ci: speed up full release validation

scripts/github/resolve-openclaw-ref.sh

@@ -0,0 +1,166 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REMOTE_URL="${OPENCLAW_REF_REMOTE:-https://github.com/openclaw/openclaw.git}"
+REF=""
+EXPECTED_SHA=""
+FALLBACK_OK=0
+GITHUB_OUTPUT_FILE="${GITHUB_OUTPUT:-}"
+
+usage() {
+  cat >&2 <<'EOF'
+Usage: resolve-openclaw-ref.sh --ref <ref> [--expected-sha <sha>] [--fallback-ok] [--github-output <file>]
+
+Fast-resolves OpenClaw branch and tag refs with git ls-remote. Full commit SHAs
+are returned as fallback refs so callers can decide whether to run deeper
+reachability validation.
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --ref)
+      REF="${2:-}"
+      shift 2
+      ;;
+    --expected-sha)
+      EXPECTED_SHA="${2:-}"
+      shift 2
+      ;;
+    --fallback-ok)
+      FALLBACK_OK=1
+      shift
+      ;;
+    --github-output)
+      GITHUB_OUTPUT_FILE="${2:-}"
+      shift 2
+      ;;
+    --help|-h)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage
+      exit 2
+      ;;
+  esac
+done
+
+trim() {
+  local value="$1"
+  value="${value#"${value%%[![:space:]]*}"}"
+  value="${value%"${value##*[![:space:]]}"}"
+  printf '%s' "$value"
+}
+
+write_output() {
+  local key="$1"
+  local value="$2"
+  if [[ -n "$GITHUB_OUTPUT_FILE" ]]; then
+    printf '%s=%s\n' "$key" "$value" >> "$GITHUB_OUTPUT_FILE"
+  else
+    printf '%s=%s\n' "$key" "$value"
+  fi
+}
+
+resolve_unique_remote_ref() {
+  local refspec
+  local -a matches=()
+  for refspec in "$@"; do
+    [[ -n "$refspec" ]] || continue
+    mapfile -t matches < <(
+      git ls-remote "$REMOTE_URL" "$refspec" | awk '{print $1}' | awk '!seen[$0]++'
+    )
+    if [[ "${#matches[@]}" -eq 0 ]]; then
+      continue
+    fi
+    if [[ "${#matches[@]}" -ne 1 ]]; then
+      return 2
+    fi
+    printf '%s\n' "${matches[0]}"
+    return 0
+  done
+  return 1
+}
+
+REF="$(trim "$REF")"
+EXPECTED_SHA="$(trim "$EXPECTED_SHA")"
+if [[ -z "$REF" ]] || [[ "$REF" == -* ]]; then
+  echo "Expected a branch, tag, or full commit SHA; got: ${REF}" >&2
+  exit 1
+fi
+if [[ -n "$EXPECTED_SHA" ]] && [[ ! "$EXPECTED_SHA" =~ ^[0-9a-fA-F]{40}$ ]]; then
+  echo "Expected --expected-sha to be a full commit SHA; got: ${EXPECTED_SHA}" >&2
+  exit 1
+fi
+
+if [[ "$REF" =~ ^[0-9a-fA-F]{40}$ ]]; then
+  if [[ -n "$EXPECTED_SHA" ]] && [[ "${REF,,}" != "${EXPECTED_SHA,,}" ]]; then
+    echo "Ref SHA ${REF} does not match expected SHA ${EXPECTED_SHA}." >&2
+    exit 1
+  fi
+  write_output sha "${REF,,}"
+  write_output ref_kind sha
+  write_output fast false
+  write_output fallback true
+  exit 0
+fi
+
+declare -a matches=()
+if [[ "$REF" == refs/heads/* ]]; then
+  mapfile -t matches < <(resolve_unique_remote_ref "$REF" || true)
+elif [[ "$REF" == refs/tags/* ]]; then
+  mapfile -t matches < <(resolve_unique_remote_ref "${REF}^{}" "$REF" || true)
+elif [[ "$REF" == refs/* ]]; then
+  mapfile -t matches < <(resolve_unique_remote_ref "$REF" || true)
+else
+  mapfile -t branch_matches < <(resolve_unique_remote_ref "refs/heads/${REF}" || true)
+  mapfile -t tag_matches < <(resolve_unique_remote_ref "refs/tags/${REF}^{}" "refs/tags/${REF}" || true)
+  match_count=$(( ${#branch_matches[@]} + ${#tag_matches[@]} ))
+  if [[ "$match_count" -eq 1 ]]; then
+    if [[ "${#branch_matches[@]}" -eq 1 ]]; then
+      matches=("${branch_matches[0]}")
+      ref_kind=branch
+    else
+      matches=("${tag_matches[0]}")
+      ref_kind=tag
+    fi
+  elif [[ "$match_count" -gt 1 ]]; then
+    echo "Ref resolved ambiguously as both branch and tag: ${REF}" >&2
+    exit 1
+  fi
+fi
+
+if [[ "${#matches[@]}" -eq 1 ]]; then
+  resolved="${matches[0],,}"
+  if [[ -n "$EXPECTED_SHA" ]] && [[ "$resolved" != "${EXPECTED_SHA,,}" ]]; then
+    echo "Ref ${REF} resolved to ${resolved}, expected ${EXPECTED_SHA}." >&2
+    exit 1
+  fi
+  if [[ -z "${ref_kind:-}" ]]; then
+    if [[ "$REF" == refs/tags/* ]]; then
+      ref_kind=tag
+    elif [[ "$REF" == refs/heads/* ]]; then
+      ref_kind=branch
+    else
+      ref_kind=ref
+    fi
+  fi
+  write_output sha "$resolved"
+  write_output ref_kind "$ref_kind"
+  write_output fast true
+  write_output fallback false
+  exit 0
+fi
+
+if [[ "$FALLBACK_OK" -eq 1 ]]; then
+  write_output sha "$EXPECTED_SHA"
+  write_output ref_kind unknown
+  write_output fast false
+  write_output fallback true
+  exit 0
+fi
+
+echo "Failed to resolve OpenClaw ref: ${REF}" >&2
+exit 1