates all charts that match the current wire-server version to the pinned version
+4. Modifies root `build.json` with pinned versions
+5. Commits the changes and creates a Git tag: `pinned-<branch>-<version>`
+6. Pushes the tag to remote and deletes the temporary branch
+7. Creates a PR to wire-server-deploy using the tag name
+
+**Important:** The root `build.json` on the base branch (e.g., `offline`) remains unchanged at the latest version. Pinned versions are accessible via Git tags (e.g., `pinned-offline-5.23.0`) and referenced by clean URLs.
+
+**Example after pinning to 5.23.0:**
+```
+offline branch: build.json at 5.24.0 (unchanged)
+Git tag: pinned-offline-5.23.0 → points to commit with build.json at 5.23.0
+URL: https://raw.githubusercontent.com/wireapp/wire-builds/pinned-offline-5.23.0/build.json
+
+List all pinned versions:
+$ git tag -l 'pinned-offline-*'
+pinned-offline-5.23.0
+pinned-offline-5.22.0
+```
 
 **Available versions:** 5.24.0 down to 5.5.0