Add `qx contrib publish`

[cboulanger]

We want to make it as easy as possible for contrib authors to update their contributions. In particular, we want authors to update the dependency on a qooxdoo version so that contribs stay in sync and can automatically be discovered by qx contrib update. Even though it is a no-brainer to create a release on GitHub, the additional step might lead to updates to contribs not being published.

A new command qx contrib publish is intended to make this really easy. It could work this way:

1. In Manifest.json, update the qooxdoo-range value to include the version of the qooxdoo framework (As per version.txt).
2. In Manifest.json, based on a CLI option, increment the version number (patch, feature, breaking). For example qx contrib publish --feat would increment 1.0.1 to 1.1.0. Default would be --patch.
3. Push to master
4. Create a release with the tag vX.Y.Z according to the current version.

For this to work, the developer needs to provide a GitHub Access token, either via --token or by setting an environment variable GITHUB_ACCESS_TOKEN (Does this work on Windows?)

[hkollmann]

Enviroment variable should work with windows. Easier would be a --save_token parameter wich save's the token in the db and tries to Access it from there.

[cboulanger]

@hkollmann @johnspackman Sure! Which db could this be saved to? The compiler's? John, what is the API for that?

[hkollmann]

I thought of the contrib repos_cache

[cboulanger]

No, I wouldn't want to do that - too risky since people might accidentally commit it to GitHub. That also could happen with the compiler db, of course, but that's a better maintained resource.

[johnspackman]

How about general preferences .json file, to be stored in home directory on *nix, and %APPDATA% on Windows?

[cboulanger]

For that reason, I somehow prefer the environment variable - that's more secure than any file-based solution...

[johnspackman]

plenty of apps store github tokens on disk though, think of using git from the command line

[cboulanger]

Yes, and we have https://github.com/qooxdoo/qooxdoo-cli/issues/20 to mitigate against accidental commit of sensitive and/or ephemeral data. But we should keep sensitive information at one central location and not spread it out over several files.

[johnspackman]

This made me curious about where git keeps its data, found this:

There are 3 default paths for the config file.

Repository itself: /.git/config User home directory: ~/.gitconfig System-wide directory: $(prefix)/etc/gitconfig The --global option always use the home directory. Note that git will always try to read all of them. If it finds one, it loads it, and moves to the next one. Local takes precedence over global, which takes precedence over system-wide. It uses a simple key-merging algorithm.

from https://stackoverflow.com/a/7328869/2979698:

[cboulanger]

Implmented with fb47f853133e394947839c262a805fccd2d4182d.