From 85ec7ca388e56502e8847db49ceb6fc1d7ecb034 Mon Sep 17 00:00:00 2001 From: Mark Greenwood Date: Thu, 30 Jul 2026 15:55:04 +0100 Subject: [PATCH 1/6] Add in luarocks installation --- .github/workflows/publish-luarocks.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish-luarocks.yml b/.github/workflows/publish-luarocks.yml index 51b17a3..91403ac 100644 --- a/.github/workflows/publish-luarocks.yml +++ b/.github/workflows/publish-luarocks.yml @@ -34,7 +34,7 @@ jobs: wget -O - https://openresty.org/package/pubkey.gpg | sudo gpg --dearmor -o /usr/share/keyrings/openresty-archive-keyring.gpg echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/openresty-archive-keyring.gpg] http://openresty.org/package/ubuntu $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/openresty.list sudo apt-get update - sudo apt-get install -y openresty zip + sudo apt-get install -y openresty zip luarocks echo "/usr/local/openresty/luajit/bin:/usr/local/openresty/nginx/sbin:/usr/local/openresty/bin" >> "$GITHUB_PATH" - name: Verify the rockspec installs a working module From da7874fee28f4cfbad9e1e7243bd68987c3bcc5d Mon Sep 17 00:00:00 2001 From: Mark Greenwood Date: Thu, 30 Jul 2026 16:09:09 +0100 Subject: [PATCH 2/6] Bump rockspec --- ...tacea-1.6.0-0.rockspec => lua_resty_netacea-1.6.2-0.rockspec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename lua_resty_netacea-1.6.0-0.rockspec => lua_resty_netacea-1.6.2-0.rockspec (98%) diff --git a/lua_resty_netacea-1.6.0-0.rockspec b/lua_resty_netacea-1.6.2-0.rockspec similarity index 98% rename from lua_resty_netacea-1.6.0-0.rockspec rename to lua_resty_netacea-1.6.2-0.rockspec index d0b0e22..0c17d5d 100644 --- a/lua_resty_netacea-1.6.0-0.rockspec +++ b/lua_resty_netacea-1.6.2-0.rockspec @@ -1,5 +1,5 @@ package = "lua_resty_netacea" -version = "1.6.0-0" +version = "1.6.2-0" source = { url = "git://github.com/Netacea/lua_resty_netacea", branch = "master" From 5c28e694e77d9959db7957c7ace4685e5d32ee83 Mon Sep 17 00:00:00 2001 From: Mark Greenwood Date: Thu, 30 Jul 2026 16:11:51 +0100 Subject: [PATCH 3/6] Add in json library for luarocks --- .github/workflows/publish-luarocks.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/publish-luarocks.yml b/.github/workflows/publish-luarocks.yml index 91403ac..159b39d 100644 --- a/.github/workflows/publish-luarocks.yml +++ b/.github/workflows/publish-luarocks.yml @@ -36,6 +36,10 @@ jobs: sudo apt-get update sudo apt-get install -y openresty zip luarocks echo "/usr/local/openresty/luajit/bin:/usr/local/openresty/nginx/sbin:/usr/local/openresty/bin" >> "$GITHUB_PATH" + # luarocks itself needs a JSON library for `luarocks upload`; the + # project's own lua-cjson dependency only lands in the throwaway + # test tree, not luarocks' own Lua environment. + sudo luarocks install dkjson - name: Verify the rockspec installs a working module run: ./test_rockspec_install.sh From 898e895558d053ee4a64317dc5fa4543b8dd9b0d Mon Sep 17 00:00:00 2001 From: Mark Greenwood Date: Thu, 30 Jul 2026 16:17:40 +0100 Subject: [PATCH 4/6] PR check for rockspec files --- .github/workflows/build.yml | 3 +++ check_rockspec_version.sh | 45 +++++++++++++++++++++++++++++++++++++ 2 files changed, 48 insertions(+) create mode 100755 check_rockspec_version.sh diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 918a1be..af2e2be 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -17,6 +17,9 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd with: persist-credentials: false + fetch-depth: 0 + - name: Check rockspec version + run: ./check_rockspec_version.sh - name: Test run: | docker build --target test -t lua-resty-netacea-test . diff --git a/check_rockspec_version.sh b/check_rockspec_version.sh new file mode 100755 index 0000000..203494d --- /dev/null +++ b/check_rockspec_version.sh @@ -0,0 +1,45 @@ +#!/usr/bin/env bash +set -euo pipefail + +# Confirms the checked-in rockspec's filename and its internal `version` +# field agree, and that the version hasn't already been released as a git +# tag, so a PR can't ship a rockspec that installs under one version while +# claiming another, or silently reuse a version that's already out. +# +# Usage: ./check_rockspec_version.sh [path-to-rockspec] + +ROCKSPEC="${1:-$(ls ./lua_resty_netacea-*.rockspec 2>/dev/null | head -n1)}" + +if [ -z "$ROCKSPEC" ] || [ ! -f "$ROCKSPEC" ]; then + echo "No rockspec found (expected ./lua_resty_netacea-*.rockspec)." >&2 + exit 1 +fi + +BASENAME="$(basename "$ROCKSPEC")" +if [[ ! "$BASENAME" =~ ^lua_resty_netacea-([0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9]+)?)-([0-9]+)\.rockspec$ ]]; then + echo "Rockspec filename '$BASENAME' doesn't match the expected lua_resty_netacea--.rockspec pattern." >&2 + exit 1 +fi +RELEASE_VERSION="${BASH_REMATCH[1]}" +REVISION="${BASH_REMATCH[3]}" +FILE_VERSION="${RELEASE_VERSION}-${REVISION}" + +FIELD_VERSION="$(grep -E '^version[[:space:]]*=' "$ROCKSPEC" | head -n1 | sed -E 's/^version[[:space:]]*=[[:space:]]*"([^"]+)".*/\1/')" + +if [ -z "$FIELD_VERSION" ]; then + echo "Could not find a version = \"...\" field in $ROCKSPEC." >&2 + exit 1 +fi + +if [ "$FILE_VERSION" != "$FIELD_VERSION" ]; then + echo "Rockspec filename version ($FILE_VERSION) doesn't match its version field ($FIELD_VERSION)." >&2 + exit 1 +fi + +TAG="v${RELEASE_VERSION}" +if git rev-parse -q --verify "refs/tags/$TAG" >/dev/null; then + echo "Tag $TAG already exists; bump the version in $ROCKSPEC before merging." >&2 + exit 1 +fi + +echo "OK: $BASENAME matches version field ($FIELD_VERSION) and tag $TAG is unused." From 9d212b3798e268a69f82ee50a7d5dcca6397729d Mon Sep 17 00:00:00 2001 From: Mark Greenwood Date: Thu, 30 Jul 2026 16:19:44 +0100 Subject: [PATCH 5/6] Fix rockspec copying --- CONTRIBUTING.md | 7 +++---- Dockerfile | 4 ++-- Dockerfile.nginx_lua | 4 ++-- 3 files changed, 7 insertions(+), 8 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index c3b4d6a..f038b6c 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -69,10 +69,9 @@ When releasing a new version, update all version references together: 1. Update [`src/lua_resty_netacea.lua`](/home/user/github/lua_resty_netacea/src/lua_resty_netacea.lua) and change `_N._VERSION` to the new library version, for example `1.2.2`. 2. Rename the rockspec file to match the new release, for example `lua_resty_netacea-1.2.2-0.rockspec`. 3. Update the `version = "..."` field inside the rockspec to the same value. -4. Update any build files that reference the rockspec filename: - - [`Dockerfile`](/home/user/github/lua_resty_netacea/Dockerfile) - - [`Dockerfile.nginx_lua`](/home/user/github/lua_resty_netacea/Dockerfile.nginx_lua) -5. Update any other hardcoded version references you introduce in future changes. +4. Update any other hardcoded version references you introduce in future changes. + +`Dockerfile` and `Dockerfile.nginx_lua` pick up the rockspec via a `*.rockspec` glob, so they don't need updating for a version bump — as long as exactly one rockspec file exists in the repo root. The package version and the rockspec version should stay in sync, with the rockspec using the `-0` release suffix. diff --git a/Dockerfile b/Dockerfile index 25010d7..1602f33 100644 --- a/Dockerfile +++ b/Dockerfile @@ -9,9 +9,9 @@ RUN apt-get install -y libssl-dev FROM base AS build -COPY ./lua_resty_netacea-1.6.0-0.rockspec ./ +COPY ./*.rockspec ./ COPY ./src ./src -RUN /usr/local/openresty/luajit/bin/luarocks make ./lua_resty_netacea-1.6.0-0.rockspec +RUN /usr/local/openresty/luajit/bin/luarocks make ./*.rockspec FROM build AS test diff --git a/Dockerfile.nginx_lua b/Dockerfile.nginx_lua index 30a0954..e58cff0 100644 --- a/Dockerfile.nginx_lua +++ b/Dockerfile.nginx_lua @@ -69,9 +69,9 @@ RUN cd /usr/src && \ make install # Set up Netacea module -COPY ./lua_resty_netacea-1.6.0-0.rockspec ./ +COPY ./*.rockspec ./ COPY ./src ./src -RUN luarocks make ./lua_resty_netacea-1.6.0-0.rockspec +RUN luarocks make ./*.rockspec # Link CA certs so they match expected filename RUN ln -s /etc/ssl/certs/ca-bundle.crt /etc/ssl/certs/ca-certificates.crt From 642fa3492df8b8c97a03afd758c5b7834e9973b0 Mon Sep 17 00:00:00 2001 From: Mark Greenwood Date: Fri, 31 Jul 2026 09:38:53 +0100 Subject: [PATCH 6/6] More checks on version. Helper script for bumping version numbers --- CONTRIBUTING.md | 7 +-- bump_version.sh | 52 +++++++++++++++++++ check_rockspec_version.sh | 28 ++++++++-- ...spec => lua_resty_netacea-1.6.3-0.rockspec | 2 +- src/lua_resty_netacea.lua | 2 +- 5 files changed, 80 insertions(+), 11 deletions(-) create mode 100755 bump_version.sh rename lua_resty_netacea-1.6.2-0.rockspec => lua_resty_netacea-1.6.3-0.rockspec (98%) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index f038b6c..e70a2a2 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -64,12 +64,9 @@ docker compose run --rm --build lint ## Updating the version number -When releasing a new version, update all version references together: +Run `./bump_version.sh `, for example `./bump_version.sh 1.6.4`. It renames the rockspec, updates its `version = "..."` field, updates `_N._VERSION` in [`src/lua_resty_netacea.lua`](/home/user/github/lua_resty_netacea/src/lua_resty_netacea.lua), and finishes by running `check_rockspec_version.sh` to confirm everything agrees. -1. Update [`src/lua_resty_netacea.lua`](/home/user/github/lua_resty_netacea/src/lua_resty_netacea.lua) and change `_N._VERSION` to the new library version, for example `1.2.2`. -2. Rename the rockspec file to match the new release, for example `lua_resty_netacea-1.2.2-0.rockspec`. -3. Update the `version = "..."` field inside the rockspec to the same value. -4. Update any other hardcoded version references you introduce in future changes. +If you introduce a new hardcoded version reference elsewhere, update `bump_version.sh` and `check_rockspec_version.sh` to cover it too, so a future bump can't miss it. `Dockerfile` and `Dockerfile.nginx_lua` pick up the rockspec via a `*.rockspec` glob, so they don't need updating for a version bump — as long as exactly one rockspec file exists in the repo root. diff --git a/bump_version.sh b/bump_version.sh new file mode 100755 index 0000000..e15b7f7 --- /dev/null +++ b/bump_version.sh @@ -0,0 +1,52 @@ +#!/usr/bin/env bash +set -euo pipefail + +# Bumps the library to a new version in every place check_rockspec_version.sh +# checks: renames the rockspec, updates its `version` field, and updates +# _N._VERSION in src/lua_resty_netacea.lua. Always uses the "-0" release +# suffix (see CONTRIBUTING.md). +# +# Usage: ./bump_version.sh +# Example: ./bump_version.sh 1.6.3 + +NEW_VERSION="${1:?usage: $0 }" + +if [[ ! "$NEW_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + echo "Version '$NEW_VERSION' doesn't look like .., e.g. 1.6.3." >&2 + exit 1 +fi + +SOURCE_FILE="$(dirname "$0")/src/lua_resty_netacea.lua" +OLD_ROCKSPEC="$(ls ./lua_resty_netacea-*.rockspec 2>/dev/null | head -n1)" + +if [ -z "$OLD_ROCKSPEC" ] || [ ! -f "$OLD_ROCKSPEC" ]; then + echo "No existing rockspec found (expected ./lua_resty_netacea-*.rockspec)." >&2 + exit 1 +fi + +NEW_ROCKSPEC="./lua_resty_netacea-${NEW_VERSION}-0.rockspec" + +if [ "$OLD_ROCKSPEC" = "$NEW_ROCKSPEC" ]; then + echo "$OLD_ROCKSPEC is already at version $NEW_VERSION." >&2 + exit 1 +fi + +if [ -e "$NEW_ROCKSPEC" ]; then + echo "$NEW_ROCKSPEC already exists." >&2 + exit 1 +fi + +if git -C "$(dirname "$0")" rev-parse --git-dir >/dev/null 2>&1; then + git mv "$OLD_ROCKSPEC" "$NEW_ROCKSPEC" +else + mv "$OLD_ROCKSPEC" "$NEW_ROCKSPEC" +fi + +sed -i -E "s/^version[[:space:]]*=[[:space:]]*\"[^\"]+\"/version = \"${NEW_VERSION}-0\"/" "$NEW_ROCKSPEC" +sed -i -E "s/^_N\._VERSION[[:space:]]*=[[:space:]]*'[^']+'/_N._VERSION = '${NEW_VERSION}'/" "$SOURCE_FILE" + +echo "Bumped to $NEW_VERSION:" +echo " $NEW_ROCKSPEC" +echo " $SOURCE_FILE" + +"$(dirname "$0")/check_rockspec_version.sh" "$NEW_ROCKSPEC" diff --git a/check_rockspec_version.sh b/check_rockspec_version.sh index 203494d..71ea090 100755 --- a/check_rockspec_version.sh +++ b/check_rockspec_version.sh @@ -2,13 +2,16 @@ set -euo pipefail # Confirms the checked-in rockspec's filename and its internal `version` -# field agree, and that the version hasn't already been released as a git -# tag, so a PR can't ship a rockspec that installs under one version while -# claiming another, or silently reuse a version that's already out. +# field agree, that the version hasn't already been released as a git tag, +# and that src/lua_resty_netacea.lua's _N._VERSION was bumped to match, so +# a PR can't ship a rockspec that installs under one version while claiming +# another, silently reuse a version that's already out, or ship a release +# that reports its own predecessor's version at runtime. # # Usage: ./check_rockspec_version.sh [path-to-rockspec] ROCKSPEC="${1:-$(ls ./lua_resty_netacea-*.rockspec 2>/dev/null | head -n1)}" +SOURCE_FILE="$(dirname "$ROCKSPEC")/src/lua_resty_netacea.lua" if [ -z "$ROCKSPEC" ] || [ ! -f "$ROCKSPEC" ]; then echo "No rockspec found (expected ./lua_resty_netacea-*.rockspec)." >&2 @@ -42,4 +45,21 @@ if git rev-parse -q --verify "refs/tags/$TAG" >/dev/null; then exit 1 fi -echo "OK: $BASENAME matches version field ($FIELD_VERSION) and tag $TAG is unused." +if [ ! -f "$SOURCE_FILE" ]; then + echo "Could not find $SOURCE_FILE to check _N._VERSION." >&2 + exit 1 +fi + +MODULE_VERSION="$(grep -E "^_N\._VERSION[[:space:]]*=" "$SOURCE_FILE" | head -n1 | sed -E "s/^_N\._VERSION[[:space:]]*=[[:space:]]*['\"]([^'\"]+)['\"].*/\1/")" + +if [ -z "$MODULE_VERSION" ]; then + echo "Could not find a _N._VERSION = \"...\" assignment in $SOURCE_FILE." >&2 + exit 1 +fi + +if [ "$MODULE_VERSION" != "$RELEASE_VERSION" ]; then + echo "src/lua_resty_netacea.lua's _N._VERSION ($MODULE_VERSION) doesn't match the rockspec release version ($RELEASE_VERSION)." >&2 + exit 1 +fi + +echo "OK: $BASENAME matches version field ($FIELD_VERSION), module version ($MODULE_VERSION), and tag $TAG is unused." diff --git a/lua_resty_netacea-1.6.2-0.rockspec b/lua_resty_netacea-1.6.3-0.rockspec similarity index 98% rename from lua_resty_netacea-1.6.2-0.rockspec rename to lua_resty_netacea-1.6.3-0.rockspec index 0c17d5d..f17a35c 100644 --- a/lua_resty_netacea-1.6.2-0.rockspec +++ b/lua_resty_netacea-1.6.3-0.rockspec @@ -1,5 +1,5 @@ package = "lua_resty_netacea" -version = "1.6.2-0" +version = "1.6.3-0" source = { url = "git://github.com/Netacea/lua_resty_netacea", branch = "master" diff --git a/src/lua_resty_netacea.lua b/src/lua_resty_netacea.lua index 0cd19e7..c80e0ce 100644 --- a/src/lua_resty_netacea.lua +++ b/src/lua_resty_netacea.lua @@ -8,7 +8,7 @@ local Constants = require("lua_resty_netacea_constants") local mitigation = require("lua_resty_netacea_mitigation") local _N = {} -_N._VERSION = '1.6.0' +_N._VERSION = '1.6.3' _N._TYPE = 'nginx' local ngx = require 'ngx'