ekklesiaandClaude Opus 5.5
22f25854aa
ci.yml runs tools/check.sh and the container gate on every push and pull request, with no secrets. Release 1 builds a version from its release commit on master or release/*, gates it, and keeps it in a Gitea pre-release. Release 2 gates that file again on the CI runner and publishes it to canary (Preview) from the release runner. Release 3 promotes the file Preview ran, on a person's approval. Import records a release from before Gitea kept the record. All of it is tools/release-ci.sh calling the existing scripts. docs/releasing.md: tracks, branches, each step, immutability, rollback, secrets, runners, Nightly and the hardware lab as designs, the Gitea administration still to do, and what was measured to make it. Co-Authored-By: Claude Opus 5.5 <[email protected]>
58 lines
2.3 KiB
YAML
58 lines
2.3 KiB
YAML
# PROMOTE TO STABLE: THE FILE PREVIEW RAN, AND NOTHING ELSE.
|
|
#
|
|
# Only after a person has done the physical checks in docs/testing.md on
|
|
# real hardware and says so here. No build, no gate: stable is pointed at
|
|
# the package already on the server, and update_stable.sh refuses any
|
|
# file but the SHA-256 given. The Gitea release must already record that
|
|
# exact file going to Preview.
|
|
#
|
|
# Merging code never runs this. Nothing runs it but a person.
|
|
name: Release 3 - promote to Stable
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: 'The version on Preview to promote'
|
|
required: true
|
|
sha256:
|
|
description: 'Its SHA-256, exactly as approved'
|
|
required: true
|
|
approval:
|
|
description: 'Who approved it, when, and which physical checks passed on which machine'
|
|
required: true
|
|
confirm:
|
|
description: 'Type: PROMOTE <version> TO STABLE'
|
|
required: true
|
|
|
|
jobs:
|
|
promote:
|
|
name: promote the approved file and read it back
|
|
runs-on: ekklesia-release
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: What promoting needs
|
|
run: |
|
|
command -v ssh rsync curl python3 dpkg-deb git >/dev/null \
|
|
|| { apt-get update -qq && apt-get install -y -qq --no-install-recommends \
|
|
openssh-client rsync curl python3 dpkg git ca-certificates >/dev/null; }
|
|
|
|
- name: Promote, and record it
|
|
env:
|
|
VERSION: ${{ github.event.inputs.version }}
|
|
SHA256: ${{ github.event.inputs.sha256 }}
|
|
APPROVAL: ${{ github.event.inputs.approval }}
|
|
CONFIRM: ${{ github.event.inputs.confirm }}
|
|
GITEA_TOKEN: ${{ secrets.RELEASE_API_TOKEN || github.token }}
|
|
RELEASE_SSH_KEY: ${{ secrets.CLASSROOM_UPDATES_SSH_KEY }}
|
|
RELEASE_SSH_KNOWN_HOSTS: ${{ vars.CLASSROOM_UPDATES_KNOWN_HOSTS }}
|
|
RELEASE_SSH_ADDRESS: ${{ vars.CLASSROOM_UPDATES_ADDRESS }}
|
|
RELEASE_SSH_USER: ${{ vars.CLASSROOM_UPDATES_USER }}
|
|
run: |
|
|
if [ "$CONFIRM" != "PROMOTE $VERSION TO STABLE" ]; then
|
|
echo "Confirmation must read exactly: PROMOTE $VERSION TO STABLE" >&2
|
|
exit 1
|
|
fi
|
|
RELEASE_CI_WORK="$RUNNER_TEMP/release" tools/release-ci.sh stable "$VERSION" "$SHA256" "$APPROVAL"
|