chore: move gmpctl to ops/

Author: bwplotka

hack/gmpctl.sh

@@ -26,9 +26,4 @@ SCRIPT_DIR="$(
 	pwd -P
 )"
 
-pushd "${SCRIPT_DIR}/gmpctl" >/dev/null
-# NOTE gmpctl expects the whole gmpctl directory to be present.
-# We could consider embedding bash scripts, config into binary, but it's good
-# for now.
-go run ./ "$@"
-popd >/dev/null
+bash "${SCRIPT_DIR}/../ops/gmpctl.sh" "$@"

hack/presubmit.sh

@@ -38,7 +38,7 @@ warn() {
 	echo "[$(date +'%Y-%m-%dT%H:%M:%S%z')]: Warning: $*" >&2
 }
 
-REPO_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
+REPO_ROOT=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." &>/dev/null && pwd)
 CRD_DIR=${REPO_ROOT}/charts/operator/crds
 SED=$(which gsed 2>/dev/null || which sed)
 
@@ -124,18 +124,28 @@ run_tests() {
 }
 
 reformat() {
-	echo ">>> reformatting"
-	go mod tidy
+	find . -name "go.mod" | grep -v gmpctl/data | grep -v ".bingo" | while read -r file; do
+		dir=$(dirname "$file")
+		pushd "${dir}"
+		echo ">>> go mod tidy $dir"
+		go mod tidy
+		popd
+	done
+
+	echo ">>> formatting Go files"
 	pushd "${REPO_ROOT}"
 	go fmt ./...
 	popd
 
-	pushd "${REPO_ROOT}/hack/"
+	echo ">>> formatting docs"
+	pushd "${REPO_ROOT}/ops/gmpctl"
 	go mod download # get all deps to avoid garbage output on <command> --help when auto-generating docs.
 	popd
-	${MDOX} fmt --soft-wraps "${REPO_ROOT}"/*.md "${REPO_ROOT}"/cmd/**/*.md "${REPO_ROOT}"/hack/gmpctl/*.md
+	${MDOX} fmt --soft-wraps "${REPO_ROOT}"/*.md "${REPO_ROOT}"/cmd/**/*.md "${REPO_ROOT}"/ops/gmpctl/*.md
+
+	echo ">>> formatting bash scripts"
 	# TODO: Fix and apply this to all .sh scripts we host.
-	${SHFMT} -l -w "${REPO_ROOT}/hack/gmpctl/lib.sh" "${REPO_ROOT}/hack/presubmit.sh"
+	${SHFMT} -l -w "${REPO_ROOT}/ops/gmpctl/lib.sh" "${REPO_ROOT}/hack/presubmit.sh"
 }
 
 exit_msg() {

ops/README.md

@@ -0,0 +1,7 @@
+### ops
+
+This directory contains scripts and automation for common GMP dev operations.
+
+Resources in `/ops` are meant to be used in the latest form (the `main` branch). Notably,
+when using those scripts in CI, use the latest version in main branch.
+

ops/gmpctl.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o pipefail
+set -o nounset
+
+if [[ -n "${DEBUG_MODE:-}" ]]; then
+	set -o xtrace
+fi
+
+SCRIPT_DIR="$(
+	cd -- "$(dirname "$0")" >/dev/null 2>&1
+	pwd -P
+)"
+
+# NOTE gmpctl expects the gmpctl directory to be present on execution for
+# local bash scripts and configuration.
+#
+# We could consider embedding bash scripts, config into binary for portability,
+# but it's good enough for now.
+
+pushd "${SCRIPT_DIR}/gmpctl" >/dev/null
+go run ./ "$@"
+popd >/dev/null

hack/gmpctl/.gitignore ops/gmpctl/.gitignorehack/gmpctl/.gitignore renamed to ops/gmpctl/.gitignore

@@ -14,7 +14,13 @@ It's a starting point for smaller or bigger automation on OSS side (e.g. releasi
 
 2. The next this is to obtain NVD API key to avoid rate-limits when querying CVE DB. See https://nvd.nist.gov/developers/request-an-api-key and save this key to `hack/vulnupdatelist/api.text`
 
-3. You can configure different work directory for gmpctl via `-c` flag. By default, `gmpctl` does the work in `hack/gmpctl/.data`)
+3. Ensure you have installed:
+   * new-ish `bash` (MacOS: `brew install bash`)
+   * `gsed` (MacOS: `brew install gsed`)
+   * `gcloud` (https://docs.cloud.google.com/sdk/docs/install-sdk) (and `gcloud auth login`)
+   * `gpg` (MacOS: `brew install gpg`)
+
+4. You can configure different work directory for gmpctl via `-c` flag. By default, `gmpctl` does the work in `hack/gmpctl/.data`)
 
 Enjoy!
 
@@ -45,6 +51,8 @@ on breaking go mod updates for vulnerabilities or fork sync conflicts.
 Usage: gmpctl [COMMAND] [FLAGS]
   -c string
     	Path to the configuration file. See config.go#Config for the structure. (default ".gmpctl.default.yaml")
+  -git.prefer-https
+    	If true, uses HTTPS protocol instead of git for remote URLs. 
   -v	Enabled verbose, debug output (e.g. logging os.Exec commands)
 
 --- Commands ---
@@ -98,10 +106,11 @@ Some rules to follow:
   * Ensure all error messages are redirected to stderr, use log_err func for this.
   * Be careful with pushd/popd which log to stdout, you can redirect those to stderr too.
 
-## TODO
+## TODO / Known issues.
 
-* Ability to configure NVD API key in gmpctl config.
-* Port fork-sync script from the old PR.
-* Generate some on-demand query of vulnerabilities for all releases (aka dashboard.)
-* Fix NPM vulns (although it's rate).
-* Ability to schedule multiple scripts at once and managing that? (lot's of work vs multiple terminals)
+* [ ] Port bash to Go for stable commands.
+* [ ] Ability to configure NVD API key in gmpctl config.
+* [ ] Port fork-sync script from the old PR.
+* [ ] Generate some on-demand query of vulnerabilities for all releases (aka dashboard.)
+* [ ] Fix NPM vulns (although it's rate).
+* [ ] Ability to schedule multiple scripts at once and managing that? (lot's of work vs multiple terminals)

hack/gmpctl/.gmpctl.default.yaml ops/gmpctl/.gmpctl.default.yamlhack/gmpctl/.gmpctl.default.yaml renamed to ops/gmpctl/.gmpctl.default.yaml

@@ -49,7 +49,7 @@ func release() error {
 		return fmt.Errorf("couldn't find project from branch %s", branch)
 	}
 
-	logf("Assuming %q with remote %q; branch to release: %q", proj.Name, proj.RemoteURL, branch)
+	logf("Assuming %q with remote %q; branch to release: %q", proj.Name, proj.RemoteURL(), branch)
 	dir := proj.WorkDir(cfg.Directory, branch, "release")
 
 	mustFetchAll(dir)
@@ -66,35 +66,39 @@ func release() error {
 	}
 	logf("Selected %v tag", tag)
 
-	if err := runLibFunction(dir, []string{
+	if err := runLocalBash(dir, []string{
 		fmt.Sprintf("DIR=%v", dir),
 		fmt.Sprintf("BRANCH=%v", branch),
 		fmt.Sprintf("PROJECT=%v", proj.Name),
 		fmt.Sprintf("TAG=%v", tag),
-	}, "release-lib::pre-release-rc"); err != nil {
+	}, "prep-rc.sh"); err != nil {
 		return err
 	}
 
 	msg := fmt.Sprintf("chore: prepare for %v release", tag)
 	// TODO(bwplotka): Port to Go, make it more reliable.
 	// TODO(bwplotka): Quote otherwise it's split into separate args... port it so it works better (:
+	// TODO(bwplotka): Add message about a script command.
 	if err := runLibFunction(dir, nil, "release-lib::idemp::git_commit_amend_match", "\""+msg+"\""); err != nil {
 		return err
 	}
 
+	if !mustIsRemoteUpToDate(dir, branch) {
+		if confirmf("About to git push state from %q to \"origin/%v\" for %q tag; are you sure?", dir, branch, tag) {
+			// We are in detached state, so use the HEAD reference.
+			mustPush(dir, fmt.Sprintf("HEAD:%v", branch))
+		} else {
+			return errors.New("aborting")
+		}
+	}
+
 	// TODO(bwplotka): Check if tag exists.
 	mustCreateSignedTag(dir, tag)
-
-	// TODO check if anything is needed to push?
-	// TODO(bwplotka): Add option to print more debug/open terminal with the workdir?
-	if confirmf("About to git push state from %q to \"origin/%v\"; then push %q tag; are you sure?", dir, branch, tag) {
-		// We are in detached state
-		mustPush(dir, fmt.Sprintf("HEAD:%v", branch))
+	if confirmf("About to git push %q tag from %q to \"origin/%v\"; are you sure?", tag, dir, branch) {
 		mustPush(dir, tag)
 	} else {
 		return errors.New("aborting")
 	}
-
 	if confirmf("Do you want to remove the %v worktree (recommended)?", dir) {
 		proj.RemoveWorkDir(cfg.Directory, dir)
 	}

hack/gmpctl/README.md ops/gmpctl/README.mdhack/gmpctl/README.md renamed to ops/gmpctl/README.md

@@ -68,7 +68,7 @@ func vulnfix() error {
 		prBranch = fmt.Sprintf("%v/%v-gmpctl-vulnfix", os.Getenv("USER"), branch)
 	}
 
-	logf("Assuming %q with remote %q; on %q; changes will be pushed to %q", proj.Name, proj.RemoteURL, branch, prBranch)
+	logf("Assuming %q with remote %q; on %q; changes will be pushed to %q", proj.Name, proj.RemoteURL(), branch, prBranch)
 	dir := proj.WorkDir(cfg.Directory, branch, "vulnfix")
 
 	// Refresh.
@@ -84,7 +84,7 @@ func vulnfix() error {
 	}
 
 	// TODO(bwplotka): Add NPM vulnfix.
-	if err := runLibFunction(dir, opts, "release-lib::vulnfix"); err != nil {
+	if err := runLocalBash(dir, opts, "vulnfix.sh"); err != nil {
 		return err
 	}
 
@@ -100,10 +100,14 @@ func vulnfix() error {
 	if err := runLibFunction(dir, nil, "release-lib::idemp::git_commit_amend_match", "\""+msg+"\""); err != nil {
 		return err
 	}
-	// TODO(bwplotka): Check if needs pushing?
+
+	if mustIsRemoteUpToDate(dir, branch) {
+		return fmt.Errorf("nothing to push from %q to \"origin/%v\"; aborting", dir, prBranch)
+	}
+
 	// TODO(bwplotka): Add option to print more debug/open terminal with the workdir?
 	if confirmf("About to FORCE git push state from %q to \"origin/%v\"; are you sure?", dir, prBranch) {
-		// We are in detached state, so be explicit what to push and from where.
+		// We are in detached state, so be explicit what to push and from where, by recreating the local prBranch.
 		mustRecreateBranch(dir, prBranch)
 		mustForcePush(dir, prBranch)
 	} else {