v0.2.0

.editorconfig

@@ -16,6 +16,13 @@ space_redirects = true
 [Dockerfile]
 indent_style = space
 
-[*.{json,yml,yaml,md}]
+[*.{yml,yaml,md}]
 indent_style = space
 indent_size = 2
+
+[*.md]
+indent_size = unset
+
+[*.lock]
+indent_style = space
+indent_size = 4

.gitattributes

@@ -1,6 +1,7 @@
 * text=auto eol=lf
 
 *.md diff=markdown
+CHANGELOG.md merge=union
 
 /.github export-ignore
 .editorconfig export-ignore

.github/PULL_REQUEST_TEMPLATE/default.md

@@ -1,9 +1,13 @@
-<!-- one sentence describing what this PR does and why -->
+<!-- one sentence describing what this PR does -->
 
 ## Changes
 
 -
 
+## Why
+
+<!-- why these changes are needed, what they try to achieve, and why they make sense -->
+
 ## Issues
 
 - Fixes

.github/jactionlint.yaml

@@ -0,0 +1 @@
+profile: pedantic

.github/workflows/actions.lock

@@ -0,0 +1,66 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/build.yaml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'docker/build-push-action@v7.4.0'
+        - 'docker/setup-buildx-action@v4.4.1'
+        - 'docker/setup-qemu-action@v4.4.0'
+    '.github/workflows/check-upstream.yaml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/clean-manifests.yaml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/upload-artifact@v7.0.2'
+    '.github/workflows/merge-forward.yaml':
+        - 'actions/checkout@v7.0.1'
+    '.github/workflows/pull-request.yaml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.2'
+        - 'docker/login-action@v4.7.0'
+    '.github/workflows/release.yaml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.2'
+        - 'docker/login-action@v4.7.0'
+    '.github/workflows/tests.yaml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.2'
+        - 'docker/setup-qemu-action@v4.4.0'
+dependencies:
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/download-artifact@v8.0.2':
+        ref: 'v8.0.2'
+        commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/upload-artifact@v7.0.2':
+        ref: 'v7.0.2'
+        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+        owner_id: 44036562
+        repo_id: 192625955
+    'docker/build-push-action@v7.4.0':
+        ref: 'v7.4.0'
+        commit: 'sha1-c3c9e263c25d99ce0380d002d59b67737d91b0dc'
+        owner_id: 5429470
+        repo_id: 241092383
+    'docker/login-action@v4.7.0':
+        ref: 'v4.7.0'
+        commit: 'sha1-81c6f93d4bc991e510b342a00b419b3bb4efc5c6'
+        owner_id: 5429470
+        repo_id: 287743349
+    'docker/setup-buildx-action@v4.4.1':
+        ref: 'v4.4.1'
+        commit: 'sha1-f87e5991a6d7451dcb8d9637bfbc97413f497069'
+        owner_id: 5429470
+        repo_id: 288485773
+    'docker/setup-qemu-action@v4.4.0':
+        ref: 'v4.4.0'
+        commit: 'sha1-99012661954931238ded8c8b007157a8430204e1'
+        owner_id: 5429470
+        repo_id: 288487894

.github/workflows/build.yaml

@@ -0,0 +1,150 @@
+name: Build
+
+on:
+  schedule:
+    - cron: "50 7 * * 1"
+  workflow_dispatch:
+  workflow_call:
+    inputs:
+      lines:
+        description: The upstream lines to build as JSON, every line of src/upstream.json when empty
+        type: string
+        default: ""
+
+permissions: {}
+
+cache-mode: none
+
+concurrency:
+  group: build-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  plan:
+    name: Plan build
+    permissions:
+      contents: read
+    runs-on: ubuntu-26.04 # https://github.com/actions/runner-images
+    timeout-minutes: 10
+    outputs:
+      image: ${{ steps.plan.outputs.image }}
+      lines: ${{ inputs.lines || steps.plan.outputs.lines }}
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Plan the image version of each SQLite line
+        id: plan
+        env:
+          BRANCH: ${{ github.base_ref || github.ref_name }}
+          PULL_REQUEST: ${{ github.event.pull_request.number }}
+        run: |
+          image="$(scripts/plan-version.sh --build)"
+          lines="$(jq -c '[.sqlite | to_entries[] | {name: .key, version: .value.version}]' src/upstream.json)"
+          printf 'image=%s\nlines=%s\n' "$image" "$lines" >> "$GITHUB_OUTPUT"
+
+  build:
+    name: Build image (${{ matrix.line.name }}, ${{ matrix.platform }})
+    needs: plan
+    permissions:
+      contents: read
+    runs-on: ${{ matrix.runner }} # https://github.com/actions/runner-images
+    timeout-minutes: 60
+    strategy:
+      matrix:
+        line: ${{ fromJSON(needs.plan.outputs.lines) }}
+        platform: [linux/amd64, linux/arm64, linux/arm/v7, linux/arm/v6, linux/riscv64, linux/ppc64le, linux/s390x, linux/386]
+        include:
+          - platform: linux/amd64
+            arch: amd64
+            runner: ubuntu-26.04
+          - platform: linux/arm64
+            arch: arm64
+            runner: ubuntu-26.04-arm
+          - platform: linux/arm/v7
+            arch: armv7
+            runner: ubuntu-26.04-arm
+            qemu: true
+          - platform: linux/arm/v6
+            arch: armv6
+            runner: ubuntu-26.04-arm
+            qemu: true
+          - platform: linux/riscv64
+            arch: riscv64
+            runner: ubuntu-26.04
+            qemu: true
+          - platform: linux/ppc64le
+            arch: ppc64le
+            runner: ubuntu-26.04
+            qemu: true
+          - platform: linux/s390x
+            arch: s390x
+            runner: ubuntu-26.04
+            qemu: true
+          - platform: linux/386
+            arch: "386"
+            runner: ubuntu-26.04
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Read the commit date
+        id: args
+        run: |
+          {
+            echo "epoch=$(git log -1 --format=%ct)"
+            echo "created=$(TZ=UTC git log -1 --format=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Set up QEMU
+        if: ${{ matrix.qemu }}
+        uses: docker/setup-qemu-action@v4.4.0
+        with:
+          image: docker.io/tonistiigi/binfmt:qemu-v10.2.3-68@sha256:400a4873b838d1b89194d982c45e5fb3cda4593fbfd7e08a02e76b03b21166f0 # https://github.com/tonistiigi/binfmt/releases/tag/deploy/v10.2.3-68
+          cache-image: false
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@v4.4.1
+        with:
+          cache-binary: false
+
+      - name: Build the image
+        uses: docker/build-push-action@v7.4.0
+        with:
+          context: src
+          platforms: ${{ matrix.platform }}
+          tags: peakimages/sqlite:test
+          outputs: type=oci,dest=${{ runner.temp }}/image,tar=false,rewrite-timestamp=true,compression=zstd,compression-level=11,force-compression=true
+          build-args: |
+            SQLITE_VERSION=${{ matrix.line.version }}
+            IMAGE_VERSION=${{ needs.plan.outputs.image }}
+            SOURCE_DATE_EPOCH=${{ steps.args.outputs.epoch }}
+            CREATED=${{ steps.args.outputs.created }}
+            GIT_SHA=${{ github.sha }}
+          provenance: mode=max
+          sbom: true
+
+      - name: Upload the image
+        uses: actions/upload-artifact@v7.0.2
+        with:
+          name: image-${{ matrix.line.name }}-${{ matrix.arch }}
+          path: ${{ runner.temp }}/image
+          if-no-files-found: error
+          retention-days: 1
+
+  tests:
+    name: Tests
+    needs: [plan, build]
+    permissions:
+      contents: read
+    uses: $/.github/workflows/tests.yaml
+    with:
+      lines: ${{ needs.plan.outputs.lines }}

.github/workflows/check-upstream.yaml

@@ -2,51 +2,105 @@ name: Check upstream
 
 on:
   schedule:
-    - cron: "30 8 * * *"
+    - cron: "20 7,18 * * *"
   workflow_dispatch:
 
 permissions: {}
 
+cache-mode: none
+
+concurrency:
+  group: check-upstream
+  cancel-in-progress: false
+
+defaults:
+  run:
+    shell: bash
+
 jobs:
+  lines:
+    name: List SQLite lines
+    permissions:
+      contents: read
+    runs-on: ubuntu-26.04 # https://github.com/actions/runner-images
+    timeout-minutes: 10
+    outputs:
+      lines: ${{ steps.lines.outputs.lines }}
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: List the lines of main, the maintenance and the major release branches
+        id: lines
+        run: |
+          for branch in $(git branch --remotes --format='%(refname:lstrip=3)' | grep -xE 'main|v[0-9]+\.x|release/v[0-9]+\.0'); do
+            git show "origin/$branch:src/upstream.json" | jq -c --arg branch "$branch" '.sqlite | keys[] | {$branch, line: .}'
+          done | jq -sc '"lines=\(.)"' -r >> "$GITHUB_OUTPUT"
+
   check:
+    name: Check sqlite.org (${{ matrix.branch }}, ${{ matrix.line }})
+    needs: lines
     permissions:
-      contents: write
-      pull-requests: write
+      actions: write # start the build workflow on the branch of the pull request
+      contents: write # push the branch of the pull request
+      pull-requests: write # open the pull request
     runs-on: ubuntu-26.04 # https://github.com/actions/runner-images
     timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(needs.lines.outputs.lines) }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # https://github.com/actions/checkout/releases/tag/v7.0.1
+      - name: Check out the branch
+        uses: actions/checkout@v7.0.1
         with:
+          ref: ${{ matrix.branch }}
           persist-credentials: false
 
-      - run: scripts/check-upstream.sh
+      - name: Check sqlite.org and pin a new SQLite release
+        env:
+          LINE: ${{ matrix.line }}
+        run: scripts/check-upstream.sh "$LINE"
 
-      - name: Open a pull request
+      - name: Open a pull request for the new release
         env:
           GH_TOKEN: ${{ github.token }}
+          BASE: ${{ matrix.branch }}
+          LINE: ${{ matrix.line }}
         run: |
           git diff --quiet && exit 0
-          version="$(jq -r .version src/version.json)"
-          source_id="$(jq -r .source_id src/version.json)"
+          pin() { jq -r --arg line "$LINE" ".sqlite[\$line].$1"; }
+          current="$(git show HEAD:src/upstream.json | pin version)"
+          version="$(pin version < src/upstream.json)"
+          source_id="$(pin source_id < src/upstream.json)"
           branch="feat/sqlite-v$version"
-          title="feat(release): bump SQLite version to v$version"
+          [ "$BASE" = main ] || branch="$branch-${BASE//\//-}"
+          title="feat(release): bump SQLite version from v$current to v$version"
           if [ -n "$(gh pr list --head "$branch" --json number --jq '.[0].number')" ]; then
             echo "a pull request from $branch is open already"
             exit 0
           fi
           cat > "$RUNNER_TEMP/body.md" <<BODY
-          Release notes: https://sqlite.org/releaselog/${version//./_}.html
+          Updates SQLite to v$version, see its [release notes](https://sqlite.org/releaselog/${version//./_}.html) and its [release check-in](https://sqlite.org/src/info/${source_id##* }).
+
+          ## Changes
 
-          Source id \`$source_id\`, confirm the check-in on https://sqlite.org/src/timeline?t=release before merging.
+          - Bump SQLite version from v$current to v$version
 
           > [!IMPORTANT]
           > Squash merge this PR to keep the commit history clean.
-
           BODY
           gh auth setup-git
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git switch --create "$branch"
           git commit --all --quiet --message "$title"
           git push --quiet --set-upstream origin "$branch"
-          gh pr create --base main --head "$branch" --title "$title" --body-file "$RUNNER_TEMP/body.md"
+          new_pr="$(gh pr create --base "$BASE" --head "$branch" --title "$title" --label bot/upstream --body-file "$RUNNER_TEMP/body.md")"
+          gh workflow run build.yaml --ref "$branch"
+          for open_pr in $(gh pr list --label bot/upstream --base "$BASE" --json url,title | jq -r --arg from "from v$current to" '.[] | select(.title | contains($from)) | .url'); do
+            [ "$open_pr" = "$new_pr" ] || gh pr close "$open_pr" --delete-branch --comment "Superseded by $new_pr"
+          done