release.sh

#!/usr/bin/env bash
# Copyright The ORAS Authors.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -euo pipefail

# ORAS Release Helper Script
# Usage: scripts/release.sh <phase> <version> [args...]
# Phases: prep, tag, validate, publish

REPO="oras-project/oras"
VERSION_FILE="internal/version/version.go"
# Resolved lazily by detect_remote() once we're inside the repo. Do not assume
# any particular remote name (e.g. "upstream") here.
REMOTE=""
# Fingerprint of the ORAS project release key. Artifacts are signed with it in
# CI by release-github.yml; see the "signs" block in .goreleaser.yml.
RELEASE_SIGNING_KEY="C6FC42F0DE84A345FAADB742F44418110791EF37"

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
CYAN='\033[0;36m'
NC='\033[0m' # No Color

info()    { echo -e "${CYAN}[INFO]${NC} $*"; }
success() { echo -e "${GREEN}[OK]${NC} $*"; }
warn()    { echo -e "${YELLOW}[MANUAL]${NC} $*"; }
error()   { echo -e "${RED}[ERROR]${NC} $*" >&2; }

DRY_RUN=false
POSITIONAL_ARGS=()

# Parse global flags, leaving non-flag arguments in the POSITIONAL_ARGS global.
# This sets DRY_RUN in the current shell, so it MUST be called directly and not
# in a command substitution / subshell, or the assignment would be lost (which
# previously caused --dry-run to be silently ignored).
parse_global_flags() {
    POSITIONAL_ARGS=()
    for arg in "$@"; do
        case "$arg" in
            --dry-run) DRY_RUN=true ;;
            *) POSITIONAL_ARGS+=("$arg") ;;
        esac
    done
}

run() {
    if [ "$DRY_RUN" = true ]; then
        info "[DRY-RUN] $*"
        return 0
    fi
    "$@"
}


# Validate semver format
validate_version() {
    local version="$1"
    if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
        error "Invalid version format: $version (expected semver like 1.2.3 or 1.2.3-rc.1)"
        exit 1
    fi
}

# Check if this is a new minor version (patch == 0, no pre-release)
is_new_minor() {
    local version="$1"
    local patch
    patch=$(echo "$version" | cut -d. -f3 | cut -d- -f1)
    if [[ "$patch" == "0" && ! "$version" =~ - ]]; then
        return 0
    fi
    return 1
}

# Get major.minor from version
get_major_minor() {
    local version="$1"
    echo "$version" | cut -d. -f1-2
}

# Major.minor series currently released from 'main'. Honors
# ORAS_MAIN_RELEASE_VERSION when set; otherwise it is derived from the version
# already recorded in VERSION_FILE on the current branch, so it tracks the
# branch instead of needing a hardcoded edit every time the series moves.
main_release_version() {
    if [ -n "${ORAS_MAIN_RELEASE_VERSION:-}" ]; then
        echo "$ORAS_MAIN_RELEASE_VERSION"
        return 0
    fi
    get_major_minor "$(version_from_file)"
}

# Read version from VERSION_FILE
version_from_file() {
    sed -nE 's/.*Version = "([^"]+)".*/\1/p' "$VERSION_FILE"
}

# Detect the git remote that points at the canonical ORAS repo ($REPO).
# Honors ORAS_REMOTE when set; otherwise it matches each remote's URL against
# $REPO so it works no matter what the remote is named (upstream, origin, ...).
# Matches both SSH (git@github.com:oras-project/oras.git) and HTTPS forms, with
# or without a trailing ".git".
detect_remote() {
    if [ -n "${ORAS_REMOTE:-}" ]; then
        if ! git remote get-url "$ORAS_REMOTE" &>/dev/null; then
            error "ORAS_REMOTE is set to '${ORAS_REMOTE}', but no such git remote exists."
            return 1
        fi
        echo "$ORAS_REMOTE"
        return 0
    fi
    local remote url
    while read -r remote; do
        url=$(git remote get-url "$remote" 2>/dev/null || echo "")
        if [[ "$url" == *"${REPO}.git" || "$url" == *"${REPO}" ]]; then
            echo "$remote"
            return 0
        fi
    done < <(git remote)
    return 1
}

###############################################################################
# Check prerequisites (gh, gpg, remote)
###############################################################################
check_prerequisites() {
    info "Checking prerequisites..."
    if ! command -v gh &>/dev/null; then
        error "'gh' CLI not found. Install: https://cli.github.com"
        exit 1
    fi
    if ! gh auth status &>/dev/null; then
        error "'gh' CLI not authenticated. Run: gh auth login"
        exit 1
    fi
    if ! REMOTE=$(detect_remote); then
        error "Could not find a git remote pointing at ${REPO}. Add it (e.g. 'git remote add upstream https://github.com/${REPO}.git') or set ORAS_REMOTE to the correct remote name."
        exit 1
    fi
    info "Using git remote '${REMOTE}' for ${REPO}"
}

# Check that git can sign the commits and tags this script creates.
# 'git tag -s' honors gpg.format, which may be openpgp (the default), ssh or
# x509. Testing only for a GPG secret key both rejects maintainers who sign
# with SSH and passes maintainers whose GPG key git will never reach for.
check_signing() {
    local format
    format=$(git config --get gpg.format || echo "openpgp")
    case "$format" in
        ssh)
            if [ -z "$(git config --get user.signingkey || echo "")" ] &&
               [ -z "$(git config --get gpg.ssh.defaultKeyCommand || echo "")" ]; then
                error "gpg.format is 'ssh' but neither user.signingkey nor gpg.ssh.defaultKeyCommand is set."
                exit 1
            fi
            info "Signing tags and commits with SSH key"
            ;;
        openpgp|"")
            if ! command -v gpg &>/dev/null; then
                error "'gpg' not found. Install GPG, or configure SSH signing (git config gpg.format ssh)."
                exit 1
            fi
            if ! gpg --list-secret-keys --keyid-format LONG 2>/dev/null | grep -q sec; then
                error "No GPG secret keys found. Import or generate a key."
                exit 1
            fi
            info "Signing tags and commits with GPG key"
            ;;
        *)
            info "Tag signing format is '${format}'; skipping signing key check"
            ;;
    esac
}

###############################################################################
# Phase 1: Prep
###############################################################################
do_prep() {
    local version="$1"
    validate_version "$version"
    info "Preparing release v${version}"

    check_prerequisites
    check_signing
    success "Prerequisites OK"

    # Verify we're on main or the correct release branch
    local current_branch major_minor expected_branch
    current_branch=$(git branch --show-current)
    major_minor=$(get_major_minor "$version")
    expected_branch="release-${major_minor}"
    if [ "$current_branch" = "main" ]; then
        # 'main' carries the current series, and it is also where the next
        # minor is cut from, so allow both. Older patch releases belong on
        # their own release branch.
        local main_series
        main_series=$(main_release_version)
        if [ "$major_minor" != "$main_series" ] && ! is_new_minor "$version"; then
            error "'main' is on the v${main_series} series, so it cannot cut patch release v${version}. Use branch '${expected_branch}', or set ORAS_MAIN_RELEASE_VERSION to override the detected series."
            exit 1
        fi
    elif [ "$current_branch" != "$expected_branch" ]; then
        error "Must be on 'main' or '${expected_branch}' to release v${version}, but currently on '${current_branch}'."
        exit 1
    fi

    # Ensure working tree is clean
    if ! git diff --quiet || ! git diff --cached --quiet; then
        error "Working tree is not clean. Commit or stash changes before running prep."
        exit 1
    fi

    # Update version file. These edits are guarded explicitly rather than via
    # run(), which cannot wrap a redirect-free in-place sed, so that --dry-run
    # leaves the working tree untouched.
    info "Updating ${VERSION_FILE}..."
    if [ "$DRY_RUN" = true ]; then
        info "[DRY-RUN] Would set Version to ${version} and clear BuildMetadata in ${VERSION_FILE}"
    else
        sed -i.bak -E "s/Version = \"[^\"]+\"/Version = \"${version}\"/" "$VERSION_FILE"
        sed -i.bak -E "s/BuildMetadata = \"[^\"]*\"/BuildMetadata = \"\"/" "$VERSION_FILE"
        rm -f "${VERSION_FILE}.bak"
        success "Version set to ${version}"

        # Show the diff
        git diff "$VERSION_FILE"
    fi

    # Create branch, commit, push, PR. The PR targets the branch we are
    # releasing from: 'main' for the main series, or 'release-X.Y' for patches.
    local branch="chore/release-v${version}"
    local base_branch="$current_branch"
    info "Creating branch ${branch}..."
    run git checkout -b "$branch"
    run git add "$VERSION_FILE"
    run git commit -s -m "bump: tag and release ORAS CLI v${version}"
    run git push "${REMOTE}" "$branch"

    info "Creating pull request..."
    local pr_url
    if [ "$DRY_RUN" = true ]; then
        pr_url="https://github.com/${REPO}/pull/DRY-RUN"
        info "[DRY-RUN] Would create PR"
    else
        pr_url=$(gh pr create \
            --repo "$REPO" \
            --title "bump: tag and release ORAS CLI v${version}" \
            --body "$(cat <<EOF
## Release v${version}

This PR bumps the version to v${version} for the upcoming release.

### Checklist
- [ ] Version updated in \`internal/version/version.go\`
- [ ] CI checks pass
- [ ] Vote called in the ORAS Slack channel
- [ ] Super-majority of approval from ORAS maintainers
EOF
)" \
            --head "$branch" \
            --base "$base_branch")
    fi
    success "PR created: ${pr_url}"

    # Get the commit SHA
    local sha
    sha=$(git rev-parse HEAD)
    echo ""
    success "Release commit SHA: ${sha}"

    # Print Slack vote template
    echo ""
    warn "Copy the following message to the Slack #oras-maintainers channel to call for a vote:"
    echo ""
    echo -e "${CYAN}---${NC}"
    cat <<EOF
:ballot_box: *[VOTE] Release ORAS CLI v${version}*

Hi everyone, I'd like to call a vote for the release of ORAS CLI v${version}.

*Release PR:* ${pr_url}
*Release commit:* \`${sha}\`

Please review the PR and vote:
  :+1: — approve
  :-1: — request changes (please provide a reason)

A super-majority of approval from ORAS maintainers is required before the PR can be merged.
EOF
    echo -e "${CYAN}---${NC}"
    echo ""
    warn "After the vote passes and the PR is merged, run:"
    echo "  scripts/release.sh tag ${version} <merged-commit-sha>"
}

###############################################################################
# Phase 2: Tag
###############################################################################
do_tag() {
    local version="$1"
    local sha="${2:-}"
    validate_version "$version"

    if [ -z "$sha" ]; then
        error "Usage: scripts/release.sh tag <version> <commit-sha>"
        exit 1
    fi

    info "Tagging v${version} at ${sha}"

    check_prerequisites
    check_signing
    success "Prerequisites OK"

    # Verify the commit exists and is on main
    if ! git cat-file -t "$sha" &>/dev/null; then
        error "Commit ${sha} not found. Did you fetch latest?"
        exit 1
    fi

    # Check that the version file at that commit has the right version
    local file_version
    file_version=$(git show "${sha}:${VERSION_FILE}" | grep 'Version = ' | sed -E 's/.*"([^"]+)".*/\1/')
    if [ "$file_version" != "$version" ]; then
        error "Version in ${VERSION_FILE} at ${sha} is '${file_version}', expected '${version}'"
        exit 1
    fi

    # Create signed tag
    run git tag -s "v${version}" "$sha" -m "Release v${version}"
    success "Tag v${version} created"

    # Push tag
    run git push "${REMOTE}" "v${version}"
    success "Tag pushed"

    # Create release branch for new minor versions
    if is_new_minor "$version"; then
        local release_branch="release-$(get_major_minor "$version")"
        info "New minor version detected. Creating release branch ${release_branch}..."
        run git branch "$release_branch" "$sha"
        run git push "${REMOTE}" "$release_branch"
        success "Release branch ${release_branch} pushed"
    fi

    echo ""
    info "CI workflows triggered. Monitor at:"
    echo "  https://github.com/${REPO}/actions?query=event%3Apush+branch%3Av${version}"
    echo ""
    warn "Once CI completes, run:"
    echo "  scripts/release.sh validate ${version}"
}

###############################################################################
# Phase 3: Validate
###############################################################################
do_validate() {
    local version="$1"
    validate_version "$version"
    info "Validating release v${version}"

    if ! gh attestation verify --help 2>/dev/null | grep -q -- "--source-ref"; then
        error "'gh attestation verify --source-ref' is not available. Upgrade the GitHub CLI to v2.68.0 or later."
        exit 1
    fi

    # Wait for CI workflows
    info "Checking CI workflow status..."
    local workflows=("release-ghcr" "release-github")
    local all_done=false
    local max_attempts=60  # 30 minutes at 30s intervals
    local attempt=0

    while [ "$all_done" != "true" ] && [ "$attempt" -lt "$max_attempts" ]; do
        all_done=true
        for wf in "${workflows[@]}"; do
            local status
            status=$(gh run list \
                --repo "$REPO" \
                --workflow "$wf" \
                --branch "v${version}" \
                --limit 1 \
                --json status,conclusion \
                --jq '.[0] | "\(.status) \(.conclusion)"' 2>/dev/null || echo "not_found")

            if [[ "$status" == *"completed success"* ]]; then
                success "Workflow ${wf}: completed successfully"
            elif [[ "$status" == *"completed"* ]]; then
                error "Workflow ${wf}: ${status}"
                exit 1
            elif [[ "$status" == "not_found" ]]; then
                warn "Workflow ${wf}: not found yet"
                all_done=false
            else
                info "Workflow ${wf}: ${status} (waiting...)"
                all_done=false
            fi
        done

        if [ "$all_done" != "true" ]; then
            attempt=$(( attempt + 1 ))
            if [ "$attempt" -lt "$max_attempts" ]; then
                info "Waiting 30s for workflows... (attempt ${attempt}/${max_attempts})"
                sleep 30
            fi
        fi
    done

    if [ "$all_done" != "true" ]; then
        error "Timed out waiting for workflows"
        exit 1
    fi
    success "All CI workflows completed"

    # Fetch distribution artifacts via gh to support draft releases
    info "Fetching distribution artifacts..."
    run mkdir -p _dist
    run gh release download "v${version}" \
        --repo "$REPO" \
        --dir _dist/ \
        --pattern "oras_${version}_*" \
        --clobber
    success "Artifacts downloaded to _dist/"

    # Verify checksums
    info "Verifying checksums..."
    if command -v sha256sum >/dev/null 2>&1; then
        (cd _dist && sha256sum -c "oras_${version}_checksums.txt" --ignore-missing)
    elif command -v shasum >/dev/null 2>&1; then
        (cd _dist && shasum -a 256 -c "oras_${version}_checksums.txt" --ignore-missing)
    else
        error "Neither sha256sum nor shasum is available; cannot verify checksums."
        exit 1
    fi
    success "Checksums verified"

    # Verify the build provenance attestations made by release-github.yml
    info "Verifying build provenance attestations..."
    local attested=0
    for subject in _dist/oras_"${version}"_*.tar.gz _dist/oras_"${version}"_*.zip "_dist/oras_${version}_checksums.txt"; do
        [ -f "$subject" ] || continue
        if gh attestation verify "$subject" --repo "$REPO" \
            --signer-workflow "${REPO}/.github/workflows/release-github.yml" \
            --source-ref "refs/tags/v${version}" \
            --deny-self-hosted-runners >/dev/null; then
            success "Attestation verified: $(basename "$subject")"
            attested=$(( attested + 1 ))
        else
            error "No valid build provenance attestation for $(basename "$subject")"
            exit 1
        fi
    done
    if [ "$attested" -eq 0 ]; then
        error "No release archives found in _dist/ to verify attestations for."
        exit 1
    fi
    success "All ${attested} attestations verified"

    # Test binary for the current OS/arch
    local os arch artifact
    case "$(uname -s)" in
        Darwin) os="darwin" ;;
        Linux)  os="linux" ;;
        *)      os="linux" ;;
    esac
    case "$(uname -m)" in
        x86_64)  arch="amd64" ;;
        arm64|aarch64) arch="arm64" ;;
        *)       arch="amd64" ;;
    esac
    artifact="${os}_${arch}"
    info "Testing ${os}/${arch} binary..."
    local tmpdir
    tmpdir=$(mktemp -d)
    tar -xzf "_dist/oras_${version}_${artifact}.tar.gz" -C "$tmpdir"
    local bin_version
    bin_version=$("$tmpdir/oras" version 2>/dev/null | head -1 || echo "unknown")
    rm -rf "$tmpdir"

    if echo "$bin_version" | grep -q "$version"; then
        success "Binary version matches: ${bin_version}"
    else
        error "Binary version mismatch. Expected '${version}', got: ${bin_version}"
        exit 1
    fi

    # Check git commit in binary
    local tag_sha
    tag_sha=$(git rev-list -n 1 "v${version}" 2>/dev/null || echo "unknown")
    if echo "$bin_version" | grep -q "${tag_sha:0:7}"; then
        success "Binary git commit matches tag SHA"
    else
        warn "Could not verify git commit in binary output (non-fatal)"
    fi

    echo ""
    success "All validation checks passed!"
    echo ""
    warn "Review the release notes at:"
    echo "  https://github.com/${REPO}/releases/tag/v${version}"
    echo ""
    warn "When ready, run:"
    echo "  scripts/release.sh publish ${version}"
}

###############################################################################
# Phase 4: Verify & Publish
###############################################################################
do_publish() {
    local version="$1"
    validate_version "$version"
    info "Publishing release v${version}"

    # Check artifacts exist
    if [ ! -d "_dist" ]; then
        error "_dist/ directory not found. Run 'scripts/release.sh validate ${version}' first."
        exit 1
    fi

    # Artifacts are signed in CI with the ORAS project release key (see the
    # "signs" block in .goreleaser.yml), and the .asc files ship with the
    # release, so 'validate' already downloaded them. Verify them here rather
    # than signing again: a local signature would be made with whichever key
    # gpg defaults to and would replace the project key's signatures on the
    # release.
    if ! gpg --list-keys "$RELEASE_SIGNING_KEY" &>/dev/null; then
        info "Release signing key not in keyring, importing from KEYS..."
        gpg --import KEYS &>/dev/null || true
        if ! gpg --list-keys "$RELEASE_SIGNING_KEY" &>/dev/null; then
            error "Release signing key ${RELEASE_SIGNING_KEY} is not in your keyring and could not be imported from KEYS."
            exit 1
        fi
    fi

    info "Verifying release signatures against ${RELEASE_SIGNING_KEY}..."
    local sig_count=0
    for asc in _dist/oras_"${version}"_*.asc; do
        [ -f "$asc" ] || continue
        local orig="${asc%.asc}"
        if [ ! -f "$orig" ]; then
            error "Signature $(basename "$asc") has no matching artifact in _dist/"
            exit 1
        fi
        if gpg --verify --status-fd=1 "$asc" "$orig" 2>/dev/null | grep -q "VALIDSIG .*${RELEASE_SIGNING_KEY}"; then
            success "Verified: $(basename "$orig")"
            sig_count=$(( sig_count + 1 ))
        else
            error "Signature verification failed for $(basename "$orig"); expected a signature by ${RELEASE_SIGNING_KEY}"
            exit 1
        fi
    done
    if [ "$sig_count" -eq 0 ]; then
        error "No .asc signature files found in _dist/. Check that release-github.yml signed the artifacts."
        exit 1
    fi
    success "All ${sig_count} signatures verified"

    # Record the signing key in the release notes
    local existing_notes
    if [ "$DRY_RUN" = true ]; then
        info "[DRY-RUN] Would append signing info to release notes"
    else
        existing_notes=$(gh release view "v${version}" --repo "$REPO" --json body --jq '.body')
        if [[ "$existing_notes" == *"## Verification"* ]]; then
            info "Release notes already carry a Verification section, leaving them as they are"
        else
            info "Adding verification info to release notes..."
            local note="## Verification\n\nRelease artifacts are signed with the ORAS project release key \`${RELEASE_SIGNING_KEY}\`. Signatures (\`.asc\` files) are attached to this release.\n\nPublic keys are available in the [KEYS](https://github.com/${REPO}/blob/main/KEYS) file.\n\nRelease archives and the checksums file also have GitHub build provenance attestations. Verify an archive with:\n\n\`\`\`sh\ngh attestation verify oras_${version}_linux_amd64.tar.gz --repo ${REPO}\n\`\`\`\n\nThe attestations are Sigstore bundles, so they can also be downloaded with \`gh attestation download\` and checked with \`cosign verify-blob-attestation\`."
            gh release edit "v${version}" --repo "$REPO" --notes "$(printf '%s\n\n%b' "$existing_notes" "$note")"
            success "Release notes updated with verification info"
        fi
    fi

    # Publish release
    run gh release edit "v${version}" --repo "$REPO" --draft=false
    success "Release v${version} published!"

    # Trigger snap workflow
    info "Triggering snap workflow..."
    local is_stable="true"
    if [[ "$version" == *"-"* ]]; then
        is_stable="false"
    fi
    if [ "$DRY_RUN" = true ]; then
        info "[DRY-RUN] Would trigger release-snap.yml with version=v${version} isStable=${is_stable}"
    else
        gh workflow run release-snap.yml \
            --repo "$REPO" \
            --ref "v${version}" \
            --field version="v${version}" \
            --field isStable="${is_stable}" 2>/dev/null \
        && success "Snap workflow triggered" \
        || warn "Could not trigger snap workflow. You may need to trigger it manually."
    fi

    # Clean up
    run rm -rf _dist
    success "Cleaned up _dist/"

    echo ""
    success "Release v${version} is live!"
    echo "  https://github.com/${REPO}/releases/tag/v${version}"
    echo ""
    warn "Post-release steps (manual):"
    echo "  1. Update oras-www docs if needed"
    echo "  2. Announce in Slack #oras:"
    echo ""
    echo -e "${CYAN}---${NC}"
    cat <<EOF
:tada: *ORAS CLI v${version} Released!*

We're excited to announce the release of ORAS CLI v${version}!

*Release:* https://github.com/${REPO}/releases/tag/v${version}

Thank you to all contributors!
EOF
    echo -e "${CYAN}---${NC}"
}

###############################################################################
# Main
###############################################################################
usage() {
    cat <<EOF
Usage: scripts/release.sh [--dry-run] <phase> <version> [args...]

Phases:
  prep <version>              Bump version, create PR, print vote template
  tag <version> <commit-sha>  Create and push signed tag
  validate [version]          Wait for CI, download and verify artifacts (default: version from version.go)
  publish [version]           Verify signatures, publish release (default: version from version.go)

Flags:
  --dry-run                   Print actions without executing them

Environment:
  ORAS_REMOTE                 Git remote name for ${REPO}
                              (default: auto-detected from remote URLs)
  ORAS_MAIN_RELEASE_VERSION   Major.minor series released from 'main'
                              (default: derived from ${VERSION_FILE})

Examples:
  scripts/release.sh prep 1.3.0
  scripts/release.sh tag 1.3.0 abc1234
  scripts/release.sh validate
  scripts/release.sh publish
  scripts/release.sh --dry-run prep 1.3.0-rc.1
EOF
}

main() {
    parse_global_flags "$@"
    set -- ${POSITIONAL_ARGS[@]+"${POSITIONAL_ARGS[@]}"}

    local phase="${1:-}"
    local version="${2:-}"

    if [ -z "$phase" ]; then
        usage
        exit 1
    fi

    # Ensure we're in the repo root
    cd "$(git rev-parse --show-toplevel)"

    case "$phase" in
        prep)
            [ -z "$version" ] && { error "Usage: scripts/release.sh prep <version>"; exit 1; }
            do_prep "$version"
            ;;
        tag)
            [ -z "$version" ] && { error "Usage: scripts/release.sh tag <version> <sha>"; exit 1; }
            do_tag "$version" "${3:-}"
            ;;
        validate)
            [ -z "$version" ] && version=$(version_from_file)
            [ -z "$version" ] && { error "Usage: scripts/release.sh validate [version]"; exit 1; }
            do_validate "$version"
            ;;
        publish)
            [ -z "$version" ] && version=$(version_from_file)
            [ -z "$version" ] && { error "Usage: scripts/release.sh publish [version]"; exit 1; }
            do_publish "$version"
            ;;
        help|--help|-h)
            usage
            ;;
        *)
            error "Unknown phase: ${phase}"
            usage
            exit 1
            ;;
    esac
}

main "$@"