add a tag.sh script to create signed release tags

Instead of a bare "git tag vX.Y.Z", which makes an unsigned
lightweight tag and lets typos through, RELEASING.md now says to run
./tag.sh. The script accepts both "0.1.0" and "v0.1.0" (people forget
the v), canonicalizes to "vX.Y.Z", and creates an SSH-signed annotated
tag, requiring user.signingkey to be set. It refuses to proceed if the
tag already exists on origin, always asking the remote rather than
trusting possibly-stale local refs; an unpushed local-only tag is
replaced. It does not push the tag (which is what triggers the Release
workflow); it prints the push command to run instead.

Updates tailscale/corp#24454

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Change-Id: I01cb076eeb8b34f1e2f5d42d9188ff7be2b31c4b

Author: bradfitz

RELEASING.md

@@ -9,14 +9,22 @@ Release with a changelog generated from the commit log.
 ## Cutting a release
 
 1. Make sure the Test workflow is green on `main`.
-2. Tag and push:
+2. Run the release script, which creates an SSH-signed annotated tag
+   after checking that the tag doesn't already exist on origin (a tag
+   that exists only locally is replaced). It requires git's
+   `user.signingkey` to be set to your SSH public key.
+
+   ```sh
+   ./tag.sh v0.1.0
+   ```
+
+3. Push the tag as the script instructs:
 
    ```sh
-   git tag v0.1.0
    git push origin v0.1.0
    ```
 
-3. Watch the Release workflow in the Actions tab. When it finishes,
+4. Watch the Release workflow in the Actions tab. When it finishes,
    the release with all artifacts appears on the
    [Releases page](https://github.com/tailscale/tailcat/releases).
 

tag.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# tag.sh creates the SSH-signed tag for a new release but does not
+# push it. See RELEASING.md for the overall release process.
+set -euo pipefail
+
+if [[ $# -ne 1 ]]; then
+    echo "usage: $0 <version>   (e.g. v0.1.0)" >&2
+    exit 1
+fi
+
+# Accept both "0.1.0" and "v0.1.0" and canonicalize to "v0.1.0".
+v="${1#v}"
+if [[ ! "$v" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
+    echo "tag.sh: invalid version \"$1\"; want something like v0.1.0" >&2
+    exit 1
+fi
+tag="v$v"
+
+if ! git config --get user.signingkey >/dev/null; then
+    echo "tag.sh: git user.signingkey is not set; set it to your SSH public key with:" >&2
+    echo "  git config --global user.signingkey ~/.ssh/id_ed25519.pub" >&2
+    exit 1
+fi
+
+# The remote is the source of truth for whether a release exists, so
+# always ask it rather than trusting possibly-stale local refs. A tag
+# that exists only locally was never pushed and is fine to replace.
+echo "Checking whether $tag already exists on origin..."
+if [[ -n "$(git ls-remote --tags origin "refs/tags/$tag")" ]]; then
+    echo "tag.sh: tag $tag already exists on origin" >&2
+    exit 1
+fi
+
+if git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then
+    echo "Replacing existing unpushed local tag $tag."
+fi
+
+git -c gpg.format=ssh tag -s -f -m "tailcat $tag" "$tag"
+
+echo "Created signed tag $tag. To push it and start the release:"
+echo "  git push origin $tag"