chore: verify bootstrap version format before merge

Relates-to: keymanapp/keyman.com#794
Test-bot: skip

Author: mcdurdin

.github/workflows/ci.yml

@@ -52,7 +52,7 @@ jobs:
         if [ ! -f ./metadata/kmwversions.json ]; then
           echo "Failed to generate static file"
           exit 1
-        fi    
+        fi
     #
     # If any of the tests fail, let's grab a bit more detail on the environment
     #
@@ -63,3 +63,16 @@ jobs:
         CONTAINER=`docker container ls -l -q`
         echo "--- PHP errors in Docker log ---"
         docker container logs $CONTAINER 2>&1 | grep 'php7'
+
+    - name: Verify .bootstrap-required-version
+      if: ${{ !cancelled() }}
+      shell: bash
+      run: |
+        # We want to avoid merging a bootstrap version that is not based on a published tag
+        # in the shared-sites repo. We will do this with a heuristic based on the normal
+        # shape of the tags, which is `v#.#.#`. Any other shape we will assume is a test
+        # branch.
+        cat resources/.bootstrap-required-version | grep -qP '^v\d+\.\d+\.\d+$' || (
+          echo "::error file=resources/.bootstrap-required-version,line=1,col=1::This branch cannot be merged, because resources/.bootstrap-required-version references \`$(cat resources/.bootstrap-required-version)\`, which does not appear to be a published tag -- is it a test branch?"
+          exit 1
+        )

build.sh

@@ -2,7 +2,8 @@
 ## START STANDARD SITE BUILD SCRIPT INCLUDE
 readonly THIS_SCRIPT="$(readlink -f "${BASH_SOURCE[0]}")"
 readonly BOOTSTRAP="$(dirname "$THIS_SCRIPT")/resources/bootstrap.inc.sh"
-readonly BOOTSTRAP_VERSION=v1.0.13
+BOOTSTRAP_VERSION="$(cat "$(dirname "THIS_SCRIPT")/resources/.bootstrap-required-version")" || exit 1
+readonly BOOTSTRAP_VERSION
 if ! [ -f "$BOOTSTRAP" ] || ! source "$BOOTSTRAP"; then
   curl -H "Cache-Control: no-cache" --fail --silent --show-error -w "curl: Finished attempt to download %{url}" "https://raw.githubusercontent.com/keymanapp/shared-sites/$BOOTSTRAP_VERSION/bootstrap.inc.sh" -o "$BOOTSTRAP.tmp" || exit 1
   source "$BOOTSTRAP.tmp"

resources/.bootstrap-required-version

@@ -0,0 +1 @@
+v1.0.14