feat: enforce semver in package versions (#17)

* chore: disable copilot

Signed-off-by: Xe Iaso <[e-mail]>

* feat(internal): additional version and package build validations

This adds additional test logic to ensure that versions passed to
package build functions are semantic versions and that the version
strings can be properly parsed after the package is built.

Signed-off-by: Xe Iaso <[e-mail]>

* chore: go mod tidy

Signed-off-by: Xe Iaso <[e-mail]>

* test(internal): test an intentionally failing build

Signed-off-by: Xe Iaso <[e-mail]>

---------

Signed-off-by: Xe Iaso <[e-mail]>

.vscode/settings.json

···
+{
+  "github.copilot.enable": {
+    "*": false
+  }
+}

go.mod

···
 
 require (
 	al.essio.dev/pkg/shellescape v1.6.0
+	github.com/Masterminds/semver/v3 v3.3.1
 	github.com/Songmu/gitconfig v0.2.0
+	github.com/cavaliergopher/rpm v1.3.0
 	github.com/dop251/goja v0.0.0-20250309171923-bcd7cc6bf64c
 	github.com/goreleaser/nfpm/v2 v2.42.0
 	github.com/pkg/errors v0.9.1
+	pault.ag/go/debian v0.18.0
 )
 
 require (
···
 	github.com/AlekSi/pointer v1.2.0 // indirect
 	github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.3.1 // indirect
 	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/ProtonMail/go-crypto v1.1.6 // indirect
···
 	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
+	github.com/kjk/lzma v0.0.0-20161016003348-3fd93898850d // indirect
 	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
···
 	github.com/spf13/cast v1.7.1 // indirect
 	github.com/ulikunitz/xz v0.5.12 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
+	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
 	gitlab.com/digitalxero/go-conventional-commit v1.0.7 // indirect
 	golang.org/x/crypto v0.37.0 // indirect
 	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
···
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	honnef.co/go/tools v0.6.1 // indirect
+	pault.ag/go/topsort v0.1.1 // indirect
 )
 
 tool (

go.sum

···
 github.com/caarlos0/testfs v0.4.4/go.mod h1:bRN55zgG4XCUVVHZCeU+/Tz1Q6AxEJOEJTliBy+1DMk=
 github.com/cavaliergopher/cpio v1.0.1 h1:KQFSeKmZhv0cr+kawA3a0xTQCU4QxXF1vhU7P7av2KM=
 github.com/cavaliergopher/cpio v1.0.1/go.mod h1:pBdaqQjnvXxdS/6CvNDwIANIFSP0xRKI16PX4xejRQc=
+github.com/cavaliergopher/rpm v1.3.0 h1:UHX46sasX8MesUXXQ+UbkFLUX4eUWTlEcX8jcnRBIgI=
+github.com/cavaliergopher/rpm v1.3.0/go.mod h1:vEumo1vvtrHM1Ov86f6+k8j7zNKOxQfHDCAIcR/36ZI=
 github.com/cli/browser v1.1.0/go.mod h1:HKMQAt9t12kov91Mn7RfZxyJQQgWgyS/3SZswlZ5iTI=
 github.com/cli/go-gh v0.1.0 h1:kMqFmC3ECBrV2UKzlOHjNOTTchExVc5tjNHtCqk/zYk=
 github.com/cli/go-gh v0.1.0/go.mod h1:eTGWl99EMZ+3Iau5C6dHyGAJRRia65MtdBtuhWc+84o=
···
 github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
 github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
+github.com/kjk/lzma v0.0.0-20161016003348-3fd93898850d h1:RnWZeH8N8KXfbwMTex/KKMYMj0FJRCF6tQubUuQ02GM=
+github.com/kjk/lzma v0.0.0-20161016003348-3fd93898850d/go.mod h1:phT/jsRPBAEqjAibu1BurrabCBNTYiVI+zbmyCZJY6Q=
 github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
···
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.6.1 h1:R094WgE8K4JirYjBaOpz/AvTyUu/3wbmAoskKN/pxTI=
 honnef.co/go/tools v0.6.1/go.mod h1:3puzxxljPCe8RGJX7BIy1plGbxEOZni5mR2aXe3/uk4=
+pault.ag/go/debian v0.18.0 h1:nr0iiyOU5QlG1VPnhZLNhnCcHx58kukvBJp+dvaM6CQ=
+pault.ag/go/debian v0.18.0/go.mod h1:JFl0XWRCv9hWBrB5MDDZjA5GSEs1X3zcFK/9kCNIUmE=
+pault.ag/go/topsort v0.1.1 h1:L0QnhUly6LmTv0e3DEzbN2q6/FGgAcQvaEw65S53Bg4=
+pault.ag/go/topsort v0.1.1/go.mod h1:r1kc/L0/FZ3HhjezBIPaNVhkqv8L0UJ9bxRuHRVZ0q4=

internal/git_test.go

···
 			input: "1.0.0",
 			want:  "1.0.0",
 		},
+		{
+			name:  "with version with v and -",
+			input: "v1.0.0-abc123",
+			want:  "1.0.0-abc123",
+		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
 			yeet.ForceGitVersion = &tt.input

internal/mkdeb/mkdeb.go

···
 	"runtime"
 	"time"
 
+	"github.com/Masterminds/semver/v3"
 	"github.com/TecharoHQ/yeet/internal"
 	"github.com/TecharoHQ/yeet/internal/pkgmeta"
 	"github.com/goreleaser/nfpm/v2"
···
 			}
 		}
 	}()
+
+	if _, err := semver.NewVersion(p.Version); err != nil {
+		return "", err
+	}
 
 	os.MkdirAll("./var", 0755)
 	os.WriteFile(filepath.Join("./var", ".gitignore"), []byte("*\n!.gitignore"), 0644)

internal/mkdeb/mkdeb_test.go

···
+package mkdeb
+
+import (
+	"testing"
+
+	"github.com/TecharoHQ/yeet/internal/yeettest"
+	"pault.ag/go/debian/deb"
+)
+
+func TestBuild(t *testing.T) {
+	fname := yeettest.BuildHello(t, Build, "1.0.0", true)
+
+	debFile, close, err := deb.LoadFile(fname)
+	if err != nil {
+		t.Fatalf("failed to load deb file: %v", err)
+	}
+	defer close()
+
+	if debFile.Control.Version.Empty() {
+		t.Error("version is empty")
+	}
+}
+
+func TestBuildError(t *testing.T) {
+	yeettest.BuildHello(t, Build, ".0.0", false)
+}

internal/mkrpm/mkrpm.go

···
 	"runtime"
 	"time"
 
+	"github.com/Masterminds/semver/v3"
 	"github.com/TecharoHQ/yeet/internal"
 	"github.com/TecharoHQ/yeet/internal/pkgmeta"
 	"github.com/goreleaser/nfpm/v2"
···
 			}
 		}
 	}()
+
+	if _, err := semver.NewVersion(p.Version); err != nil {
+		return "", err
+	}
 
 	os.MkdirAll("./var", 0755)
 	os.WriteFile(filepath.Join("./var", ".gitignore"), []byte("*\n!.gitignore"), 0644)

internal/mkrpm/mkrpm_test.go

···
+package mkrpm
+
+import (
+	"os"
+	"testing"
+
+	"github.com/Masterminds/semver/v3"
+	"github.com/TecharoHQ/yeet/internal/yeettest"
+	"github.com/cavaliergopher/rpm"
+)
+
+func TestBuild(t *testing.T) {
+	fname := yeettest.BuildHello(t, Build, "1.0.0", true)
+
+	pkg, err := rpm.Open(fname)
+	if err != nil {
+		t.Fatalf("failed to open rpm file: %v", err)
+	}
+
+	version, err := semver.NewVersion(pkg.Version())
+	if err != nil {
+		t.Fatalf("failed to parse version: %v", err)
+	}
+	if version == nil {
+		t.Error("version is nil")
+	}
+
+	fin, err := os.Open(fname)
+	if err != nil {
+		t.Fatalf("failed to open rpm file: %v", err)
+	}
+	defer fin.Close()
+}
+
+func TestBuildError(t *testing.T) {
+	yeettest.BuildHello(t, Build, ".0.0", false)
+}

internal/mktarball/mktarball.go

···
 	"path/filepath"
 	"runtime"
 
+	"github.com/Masterminds/semver/v3"
 	"github.com/TecharoHQ/yeet/internal"
 	"github.com/TecharoHQ/yeet/internal/pkgmeta"
 )
···
 			}
 		}
 	}()
+	if _, err := semver.NewVersion(p.Version); err != nil {
+		return "", err
+	}
 
 	os.MkdirAll("./var", 0755)
 	os.WriteFile(filepath.Join("./var", ".gitignore"), []byte("*\n!.gitignore"), 0644)

internal/mktarball/mktarball_test.go

···
+package mktarball
+
+import (
+	"testing"
+
+	"github.com/TecharoHQ/yeet/internal/yeettest"
+)
+
+func TestBuild(t *testing.T) {
+	yeettest.BuildHello(t, Build, "1.0.0", true)
+}
+
+func TestBuildError(t *testing.T) {
+	yeettest.BuildHello(t, Build, ".0.0", false)
+}

internal/testdata/hello/main.go

···
+package main
+
+import "fmt"
+
+func main() {
+	fmt.Println("Hello, world!")
+}

internal/yeet/yeet.go

···
 	"strings"
 	"time"
 
+	"github.com/Masterminds/semver/v3"
 	"github.com/pkg/errors"
 )
 
···
 		return "", err
 	}
 
-	return strings.TrimSuffix(s, "\n"), nil
+	ver, err := semver.NewVersion(strings.TrimSuffix(s, "\n"))
+	if err != nil {
+		// probably no git tag
+		return "devel", nil
+	}
+
+	return ver.String(), nil
 }
 
 // DockerTag tags a docker image

internal/yeettest/buildpackage.go

···
+package yeettest
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/TecharoHQ/yeet/internal/pkgmeta"
+	"github.com/TecharoHQ/yeet/internal/yeet"
+)
+
+type Impl func(p pkgmeta.Package) (string, error)
+
+func BuildHello(t *testing.T, build Impl, version string, fatal bool) string {
+	t.Helper()
+
+	p := pkgmeta.Package{
+		Name:        "hello",
+		Version:     version,
+		Description: "Hello world",
+		Homepage:    "https://example.com",
+		License:     "MIT",
+		Platform:    runtime.GOOS,
+		Goarch:      runtime.GOARCH,
+		Build: func(p pkgmeta.BuildInput) {
+			yeet.ShouldWork(t.Context(), nil, yeet.WD, "go", "build", "-o", filepath.Join(p.Bin, "hello"), "../testdata/hello")
+		},
+	}
+
+	foutpath, err := build(p)
+	switch fatal {
+	case true:
+		if err != nil {
+			t.Fatalf("Build() error = %v", err)
+		}
+	case false:
+		if err != nil {
+			t.Logf("Build() error = %v", err)
+		}
+		return ""
+	}
+
+	if foutpath == "" {
+		t.Fatal("Build() returned empty path")
+	}
+
+	t.Cleanup(func() {
+		os.RemoveAll(filepath.Dir(foutpath))
+	})
+
+	return foutpath
+}