chore: migrate mail themes to shared framework and locked upstream inputs

.github/scripts/package_release.py

@@ -0,0 +1,130 @@
+"""Package verified generated mail overrides; never copy stale build directories."""
+
+import argparse
+import hashlib
+import io
+import json
+from pathlib import Path, PurePosixPath
+import re
+import tarfile
+import zipfile
+
+
+def read_file(path):
+    path = Path(path)
+    if path.is_symlink() or not path.is_file():
+        raise ValueError(f"Expected regular file: {path}")
+    return path.read_bytes()
+
+
+def checked_path(base, name):
+    parts = PurePosixPath(name)
+    if parts.is_absolute() or ".." in parts.parts or "\\" in name or ":" in name:
+        raise ValueError(f"Unsafe package path: {name}")
+    path = base.joinpath(*parts.parts)
+    if not path.resolve().is_relative_to(base.resolve()):
+        raise ValueError(f"Path escapes package root: {name}")
+    return path
+
+
+def digest(data):
+    return hashlib.sha256(data).hexdigest()
+
+
+def collect(root, version):
+    root = Path(root)
+    if not re.fullmatch(r"v[0-9]+\.[0-9]+\.[0-9]+", version):
+        raise ValueError("Expected a stable vX.Y.Z package version")
+    lock = json.loads(read_file(root / "gitea.lock.json"))
+    if version != lock["tag"]:
+        raise ValueError("Package version must match the locked Gitea tag")
+    files = {}
+    names = sorted(p.name for p in (root / "themes").iterdir() if p.is_dir() and not p.is_symlink())
+    if not names:
+        raise ValueError("No source theme manifests")
+    for name in names:
+        if not re.fullmatch(r"[a-z][a-z0-9-]*", name):
+            raise ValueError(f"Invalid theme name: {name}")
+        source = root / "themes" / name
+        theme = json.loads(read_file(source / "theme.json"))
+        if theme["name"] != name or theme["mode"] not in ("shared", "framed"):
+            raise ValueError(f"Invalid theme metadata: {name}")
+        built = root / "build" / "themes" / name
+        meta = json.loads(read_file(built / "build.json"))
+        if (meta["theme"], meta["mode"], meta["gitea_tag"], meta["gitea_commit"]) != (name, theme["mode"], version, lock["commit"]):
+            raise ValueError(f"Stale build identity: {name}")
+        if not {"theme.json", "theme.css"}.issubset(meta.get("sources") or {}) or not meta.get("files"):
+            raise ValueError(f"Missing source/file provenance: {name}")
+        expected_files = {"mail/base/head.tmpl", "mail/base/footer.tmpl"}
+        if theme["mode"] == "framed":
+            expected_files.update(path.removeprefix("templates/") for path in lock["files"] if path.startswith("templates/mail/") and path.endswith(".tmpl"))
+            expected_files.update(path.relative_to(root / "framework").as_posix() for path in (root / "framework" / "mail").rglob("*.tmpl"))
+        if set(meta["files"]) != expected_files:
+            raise ValueError(f"Incomplete generated install package: {name}")
+        for path, expected in meta["sources"].items():
+            base = root if path.startswith(("framework/", "tools/")) else source
+            if digest(read_file(checked_path(base, path))) != expected:
+                raise ValueError(f"Source changed since build: {name}/{path}")
+        for path, expected in meta["files"].items():
+            if not path.startswith("mail/") or not path.endswith(".tmpl"):
+                raise ValueError(f"Unexpected generated file: {path}")
+            data = read_file(checked_path(built, path))
+            if digest(data) != expected:
+                raise ValueError(f"Generated checksum mismatch: {name}/{path}")
+            files[f"themes/{name}/{path}"] = data
+        files[f"themes/{name}/build.json"] = read_file(built / "build.json")
+    manifest_data = read_file(root / "preview" / "rendered.js")
+    prefix = b"window.__MAIL_PREVIEW__ = "
+    manifest = json.loads(manifest_data.split(prefix, 1)[1].strip().removesuffix(b";"))
+    languages = sorted(path.removeprefix("options/locale/locale_").removesuffix(".json") for path in lock["files"] if path.startswith("options/locale/locale_") and path.endswith(".json"))
+    if manifest["upstream"] != version or manifest.get("upstream_commit") != lock["commit"] or sorted(manifest["themes"]) != names or sorted(manifest["languages"]) != languages:
+        raise ValueError("Preview does not match lock/all source themes and languages; run preview all")
+    files["preview/rendered.js"] = manifest_data
+    for lang in languages:
+        data = read_file(root / "preview" / "rendered" / (lang + ".js"))
+        marker = ('window.__MAIL_PREVIEW_DATA__[' + json.dumps(lang) + '] = ').encode()
+        payload = json.loads(data.split(marker, 1)[1].strip().removesuffix(b";"))
+        if sorted(payload) != names or any(set(payload[name]) != set(manifest["registry"]) for name in names):
+            raise ValueError(f"Incomplete preview language bundle: {lang}")
+        files[f"preview/rendered/{lang}.js"] = data
+    for name in ["LICENSE", "README.md", "CONTRIBUTING.md", "COMPATIBILITY.md", "THIRD_PARTY_NOTICES.md", "docs/README.zh-CN.md", "docs/CONTRIBUTING.zh-CN.md", "preview/index.html"]:
+        files[name] = read_file(root / name)
+    for path in sorted((root / "docs" / "images").iterdir()):
+        if path.is_file() and (path.suffix == ".png" or path.name == "README.md"):
+            files["docs/images/" + path.name] = read_file(path)
+    license_data = read_file(root / "build" / "upstream" / "LICENSE")
+    if digest(license_data) != lock["files"]["LICENSE"]:
+        raise ValueError("Upstream license checksum mismatch")
+    files["GITEA-LICENSE"] = license_data
+    files["upstream-lock.json"] = read_file(root / "gitea.lock.json")
+    return files
+
+
+def package(root, version, output):
+    files = collect(root, version)
+    archive = f"gitea-mail-templates-{version}"
+    output = Path(output)
+    targets = [output / (archive + ext) for ext in (".zip", ".tar.gz")]
+    if any(path.exists() for path in targets):
+        raise ValueError("Refusing to overwrite existing release archives; use a new output directory")
+    output.mkdir(parents=True, exist_ok=True)
+    with zipfile.ZipFile(targets[0], "w", zipfile.ZIP_DEFLATED, compresslevel=9) as zipped, tarfile.open(targets[1], "w:gz") as tar:
+        for name, data in sorted(files.items()):
+            path = archive + "/" + name
+            zipped.writestr(path, data)
+            info = tarfile.TarInfo(path)
+            info.size, info.mode = len(data), 0o644
+            tar.addfile(info, io.BytesIO(data))
+    print(f"[PASS] Packaged {len(files)} verified files: {targets[0]}, {targets[1]}")
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--version", required=True)
+    parser.add_argument("--root", type=Path, default=Path(__file__).resolve().parents[2])
+    parser.add_argument("--output", type=Path, default=Path("dist"))
+    args = parser.parse_args()
+    try:
+        package(args.root, args.version, args.output)
+    except (ValueError, KeyError, IndexError, OSError) as error:
+        parser.exit(1, f"[FAIL] {error}\n")