release: harden release.sh and automate draft GitHub releases - #2185
Merged
Conversation
|
Ephemeral COPR build failed. @containers/packit-build please check. |
it is not useful for crun. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Define the target architectures once in an ARCHES array instead of hardcoding them inline in the build loop, so future changes touch a single place. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Verify the container runtime, git, make, and gpg2 (unless SKIP_GPG) are available before starting, so a missing tool fails immediately with a clear message instead of minutes into the build. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Match the exact release header line '* crun-$VERSION' with a fixed-string, whole-line grep instead of a substring regex that could match unrelated text, and print an actionable error when it is missing. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Remove the 'result' symlink dir and .tarball-git-version.h via an EXIT trap so they no longer linger after a run or a failure. OUTDIR is left in place for inspection. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Add a 'release' job that reuses the existing artifact build. On a tag push it downloads the built binaries and tarballs, renames them with the version, regenerates a CHECKSUMS file, extracts the release notes from NEWS, and opens a draft GitHub release with the assets attached. It is a draft so the maintainer can add the local GPG (.asc) signatures before publishing. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Guarantee the release notes come from NEWS: abort the job when the '* crun-<tag>' section is missing or empty instead of publishing a release with an empty body. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Add a helper that downloads all assets of a (draft) GitHub release into a local directory, so the maintainer can GPG-sign them before publishing. The version defaults to git-version-gen and the repository is auto-detected from the git remotes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
giuseppe
force-pushed
the
improve-release-script
branch
from
August 13, 2026 10:51
88168c8 to
504be22
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
Improves the release process in small, self-contained steps.
build-aux/release.shARCHESarray.git,make, andgpg2unlessSKIP_GPG) so a missing tool fails fast with a clear message instead of minutes into the build.* crun-$VERSIONheader line instead of a substring regex, with an actionable error.result/,.tarball-git-version.h) via an EXIT trap;OUTDIRis left in place for inspection.CI (
.github/workflows/release.yaml)releasejob that reuses the existing artifact build. On a tag push it downloads the built binaries/tarballs, renames them with the version, regeneratesCHECKSUMS, extracts the release notes fromNEWS, and opens a draft GitHub release with the assets attached.NEWShas no* crun-<tag>section, so a release is never published with an empty body..asc) signatures before publishing. Normal pushes/PRs are unaffected.build-aux/download-release.shgit-version-gen; the repo is auto-detected from git remotes.@kolyshkin this should simplify the task of making a release, the only task left to run locally is signing the artifacts.