feat: Gitea CI, and releases built once, previewed and promoted as one file

ci.yml runs tools/check.sh and the container gate on every push and pull request, with no secrets. Release 1 builds a version from its release commit on master or release/*, gates it, and keeps it in a Gitea pre-release. Release 2 gates that file again on the CI runner and publishes it to canary (Preview) from the release runner. Release 3 promotes the file Preview ran, on a person's approval. Import records a release from before Gitea kept the record. All of it is tools/release-ci.sh calling the existing scripts. docs/releasing.md: tracks, branches, each step, immutability, rollback, secrets, runners, Nightly and the hardware lab as designs, the Gitea administration still to do, and what was measured to make it. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-09-29 18:47:42 -05:00
parent 583f9b1809
commit 22f25854aa
10 changed files with 1643 additions and 5 deletions
@@ -0,0 +1,54 @@
+# BUILD A RELEASE: ONE COMMIT, ONE PACKAGE, KEPT FOR GOOD.
+#
+# Run by hand from master or a release/* branch, on the release commit:
+# the one whose VERSION says the version being released. It builds the
+# package from exactly that commit, runs every check and the full
+# container gate on that file, and creates the Gitea pre-release
+# vVERSION holding the package, SHA256SUMS, build-info.json and the
+# reports. Nothing is published: Preview and Stable are their own
+# workflows, and each is a person's decision. See docs/releasing.md.
+#
+# A version that already has a Gitea release, a tag, or a package on the
+# update server is refused. A version is built once.
+name: Release 1 - build
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'The version to build; VERSION at this commit must say the same (e.g. 0.2.6.7)'
+        required: true
+      from_versions:
+        description: 'Older releases rooms are still on, rehearsed as upgrades too (e.g. 0.2.2)'
+        required: false
+        default: ''
+
+jobs:
+  build:
+    name: build, check, gate and record
+    runs-on: ekklesia-ci
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Build, check, gate, and create the Gitea pre-release
+        id: build
+        env:
+          VERSION: ${{ github.event.inputs.version }}
+          FROM_VERSIONS: ${{ github.event.inputs.from_versions }}
+          GITEA_TOKEN: ${{ secrets.RELEASE_API_TOKEN || github.token }}
+        run: |
+          # shellcheck disable=SC2086 # FROM_VERSIONS is a list of versions
+          RELEASE_CI_WORK="$RUNNER_TEMP/release" tools/release-ci.sh build "$VERSION" $FROM_VERSIONS
+
+      - name: Keep the reports with this run as well
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: release-build-reports
+          path: |
+            dist/release-*/gate-report.txt
+            dist/release-*/checks.md
+            dist/release-*/build-info.json
+            ${{ runner.temp }}/release/checks