feat: Gitea CI, and releases built once, previewed and promoted as one file

ci.yml runs tools/check.sh and the container gate on every push and pull request, with no secrets. Release 1 builds a version from its release commit on master or release/*, gates it, and keeps it in a Gitea pre-release. Release 2 gates that file again on the CI runner and publishes it to canary (Preview) from the release runner. Release 3 promotes the file Preview ran, on a person's approval. Import records a release from before Gitea kept the record. All of it is tools/release-ci.sh calling the existing scripts. docs/releasing.md: tracks, branches, each step, immutability, rollback, secrets, runners, Nightly and the hardware lab as designs, the Gitea administration still to do, and what was measured to make it. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-09-29 18:47:42 -05:00
parent 583f9b1809
commit 22f25854aa
10 changed files with 1643 additions and 5 deletions
@@ -0,0 +1,57 @@
+# PROMOTE TO STABLE: THE FILE PREVIEW RAN, AND NOTHING ELSE.
+#
+# Only after a person has done the physical checks in docs/testing.md on
+# real hardware and says so here. No build, no gate: stable is pointed at
+# the package already on the server, and update_stable.sh refuses any
+# file but the SHA-256 given. The Gitea release must already record that
+# exact file going to Preview.
+#
+# Merging code never runs this. Nothing runs it but a person.
+name: Release 3 - promote to Stable
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'The version on Preview to promote'
+        required: true
+      sha256:
+        description: 'Its SHA-256, exactly as approved'
+        required: true
+      approval:
+        description: 'Who approved it, when, and which physical checks passed on which machine'
+        required: true
+      confirm:
+        description: 'Type: PROMOTE <version> TO STABLE'
+        required: true
+
+jobs:
+  promote:
+    name: promote the approved file and read it back
+    runs-on: ekklesia-release
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: What promoting needs
+        run: |
+          command -v ssh rsync curl python3 dpkg-deb git >/dev/null \
+            || { apt-get update -qq && apt-get install -y -qq --no-install-recommends \
+                   openssh-client rsync curl python3 dpkg git ca-certificates >/dev/null; }
+
+      - name: Promote, and record it
+        env:
+          VERSION: ${{ github.event.inputs.version }}
+          SHA256: ${{ github.event.inputs.sha256 }}
+          APPROVAL: ${{ github.event.inputs.approval }}
+          CONFIRM: ${{ github.event.inputs.confirm }}
+          GITEA_TOKEN: ${{ secrets.RELEASE_API_TOKEN || github.token }}
+          RELEASE_SSH_KEY: ${{ secrets.CLASSROOM_UPDATES_SSH_KEY }}
+          RELEASE_SSH_KNOWN_HOSTS: ${{ vars.CLASSROOM_UPDATES_KNOWN_HOSTS }}
+          RELEASE_SSH_ADDRESS: ${{ vars.CLASSROOM_UPDATES_ADDRESS }}
+          RELEASE_SSH_USER: ${{ vars.CLASSROOM_UPDATES_USER }}
+        run: |
+          if [ "$CONFIRM" != "PROMOTE $VERSION TO STABLE" ]; then
+            echo "Confirmation must read exactly: PROMOTE $VERSION TO STABLE" >&2
+            exit 1
+          fi
+          RELEASE_CI_WORK="$RUNNER_TEMP/release" tools/release-ci.sh stable "$VERSION" "$SHA256" "$APPROVAL"