Skip to content

Commit 82089ca

Browse files
authored
Merge pull request #14 from atgreen/release-tooling
Add release artifact tooling (deb/rpm, tarballs, repos); bump to 2.0.0
2 parents 5be828a + e3e2d0e commit 82089ca

9 files changed

Lines changed: 940 additions & 30 deletions

File tree

.github/workflows/release.yaml

Lines changed: 750 additions & 0 deletions
Large diffs are not rendered by default.

ocicl.csv

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -128,8 +128,8 @@ mgl-pax.asdf, ghcr.io/ocicl/mgl-pax-bootstrap@sha256:42e99a0c4f35124650a63ca3ff8
128128
misc-extensions, ghcr.io/ocicl/misc-extensions@sha256:ff9142e340adce70b2c1a42eb7801798827c219d4c98282f6cfbcb1906ca718b, misc-extensions-20250427-1f70028/misc-extensions.asd
129129
mt19937, ghcr.io/ocicl/mt19937@sha256:49c0a25a535cd22212343c67e17635b8e05675ad9cc20aa75ce75e35e842bbe3, MT19937-20240503-78f0419/mt19937.asd
130130
multilang-documentation-utils, ghcr.io/ocicl/documentation-utils@sha256:b2a1b3f3bcd1a738af85ae2b0168d408c177661eab6d6bbebb254e394d983f54, documentation-utils-20230511-98630dd/multilang-documentation-utils.asd
131-
named-readtables, ghcr.io/ocicl/named-readtables@sha256:c6380ffa68acf18ba97ef7b88e84ea174fc5605c8a9b23d80ef2583b44f68017, named-readtables-20250524-8bd0045/named-readtables.asd
132-
named-readtables-test, ghcr.io/ocicl/named-readtables@sha256:c6380ffa68acf18ba97ef7b88e84ea174fc5605c8a9b23d80ef2583b44f68017, named-readtables-20250524-8bd0045/named-readtables-test.asd
131+
named-readtables, ghcr.io/ocicl/named-readtables@sha256:8fcaff38960701e5e23c29a22c625ab6c43393d53101c5d3f69466af8e840407, named-readtables-20260324-fb2aa15/named-readtables.asd
132+
named-readtables-test, ghcr.io/ocicl/named-readtables@sha256:8fcaff38960701e5e23c29a22c625ab6c43393d53101c5d3f69466af8e840407, named-readtables-20260324-fb2aa15/named-readtables-test.asd
133133
parenscript, ghcr.io/ocicl/parenscript@sha256:b4d667abac5092a849871d58d504412e6e1e401fab3fef8f8ac2542a6dfcaa54, parenscript-20240503-1fd720b/parenscript.asd
134134
parenscript.tests, ghcr.io/ocicl/parenscript@sha256:b4d667abac5092a849871d58d504412e6e1e401fab3fef8f8ac2542a6dfcaa54, parenscript-20240503-1fd720b/parenscript.tests.asd
135135
parse-declarations-1.0, ghcr.io/ocicl/parse-declarations-1.0@sha256:9305fa9624205b16fd1fc51cb1cc4282a18e50eee9ac75b66a14f6f2c5df9518, parse-declarations-20240503-549aebb/parse-declarations-1.0.asd
@@ -200,5 +200,6 @@ usocket, ghcr.io/ocicl/usocket@sha256:015b8cdb91cdc25aefd08054e8ede6a5d054d10bc8
200200
usocket-server, ghcr.io/ocicl/usocket@sha256:015b8cdb91cdc25aefd08054e8ede6a5d054d10bc87916904cf0d0670b3f4a68, usocket-0.8.8/usocket-server.asd
201201
usocket-test, ghcr.io/ocicl/usocket@sha256:015b8cdb91cdc25aefd08054e8ede6a5d054d10bc87916904cf0d0670b3f4a68, usocket-0.8.8/usocket-test.asd
202202
uuid, ghcr.io/ocicl/uuid@sha256:a32feac67562b09ece6a4d6debc6fefa40009231cd061042bc8939d3fab3c89e, uuid-20240503-f0052f3/uuid.asd
203+
version-string, ghcr.io/ocicl/version-string@sha256:eb8f45786af7fd6f792aecada1f905870f1d79abfaee0ceb774a94824ad9b14f, cl-version-string-20251228-668f2fa/version-string.asd
203204
with-user-abort, ghcr.io/ocicl/with-user-abort@sha256:c19560034f9909a7afb4110b5efd939a9f1e829d9ef9887797b98679f290c480, with-user-abort-20240503-a3db02e/with-user-abort.asd
204205
zs3, ghcr.io/ocicl/zs3@sha256:6ae320e2ca7feda5cd04b6ac84293764ea420c3e4354a21c325b46a3b7894b90, zs3-1.3.3/zs3.asd

releng/debian/changelog

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
rlgl (2.0.0-1) unstable; urgency=medium
2+
3+
* First release of rlgl as a standalone client-side tool (dropped the
4+
client-server architecture).
5+
6+
-- Anthony Green <green@moxielogic.com> Thu, 18 Jun 2026 12:00:00 -0500

releng/debian/control

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
Source: rlgl
2+
Section: devel
3+
Priority: optional
4+
Maintainer: Anthony Green <green@moxielogic.com>
5+
Build-Depends: debhelper-compat (= 13),
6+
sbcl,
7+
gcc,
8+
make
9+
Standards-Version: 4.6.2
10+
Homepage: https://github.com/atgreen/red-light-green-light
11+
Vcs-Browser: https://github.com/atgreen/red-light-green-light
12+
Vcs-Git: https://github.com/atgreen/red-light-green-light.git
13+
Rules-Requires-Root: no
14+
15+
Package: rlgl
16+
Architecture: amd64
17+
Depends: ${shlibs:Depends}, ${misc:Depends}, git
18+
Description: Git-centric policy management and enforcement tool
19+
Red Light Green Light (rlgl) evaluates a test or scan report against a
20+
policy stored in a git repository, entirely on the local machine. It
21+
produces a self-contained HTML report and a GREEN (exit 0) or RED (exit 1)
22+
result, making it easy to gate CI/CD pipelines. Policies are plain-text
23+
JSON matchers maintained in git, so changes are auditable.

releng/debian/copyright

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
2+
Upstream-Name: rlgl
3+
Upstream-Contact: Anthony Green <green@moxielogic.com>
4+
Source: https://github.com/atgreen/red-light-green-light
5+
6+
Files: *
7+
Copyright: 2018-2026 Anthony Green <green@moxielogic.com>
8+
License: AGPL-3.0-or-later
9+
10+
License: AGPL-3.0-or-later
11+
This program is free software: you can redistribute it and/or modify it
12+
under the terms of the GNU Affero General Public License as published by
13+
the Free Software Foundation, either version 3 of the License, or (at your
14+
option) any later version.
15+
.
16+
This program is distributed in the hope that it will be useful, but WITHOUT
17+
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
18+
FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License
19+
for more details.
20+
.
21+
You should have received a copy of the GNU Affero General Public License
22+
along with this program. If not, see <https://www.gnu.org/licenses/>.
23+
.
24+
On Debian systems, the complete text of the GNU Affero General Public
25+
License version 3 can be found in "/usr/share/common-licenses/AGPL-3".

releng/debian/rules

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#!/usr/bin/make -f
2+
3+
%:
4+
dh $@
5+
6+
override_dh_auto_build:
7+
# Lisp dependencies are vendored in the source tarball (ocicl/).
8+
make rlgl
9+
10+
override_dh_auto_install:
11+
mkdir -p debian/rlgl/usr/bin
12+
mkdir -p debian/rlgl/usr/share/rlgl/recog.d
13+
mkdir -p debian/rlgl/usr/share/doc/rlgl
14+
install -m 0755 rlgl debian/rlgl/usr/bin/
15+
install -m 0755 recog.d/* debian/rlgl/usr/share/rlgl/recog.d/
16+
install -m 0644 README.md debian/rlgl/usr/share/doc/rlgl/
17+
install -m 0644 COPYING debian/rlgl/usr/share/doc/rlgl/
18+
# SBOM (generated by the release workflow)
19+
if [ -f rlgl-sbom.spdx.json ]; then \
20+
mkdir -p debian/rlgl/usr/share/sbom; \
21+
install -m 0644 rlgl-sbom.spdx.json debian/rlgl/usr/share/sbom/rlgl-$(shell dpkg-parsechangelog -S Version | sed 's/-.*//').spdx.json; \
22+
fi
23+
24+
override_dh_auto_test:
25+
# Tests require a network policy clone and fiveam/prove which are not
26+
# part of the binary build; skip during packaging.
27+
28+
override_dh_strip:
29+
# Do not strip SBCL-based binaries; it corrupts the embedded core.
30+
31+
override_dh_auto_clean:
32+
rm -f rlgl
33+
dh_auto_clean

releng/rlgl.spec

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
Name: rlgl
2+
Version: 2.0.0
3+
Release: 1%{?dist}
4+
Summary: Git-centric policy management and enforcement tool
5+
6+
License: AGPL-3.0-or-later
7+
URL: https://github.com/atgreen/red-light-green-light
8+
Source0: rlgl-%{version}.tar.gz
9+
10+
# Disable debug packages and stripping since this is a Lisp binary with a
11+
# dumped image; stripping corrupts the embedded core.
12+
%global debug_package %{nil}
13+
%global _build_id_links none
14+
%global __strip /bin/true
15+
%global __brp_strip %{nil}
16+
%global __brp_strip_comment_note %{nil}
17+
%global __brp_strip_static_archive %{nil}
18+
19+
BuildRequires: sbcl
20+
BuildRequires: gcc
21+
BuildRequires: make
22+
23+
# rlgl clones/pulls policy git repositories and runs the recog.d shell
24+
# recognizers at runtime.
25+
Requires: git
26+
Requires: /bin/sh
27+
28+
%description
29+
Red Light Green Light (rlgl) is a git-centric policy management and
30+
enforcement tool for CI/CD pipelines. It evaluates a test or scan report
31+
against a policy stored in a git repository entirely on the local machine,
32+
producing a self-contained HTML report and a GREEN (exit 0) or RED (exit 1)
33+
result.
34+
35+
%prep
36+
%autosetup -n rlgl-%{version}
37+
38+
%build
39+
# Lisp dependencies are vendored in the source tarball (ocicl/).
40+
make rlgl
41+
42+
%install
43+
# Binary
44+
install -D -m 0755 rlgl %{buildroot}%{_bindir}/rlgl
45+
46+
# Report recognizers, located at runtime under %{_datadir}/rlgl
47+
mkdir -p %{buildroot}%{_datadir}/rlgl/recog.d
48+
install -m 0755 recog.d/* %{buildroot}%{_datadir}/rlgl/recog.d/
49+
50+
# SBOM (generated by the release workflow)
51+
if [ -f rlgl-sbom.spdx.json ]; then
52+
install -D -m 0644 rlgl-sbom.spdx.json %{buildroot}%{_datadir}/sbom/rlgl-%{version}.spdx.json
53+
fi
54+
55+
%files
56+
%license COPYING
57+
%doc README.md
58+
%{_bindir}/rlgl
59+
%{_datadir}/rlgl/recog.d
60+
%{_datadir}/sbom/rlgl-%{version}.spdx.json
61+
62+
%changelog
63+
* Thu Jun 18 2026 Anthony Green <green@moxielogic.com> - 2.0.0-1
64+
- First release of rlgl as a standalone client-side tool (dropped the
65+
client-server architecture)

rlgl.asd

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
(asdf:defsystem #:rlgl
2020
:description "Red Light Green Light - a client-side policy enforcement tool."
2121
:author "Anthony Green <green@moxielogic.com>"
22-
:version "9"
22+
:version "2.0.0"
2323
:serial t
2424
:components ((:file "package")
2525
(:file "matcher")
@@ -29,7 +29,7 @@
2929
:alexandria :bordeaux-threads :clingon :markup
3030
:cl-json :jsown-utils :cl-fad :str :log4cl :cl-ppcre
3131
:ironclad :flexi-streams :inferior-shell :metabang-bind
32-
:cl-date-time-parser :quri :legit)
32+
:cl-date-time-parser :quri :version-string)
3333
:build-operation "program-op"
3434
:build-pathname "rlgl"
3535
:entry-point "rlgl:main")

rlgl.lisp

Lines changed: 33 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -25,46 +25,53 @@
2525
;; ----------------------------------------------------------------------------
2626
;; Version. Pull from git when available, otherwise fall back.
2727

28-
(defparameter +rlgl-version+
29-
(or (ignore-errors
30-
(string-trim '(#\Newline #\Space)
31-
(with-output-to-string (legit:*git-output*)
32-
(legit:git-describe :tags t))))
33-
"unknown"))
28+
;; +RLGL-VERSION+ is the base version from rlgl.asd at load time, and is
29+
;; updated to include git information (tag/hash, "+dirty" suffix) when the
30+
;; standalone binary is built via program-op.
31+
(version-string:define-version-parameter +rlgl-version+ :rlgl)
3432

3533
;; ----------------------------------------------------------------------------
3634
;; Installation root. This is the directory containing the recog.d
37-
;; report-recognition scripts. Resolved at runtime from (in order):
38-
;; the --root option, the RLGL_ROOT environment variable, the directory
39-
;; of the running executable (if it contains recog.d), or the current
40-
;; working directory.
35+
;; report-recognition scripts. At runtime we pick the first of a list of
36+
;; candidate directories that actually contains recog.d: the --root option,
37+
;; the RLGL_ROOT environment variable, the directory of the running
38+
;; executable (running from a build tree), the data directory of a system
39+
;; install (e.g. /usr/share/rlgl when the binary is /usr/bin/rlgl), and
40+
;; finally the current working directory.
4141

4242
(defvar *rlgl-root* nil)
4343

4444
(defun rlgl-root ()
4545
*rlgl-root*)
4646

4747
(defun directory-has-recog.d? (dir)
48-
(and dir (fad:directory-exists-p (merge-pathnames "recog.d/" dir))))
48+
(and dir (ignore-errors (fad:directory-exists-p (merge-pathnames "recog.d/" dir)))))
49+
50+
(defun rlgl-root-candidates (override)
51+
(let ((argv0-dir (ignore-errors
52+
(uiop:pathname-directory-pathname
53+
(uiop:ensure-absolute-pathname (uiop:argv0) (uiop:getcwd))))))
54+
(remove nil
55+
(list
56+
(and override (uiop:ensure-directory-pathname override))
57+
(let ((env (uiop:getenv "RLGL_ROOT")))
58+
(and env (uiop:ensure-directory-pathname env)))
59+
argv0-dir
60+
;; /usr/bin/rlgl -> /usr/share/rlgl, /usr/local/bin -> /usr/local/share
61+
(and argv0-dir (merge-pathnames #p"../share/rlgl/" argv0-dir))
62+
#p"/usr/share/rlgl/"
63+
#p"/usr/local/share/rlgl/"
64+
(uiop:getcwd)))))
4965

5066
(defun resolve-rlgl-root (&optional override)
5167
"Determine and set *RLGL-ROOT*."
52-
(let ((root
53-
(or (and override (uiop:ensure-directory-pathname override))
54-
(let ((env (uiop:getenv "RLGL_ROOT")))
55-
(and env (uiop:ensure-directory-pathname env)))
56-
(let ((argv0-dir (ignore-errors
57-
(uiop:pathname-directory-pathname
58-
(uiop:ensure-absolute-pathname
59-
(uiop:argv0) (uiop:getcwd))))))
60-
(and (directory-has-recog.d? argv0-dir) argv0-dir))
61-
(uiop:getcwd))))
62-
(setf *rlgl-root* (namestring root))
63-
(unless (directory-has-recog.d? root)
64-
(error "Can't find report recognizers (recog.d) under ~A.~%~
68+
(let* ((candidates (rlgl-root-candidates override))
69+
(root (find-if #'directory-has-recog.d? candidates)))
70+
(unless root
71+
(error "Can't find report recognizers (recog.d). Looked in:~%~{ ~A~%~}~
6572
Set RLGL_ROOT or pass --root to point at the rlgl installation directory."
66-
*rlgl-root*))
67-
*rlgl-root*))
73+
(mapcar #'namestring candidates)))
74+
(setf *rlgl-root* (namestring root))))
6875

6976
;; ----------------------------------------------------------------------------
7077
;; Policy checkout directory. Policies are git repositories that we

0 commit comments

Comments
 (0)