CLI: Allow binaries to autoupdate

.github/workflows/release-cli-assets.yml

@@ -7,13 +7,28 @@ on:
         description: 'Published packages'
         required: true
         type: string
+      commitSha:
+        description: 'Commit SHA'
+        required: true
+        type: string
   workflow_dispatch:
     inputs:
       publishedPackages:
         description: 'Published packages'
         required: true
         default: '[{"name": "@xata.io/cli", "version": "1.2.0"}]'
         type: string
+      commitSha:
+        description: 'Commit SHA'
+        required: true
+        type: string
+
+permissions:
+  id-token: write
+  contents: write
+  packages: write
+  pages: write
+  pull-requests: write
 
 jobs:
   release-cli-assets:
@@ -81,12 +96,71 @@ jobs:
           sudo apt-get install -y nsis
           sudo apt-get install -y p7zip
 
-      - name: Release CLI Assets
-        run: pnpm run release:cli
+      - name: Configure AWS Credentials for production
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.CLI_ASSETS_UPLOAD_ROLE }}
+          aws-region: us-east-1
+          mask-aws-account-id: 'no'
+
+      - name: Pack
+        run: pnpm run release:cli:pack
+        env:
+          PUBLISHED_PACKAGES: ${{ inputs.publishedPackages }}
+          MATRIX_OS: ${{ matrix.os }}
+
+      - name: Upload CLI Assets to GitHub Releases
+        run: pnpm run release:cli:upload:gh
+        env:
+          MATRIX_OS: ${{ matrix.os }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Debian cert
+        if: matrix.os == 'ubuntu-latest'
+        working-directory: /home/runner/work/client-ts/client-ts/cli/dist/deb
+        run: |
+          echo "$DEBIAN_GPG_KEY_PRIVATE" | gpg --import --batch --passphrase "$DEBIAN_GPG_KEY_PASS"
+          gpg --digest-algo SHA512 --clearsign --pinentry-mode loopback --passphrase "$DEBIAN_GPG_KEY_PASS" -u $DEBIAN_GPG_KEY_ID -o InRelease Release 
+          gpg --digest-algo SHA512 -abs --pinentry-mode loopback --passphrase "$DEBIAN_GPG_KEY_PASS" -u $DEBIAN_GPG_KEY_ID -o Release.gpg Release 
+          echo "Signed debian packages successfully"
+          echo "sha256 sums:"
+          sha256sum *Release*
+
+          mkdir -p /home/runner/work/client-ts/client-ts/cli/dist/apt
+          echo "$DEBIAN_GPG_KEY_PUBLIC" > /home/runner/work/client-ts/client-ts/cli/dist/apt/release.key
+        env:
+          DEBIAN_GPG_KEY_PRIVATE: ${{ secrets.DEBIAN_GPG_KEY_PRIVATE }}
+          DEBIAN_GPG_KEY_PASS: ${{ secrets.DEBIAN_GPG_KEY_PASS }}
+          DEBIAN_GPG_KEY_PUBLIC: ${{ secrets.DEBIAN_GPG_KEY_PUBLIC }}
+          DEBIAN_GPG_KEY_ID: ${{ secrets.DEBIAN_GPG_KEY_ID }}
+
+      - name: Upload and Promote CLI Assets to S3
+        run: pnpm run release:cli:upload:s3
+        env:
+          MATRIX_OS: ${{ matrix.os }}
+          COMMIT_SHA: ${{ inputs.commitSha }}
+
+      - name: Pack (Windows only)
+        if: matrix.os == 'ubuntu-latest'
+        run: pnpm run release:cli:pack
         env:
           PUBLISHED_PACKAGES: ${{ inputs.publishedPackages }}
+          MATRIX_OS: ${{ matrix.os }}
+          OS_OVERRIDE: windows-latest
+      - name: Upload CLI Assets to GitHub Releases (Windows only)
+        run: pnpm run release:cli:upload:gh
+        if: matrix.os == 'ubuntu-latest'
+        env:
           MATRIX_OS: ${{ matrix.os }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          OS_OVERRIDE: windows-latest
+      - name: Upload and Promote CLI Assets to S3 (Windows only)
+        if: matrix.os == 'ubuntu-latest'
+        run: pnpm run release:cli:upload:s3
+        env:
+          MATRIX_OS: ${{ matrix.os }}
+          COMMIT_SHA: ${{ inputs.commitSha }}
+          OS_OVERRIDE: windows-latest
 
       - name: Clean up keychain
         if: matrix.os == 'macos-latest'

.github/workflows/release.yml

@@ -71,8 +71,9 @@ jobs:
   publish-cli-assets:
     name: Publish CLI assets
     needs: [release]
-    if: needs.release.outputs.published == 'true'
+    if: needs.release.outputs.published == 'true' && github.ref_name == 'main'
     uses: ./.github/workflows/release-cli-assets.yml
     with:
       publishedPackages: ${{ needs.release.outputs.publishedPackages }}
+      commitSha: ${{ github.sha }}
     secrets: inherit

cli/package.json

@@ -18,11 +18,15 @@
     "/npm-shrinkwrap.json",
     "/oclif.manifest.json"
   ],
+  "engines": {
+    "node": ">=8"
+  },
   "dependencies": {
     "@oclif/core": "^4.0.8",
     "@oclif/plugin-help": "^6.2.5",
     "@oclif/plugin-not-found": "^3.2.10",
     "@oclif/plugin-plugins": "^5.3.4",
+    "@oclif/plugin-update": "^4.4.9",
     "@types/ini": "^4.1.1",
     "@types/prompts": "^2.4.9",
     "@types/semver": "^7.5.8",
@@ -40,18 +44,18 @@
     "enquirer": "^2.4.1",
     "env-editor": "^1.1.0",
     "ini": "^4.1.3",
-    "lodash.keyby": "^4.6.0",
     "lodash.compact": "^3.0.1",
     "lodash.get": "^4.4.2",
+    "lodash.keyby": "^4.6.0",
     "lodash.set": "^4.3.2",
     "node-fetch": "^3.3.2",
     "open": "^10.1.0",
     "prompts": "^2.4.2",
     "relaxed-json": "^1.0.3",
     "semver": "^7.6.2",
     "text-table": "^0.2.0",
-    "tslib": "^2.6.3",
     "tmp": "^0.2.3",
+    "tslib": "^2.6.3",
     "type-fest": "^4.21.0",
     "which": "^4.0.0",
     "zod": "^3.23.8"
@@ -77,6 +81,12 @@
   },
   "oclif": {
     "bin": "xata",
+    "update": {
+      "s3": {
+        "host": "https://xata-cli-assets.s3.us-east-1.amazonaws.com",
+        "bucket": "xata-cli-assets"
+      }
+    },
     "hooks": {
       "init": "./dist/hooks/init/compatibility"
     },
@@ -95,7 +105,8 @@
     "plugins": [
       "@oclif/plugin-help",
       "@oclif/plugin-plugins",
-      "@oclif/plugin-not-found"
+      "@oclif/plugin-not-found",
+      "@oclif/plugin-update"
     ],
     "topicSeparator": " ",
     "topics": {

package.json

@@ -6,7 +6,9 @@
   "scripts": {
     "test": "vitest",
     "test:canary": "tsx ./scripts/test-canary.ts",
-    "release:cli": "tsx ./scripts/release-cli.ts",
+    "release:cli:pack": "tsx ./scripts/release-cli-pack.ts",
+    "release:cli:upload:gh": "tsx ./scripts/release-cli-upload-gh.ts",
+    "release:cli:upload:s3": "tsx ./scripts/release-cli-upload-s3.ts",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "prepare": "husky install",