Integrate chocolatey package publishing into release process

[petemounce]

Description of the problem / feature request / question:

At present, publishing the chocolatey package for Windows is a manual process

0. hear about an RC or release
1. run (on Windows)

   pushd "scripts/packages/chocolatey"
     ./build.ps1 -version <version> -mode <rc or release> -rc <rc number>
     ./test.ps1 -version <version>
     & choco.exe push # this assumes the secret for the chocolatey API key is present in the user's profile
   popd

2. reply to the release ticket saying that the package has been pushed and the URL it's available from.

I'd like to eliminate this manual process from the release.

Dependencies:

0. choco.exe - binary only available for Windows, but apparently choco.exe can be compiled and run on Linux. So, try that out.
1. chocolatey API key secret - bazel team should sign up to chocolatey and I'll invite that account to become a package maintainer
2. sha256 of the bazel zip file that the chocolatey package downloads and installs - so, access to either that file, or the release binaries directly to calculate that.
3. actually verifying that the package installs on Windows

Having talked to @damienmg and @dslomov the simplest thing to do is to create a Dockerfile for a (ubuntu, probably) container that contains

• the choco binary
• the packaging script
• the API key secret
• the build output

and then runs the steps (probably, rewritten into bash) to publish the package.

So, I'll have a go at this.

I need to know where to put what I create - I'm going to assume within bazelbuild/continuous-integration somewhere?

Also note dependency (4) - this approach does not satisfy that requirement. Doing that would, I suppose, require shifting this left to become an artifact that is built and tested within CI, as opposed to just within the release process.

I don't intend to address that within this work. Sounds like to do so we'd want to create some pkg_chocolatey rule akin to deb and rpm.

[damienmg]

Maybe in scripts/package or scripts/ci on bazel repository rather? See scripts/docs/Dockerfile for example

[petemounce]

Came across https://www.onitato.com/post/running-chocolatey-on-linux/, adding here for later reference.

[petemounce]

@damienmg please create a bazel-team account on chocolatey.org that I can then invite to become a package maintainer of bazel there?

[philwo]

@petemounce I'll take care of this.

[philwo]

@petemounce I've created a Chocolatey account with the username "bazel" now. :)

[philwo]

@petemounce I think we can add this step to our release pipeline easily now. We can run the required things on a trusted Windows worker that has access to the secret key required.

Does the "bazel" user on Chocolatey have push access? If yes, I can try to set this up.

[petemounce]

Yup, that user has push access.

[petemounce]

I see #8258 was merged, too, so that unblocks that.

[sgowroji]

Hi there! We're doing a clean up of old issues and will be closing this one. Please reopen (or ping me to reopen) if you’d like to discuss anything further. We’ll respond as soon as we have the bandwidth/resources to do so.

[petemounce]

@sgowroji this is being tracked in https://github.com/bazelbuild/continuous-integration/issues/1456. Are you closing issues there too?