Fix automated release

.github/workflows/publish.yml

@@ -6,6 +6,9 @@ on:
 
 permissions: {}
 
+env:
+  REGISTRY: ghcr.io
+
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -21,6 +24,12 @@ jobs:
           version: '2.25.1'
           platform: 'linux64'
           checksum: '4f070e6cc7009e75aec307ed109c2fcf0501e579c20a31080b893e31209523d5'
+      - name: Log in to the Container registry
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4.1.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - run: make test
       - run: make publish
         env:

README.md

@@ -53,3 +53,13 @@ make pack-upgrade
 make test format
 make generate-table generate-help
 ```
+
+## Release
+
+1. Ensure all `qlpack.yml` files have the correct version.
+
+   ```shell
+   ./scripts/update-version.sh <version>
+   ```
+
+1. Create a release on GitHub, create a new tag, and autogenerate release notes.

go/src/qlpack.yml

@@ -2,7 +2,7 @@
 name: trailofbits/go-queries
 description: CodeQL queries for Go developed by Trail of Bits
 authors: Trail of Bits
-version: 0.2.1
+version: 0.3.0
 license: AGPL
 library: false
 extractor: go

java/src/qlpack.yml

@@ -2,7 +2,7 @@
 name: trailofbits/java-queries
 description: CodeQL queries for Java developed by Trail of Bits
 authors: Trail of Bits
-version: 0.0.1
+version: 0.3.0
 license: AGPL
 library: false
 extractor: java-kotlin

scripts/update-version.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+set -euo pipefail
+
+if [[ $# -ne 1 ]]; then
+	echo "Usage: $0 <version>" >&2
+	echo "Example: $0 0.4.0" >&2
+	exit 1
+fi
+
+version="$1"
+
+if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+	echo "Error: version must be semver (X.Y.Z), got: $version" >&2
+	exit 1
+fi
+
+packs=(
+	cpp/lib/qlpack.yml
+	cpp/src/qlpack.yml
+	go/src/qlpack.yml
+	java/src/qlpack.yml
+)
+
+for f in "${packs[@]}"; do
+	if [[ ! -f "$f" ]]; then
+		echo "Error: file not found: $f (run from repo root)" >&2
+		exit 1
+	fi
+	if ! grep -q '^version: ' "$f"; then
+		echo "Error: no 'version:' line in $f" >&2
+		exit 1
+	fi
+done
+
+for f in "${packs[@]}"; do
+	tmp="$(mktemp)"
+	sed "s/^version: .*/version: $version/" "$f" >"$tmp"
+	mv "$tmp" "$f"
+	echo "Updated $f -> $version"
+done