Perform a set of operations needed to release a single check:

    \b
      * update the version in __about__.py
      * update the changelog
      * update the requirements-agent-release.txt file
      * update in-toto metadata
      * commit the above changes

    You can release everything at once by setting the check to `all`.

    \b
    If you run into issues signing:
    \b
      - Ensure you did `gpg --import <YOUR_KEY_ID>.gpg.pub`

def make(ctx, check, version, initial_release, skip_sign, sign_only):
    """Perform a set of operations needed to release a single check:

    \b
      * update the version in __about__.py
      * update the changelog
      * update the requirements-agent-release.txt file
      * update in-toto metadata
      * commit the above changes

    You can release everything at once by setting the check to `all`.

    \b
    If you run into issues signing:
    \b
      - Ensure you did `gpg --import <YOUR_KEY_ID>.gpg.pub`
    """
    # Import lazily since in-toto runs a subprocess to check for gpg2 on load
    from ..signing import update_link_metadata, YubikeyException

    releasing_all = check == 'all'

    valid_checks = get_valid_checks()
    if not releasing_all and check not in valid_checks:
        abort('Check `{}` is not an Agent-based Integration'.format(check))

    # don't run the task on the master branch
    if get_current_branch() == 'master':
        abort('This task will commit, you do not want to add commits to master directly')

    if releasing_all:
        if version:
            abort('You cannot bump every check to the same version')
        checks = sorted(valid_checks)
    else:
        checks = [check]

    if initial_release:
        version = '1.0.0'

    for check in checks:
        if sign_only:
            break
        elif initial_release and check in BETA_PACKAGES:
            continue

        # Initial releases will only bump if not already 1.0.0 so no need to always output
        if not initial_release:
            echo_success('Check `{}`'.format(check))

        if version:
            # sanity check on the version provided
            cur_version = get_version_string(check)

            if version == 'final':
                # Remove any pre-release metadata
                version = finalize_version(cur_version)
            else:
                # Keep track of intermediate version bumps
                prev_version = cur_version
                for method in version.split(','):
                    # Apply any supported version bumping methods. Chaining is required for going
                    # from mainline releases to development releases since e.g. x.y.z > x.y.z-rc.A.
                    # So for an initial bug fix dev release you can do `fix,rc`.
                    if method in VERSION_BUMP:
                        version = VERSION_BUMP[method](prev_version)
                        prev_version = version

            p_version = parse_version_info(version)
            p_current = parse_version_info(cur_version)
            if p_version <= p_current:
                if initial_release:
                    continue
                else:
                    abort('Current version is {}, cannot bump to {}'.format(cur_version, version))
        else:
            cur_version, changelog_types = ctx.invoke(changes, check=check, dry_run=True)
            if not changelog_types:
                echo_warning('No changes for {}, skipping...'.format(check))
                continue
            bump_function = get_bump_function(changelog_types)
            version = bump_function(cur_version)

        if initial_release:
            echo_success('Check `{}`'.format(check))

        # update the version number
        echo_info('Current version of check {}: {}'.format(check, cur_version))
        echo_waiting('Bumping to {}... '.format(version), nl=False)
        update_version_module(check, cur_version, version)
        echo_success('success!')

        # update the CHANGELOG
        echo_waiting('Updating the changelog... ', nl=False)
        # TODO: Avoid double GitHub API calls when bumping all checks at once
        ctx.invoke(
            changelog,
            check=check,
            version=version,
            old_version=cur_version,
            initial=initial_release,
            quiet=True,
            dry_run=False,
        )
        echo_success('success!')

        commit_targets = [check]

        # update the list of integrations to be shipped with the Agent
        if check not in NOT_CHECKS:
            req_file = get_agent_release_requirements()
            commit_targets.append(os.path.basename(req_file))
            echo_waiting('Updating the Agent requirements file... ', nl=False)
            update_agent_requirements(req_file, check, get_agent_requirement_line(check, version))
            echo_success('success!')

        echo_waiting('Committing files...')

        # commit the changes.
        # do not use [ci skip] so releases get built https://docs.gitlab.com/ee/ci/yaml/#skipping-jobs
        msg = '[Release] Bumped {} version to {}'.format(check, version)
        git_commit(commit_targets, msg)

        if not initial_release:
            # Reset version
            version = None

    if sign_only or not skip_sign:
        echo_waiting('Updating release metadata...')
        echo_info('Please touch your Yubikey immediately after entering your PIN!')
        try:
            commit_targets = update_link_metadata(checks)
            git_commit(commit_targets, '[Release] Update metadata', force=True)
        except YubikeyException as e:
            abort('A problem occurred while signing metadata: {}'.format(e))

    # done
    echo_success('All done, remember to push to origin and open a PR to merge these changes on master')