maggesandClaude Sonnet 5
6cd541de23
All 8 packages built and verified successfully in task 96 — the only remaining failure was the very last step: actions/upload-artifact@v4 errored with GHESNotSupportedError. Gitea Actions' built-in artifact storage doesn't implement the newer v2 upload/download API that upload-artifact@v4/download-artifact@v4 require. Downgraded both (they must match — v3 and v4 artifacts aren't cross-compatible) to v3, which uses the older protocol Gitea does support. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
97 lines
3.6 KiB
YAML
97 lines
3.6 KiB
YAML
name: Release
|
|
|
|
# Publishes a GitHub Release for a version tag (vX.Y.Z).
|
|
#
|
|
# By design, this workflow does NOT bump versions or modify podman.plg
|
|
# itself — that happens locally via `scripts/release.sh <version>`, which a
|
|
# maintainer reviews, commits, and tags *before* pushing the tag (see that
|
|
# script's own printed instructions). This workflow's only job is to:
|
|
# 1. Rebuild all packages from the tagged commit in a clean Slackware
|
|
# container (reproducibility check + provenance — we don't trust
|
|
# whatever a maintainer happened to have in their local dist/).
|
|
# 2. Verify checksums match what's already committed in plugin/podman.plg
|
|
# at this tag (catches a release.sh run that wasn't followed by a
|
|
# matching commit — see the "Verify plg matches build" step).
|
|
# 3. Create the GitHub Release and attach the .txz packages, checksum
|
|
# manifests, and podman.plg.
|
|
#
|
|
# See docs/ARCHITECTURE.md section 13 (Updates).
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*.*.*"
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
build:
|
|
name: Build release packages
|
|
uses: ./.github/workflows/build-packages.yml
|
|
|
|
publish:
|
|
name: Publish GitHub Release
|
|
needs: build
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Download built packages
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
name: ${{ needs.build.outputs.artifact-name }}
|
|
path: dist
|
|
|
|
- name: Re-verify checksums
|
|
run: scripts/checksums.sh dist
|
|
|
|
- name: Verify plugin/podman.plg matches these artifacts
|
|
# scripts/release.sh should already have been run locally, and its
|
|
# resulting podman.plg changes committed as part of this tag, before
|
|
# the tag was pushed. This step fails the release loudly if that
|
|
# didn't happen, instead of publishing a release whose plg points at
|
|
# MD5s that don't match the .txz files actually attached below.
|
|
run: |
|
|
set -eu
|
|
for f in dist/*.txz.md5; do
|
|
expected_md5=$(awk '{print $1}' "$f")
|
|
txz_name=$(basename "${f%.md5}")
|
|
if ! grep -qF "$expected_md5" plugin/podman.plg; then
|
|
echo "!! $txz_name's checksum ($expected_md5) is not referenced in plugin/podman.plg." >&2
|
|
echo "!! Did you forget to run scripts/release.sh and commit its changes before tagging?" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
echo "All package checksums are referenced in plugin/podman.plg — OK."
|
|
|
|
- name: Extract version from tag
|
|
id: version
|
|
run: echo "value=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Extract changelog section for this version
|
|
id: changelog
|
|
run: |
|
|
awk -v ver="${{ steps.version.outputs.value }}" '
|
|
$0 ~ "^## \\[" ver "\\]" { found=1; print; next }
|
|
found && /^## \[/ { exit }
|
|
found { print }
|
|
' CHANGELOG.md > /tmp/release-notes.md
|
|
echo "path=/tmp/release-notes.md" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Create GitHub Release
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
name: "unraid-podman v${{ steps.version.outputs.value }}"
|
|
body_path: ${{ steps.changelog.outputs.path }}
|
|
# v0.x tags are treated as pre-releases until the plugin reaches a
|
|
# first stable 1.0.0 — see docs/ROADMAP.md.
|
|
prerelease: ${{ startsWith(steps.version.outputs.value, '0.') }}
|
|
files: |
|
|
dist/*.txz
|
|
dist/*.sha256
|
|
dist/*.md5
|
|
dist/CHECKSUMS.sha256
|
|
dist/CHECKSUMS.md5
|
|
plugin/podman.plg
|