Claude
04006bff12
v4.0.0-alpha.1's release run (196) was killed in the proofs: release.yml's full `make init` fetched Isabelle into the workspace and pointed isabelle at it, without the image's prebuilt HOL-Library, so the proofs built it from scratch. Nothing was published. Ruled: the tag stays; release.yml runs `init INIT_PROOFS=0`; LITHOS_VERSION 4.0.0-alpha.2, the first published alpha. FABRIC-3.md XLVII.5, CHANGELOG. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2
103 lines
4.1 KiB
YAML
103 lines
4.1 KiB
YAML
# A release: pushing a tag v<version> builds that commit exactly as the nightly does -- the
|
|
# acceptance protocol, the proofs, the board images -- and the documents, and publishes both to
|
|
# starshipos-releases at that version:
|
|
#
|
|
# org.starship:kernelImage:<version> classifiers pc, raspi5, milkv, logs (nightly.yml)
|
|
# org.starship:documentation:<version> classifiers book, vol1, vol2, vol3, api (nightly-docs.yml)
|
|
#
|
|
# The tag must name the version the tree says it is: v<LITHOS_VERSION> (kernel/Makefile). A tag
|
|
# that does not is refused before anything is built. A release repository takes a version once.
|
|
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
|
|
concurrency:
|
|
group: qemu # every workflow shares this one group: one run at a time,
|
|
# a runner-image rebuild included (Captain Bob, 2026-11-07)
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
release:
|
|
name: Release ${{ github.ref_name }}
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: gitea.starshipos-f18.org/rajames/lithosananke-runner:4f675c8b75b2 # ci/runner-image (#120)
|
|
credentials: # the registry refuses anonymous pulls
|
|
username: rajames
|
|
password: ${{ secrets.PACKAGES_TOKEN }}
|
|
timeout-minutes: 240
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
lfs: false
|
|
|
|
- name: The capsule-signing key
|
|
env:
|
|
KEY: ${{ secrets.CAPSULE_SIGN_KEY }}
|
|
run: | # ci/pki/make-ca.sh; kernel/Makefile signs with SIGN_KEY
|
|
if [ -n "$KEY" ]; then
|
|
f="${RUNNER_TEMP:-/tmp}/capsule-signing.key"
|
|
(umask 077; printf '%s\n' "$KEY" > "$f")
|
|
echo "SIGN_KEY=$f" >> "$GITHUB_ENV"; echo "The capsules will be signed."
|
|
else
|
|
echo "::warning::No CAPSULE_SIGN_KEY secret: the capsules are built unsigned."
|
|
fi
|
|
|
|
- name: The tag names the tree's version
|
|
run: |
|
|
tree="v$(sed -n 's/^LITHOS_VERSION *?= *//p' kernel/Makefile)"
|
|
echo "tag ${{ github.ref_name }}, kernel/Makefile LITHOS_VERSION -> $tree"
|
|
[ "${{ github.ref_name }}" = "$tree" ] || { echo "The tag must be $tree, or LITHOS_VERSION changed first."; exit 1; }
|
|
echo "NIGHTLY_VERSION=${tree#v}" >> "$GITHUB_ENV"
|
|
|
|
- name: Install the dependencies
|
|
# INIT_PROOFS=0: the image's Isabelle has HOL-Library prebuilt; a full init would fetch a fresh
|
|
# Isabelle into the workspace and point isabelle at it, and the proofs would build HOL-Library
|
|
# from scratch -- killed (release run 196, v4.0.0-alpha.1)
|
|
run: make ARCH=amd64,aarch64,riscv64 init INIT_PROOFS=0 # the image has all but the documents' packages
|
|
|
|
- name: Acceptance amd64
|
|
run: scripts/nightly.sh accept amd64
|
|
- name: Acceptance aarch64
|
|
run: scripts/nightly.sh accept aarch64
|
|
- name: Acceptance riscv64
|
|
run: scripts/nightly.sh accept riscv64
|
|
- name: Acceptance PC stick loaded high
|
|
run: scripts/nightly.sh accept stick-high
|
|
- name: Acceptance 32-bit build
|
|
run: scripts/nightly.sh test-32
|
|
- name: Isabelle/HOL proofs
|
|
run: scripts/nightly.sh proofs
|
|
- name: Images
|
|
run: scripts/nightly.sh images
|
|
- name: Documents
|
|
run: scripts/nightly.sh docs
|
|
|
|
- name: Publish to Nexus
|
|
env:
|
|
NEXUS_USER: ci-publisher
|
|
NEXUS_PASSWORD: ${{ secrets.NEXUS_CI_PASSWORD }}
|
|
run: |
|
|
scripts/nightly.sh publish https://nexus.starshipos-f18.org/repository/starshipos-releases
|
|
scripts/nightly.sh publish-docs https://nexus.starshipos-f18.org/repository/starshipos-releases
|
|
|
|
- name: Keep the release
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: release-${{ github.ref_name }}
|
|
path: |
|
|
build/nightly/
|
|
build/nightly-docs/
|
|
|
|
- name: Keep the logs and DoE CSVs
|
|
if: always()
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: release-logs-${{ github.ref_name }}
|
|
path: |
|
|
logs/
|
|
experiments/bare_metal/runs/
|