From 4a7d23c5e99d2a60d41c20798eeb43c1272b398d Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Thu, 13 Aug 2026 12:50:45 +0200 Subject: [PATCH 1/8] cfg.mk: skip sc_two_space_separator_in_usage it is not useful for crun. Signed-off-by: Giuseppe Scrivano --- cfg.mk | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/cfg.mk b/cfg.mk index ec833f91ca..adf0f3f382 100644 --- a/cfg.mk +++ b/cfg.mk @@ -15,7 +15,8 @@ local-checks-to-skip = \ sc_cast_of_x_alloc_return_value \ sc_indent \ sc_prohibit_always-defined_macros \ - sc_prohibit_gnu_make_extensions + sc_prohibit_gnu_make_extensions \ + sc_two_space_separator_in_usage sc_prohibit_sprintf: @prohibit='\ Date: Thu, 13 Aug 2026 06:41:55 +0000 Subject: [PATCH 2/8] release.sh: dedupe arch list into a single array Define the target architectures once in an ARCHES array instead of hardcoding them inline in the build loop, so future changes touch a single place. Co-Authored-By: Claude Opus 4.8 Signed-off-by: Giuseppe Scrivano --- build-aux/release.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/build-aux/release.sh b/build-aux/release.sh index 8890cefca1..7f7de82886 100755 --- a/build-aux/release.sh +++ b/build-aux/release.sh @@ -7,6 +7,8 @@ SKIP_CHECKS=${SKIP_CHECKS:-} NIX_IMAGE=${NIX_IMAGE:-docker.io/nixos/nix:2.35.1} +ARCHES=(amd64 arm64 ppc64le riscv64 s390x) + test -e Makefile && make distclean ./autogen.sh @@ -65,7 +67,7 @@ fi git_commit=$(git rev-parse HEAD) printf '/* autogenerated. */\n#ifndef GIT_VERSION\n# define GIT_VERSION "%s"\n#endif\n' "$git_commit" > .tarball-git-version.h -for ARCH in amd64 arm64 ppc64le riscv64 s390x; do +for ARCH in "${ARCHES[@]}"; do "${BUILD_CMD[@]}" "path:.#crun-static-${ARCH}" cp ./result/bin/crun "$OUTDIR/crun-$VERSION-linux-${ARCH}" rm -rf result From 4ba21dc72023eceb7392585352c781cb1179587d Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Thu, 13 Aug 2026 06:42:15 +0000 Subject: [PATCH 3/8] release.sh: check required tools up front Verify the container runtime, git, make, and gpg2 (unless SKIP_GPG) are available before starting, so a missing tool fails immediately with a clear message instead of minutes into the build. Co-Authored-By: Claude Opus 4.8 Signed-off-by: Giuseppe Scrivano --- build-aux/release.sh | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/build-aux/release.sh b/build-aux/release.sh index 7f7de82886..80482040ba 100755 --- a/build-aux/release.sh +++ b/build-aux/release.sh @@ -9,6 +9,18 @@ NIX_IMAGE=${NIX_IMAGE:-docker.io/nixos/nix:2.35.1} ARCHES=(amd64 arm64 ppc64le riscv64 s390x) +# Fail fast if a required tool is missing, before the long build starts. +REQUIRED_TOOLS=("${RUNTIME:-podman}" git make) +if test "$SKIP_GPG" = ""; then + REQUIRED_TOOLS+=(gpg2) +fi +for tool in "${REQUIRED_TOOLS[@]}"; do + if ! command -v "$tool" >/dev/null 2>&1; then + echo "required tool not found: $tool" >&2 + exit 1 + fi +done + test -e Makefile && make distclean ./autogen.sh From 5e7ae5a6ae3582b94e9064b376e755759e06cac0 Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Thu, 13 Aug 2026 06:42:34 +0000 Subject: [PATCH 4/8] release.sh: harden the NEWS version gate Match the exact release header line '* crun-$VERSION' with a fixed-string, whole-line grep instead of a substring regex that could match unrelated text, and print an actionable error when it is missing. Co-Authored-By: Claude Opus 4.8 Signed-off-by: Giuseppe Scrivano --- build-aux/release.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/build-aux/release.sh b/build-aux/release.sh index 80482040ba..866bc96dbc 100755 --- a/build-aux/release.sh +++ b/build-aux/release.sh @@ -31,7 +31,11 @@ make -j "$(nproc)" VERSION="$("$(dirname "$0")/git-version-gen" --prefix "" .)" if test "$SKIP_CHECKS" = ""; then - grep "$VERSION" NEWS + if ! grep -Fqx -- "* crun-$VERSION" NEWS; then + echo "no '* crun-$VERSION' entry found in NEWS" >&2 + echo "(add the release notes, or commit a tag if the version is '-dirty')" >&2 + exit 1 + fi fi OUTDIR=${OUTDIR:-release-$VERSION} From 1c347d4709278a6d38c483a9d74b6f9b969b0cbf Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Thu, 13 Aug 2026 06:43:34 +0000 Subject: [PATCH 5/8] release.sh: clean up generated intermediates on exit Remove the 'result' symlink dir and .tarball-git-version.h via an EXIT trap so they no longer linger after a run or a failure. OUTDIR is left in place for inspection. Co-Authored-By: Claude Opus 4.8 Signed-off-by: Giuseppe Scrivano --- build-aux/release.sh | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/build-aux/release.sh b/build-aux/release.sh index 866bc96dbc..91490d5cce 100755 --- a/build-aux/release.sh +++ b/build-aux/release.sh @@ -21,6 +21,14 @@ for tool in "${REQUIRED_TOOLS[@]}"; do fi done +# Remove generated intermediates on exit so they do not linger after a +# successful run or a failure. OUTDIR is left untouched for inspection. +cleanup() { + rm -rf result + rm -f .tarball-git-version.h +} +trap cleanup EXIT + test -e Makefile && make distclean ./autogen.sh From 027545a63ce43d3215b547f3839ba2d27ae03b66 Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Thu, 13 Aug 2026 07:18:07 +0000 Subject: [PATCH 6/8] ci: publish a draft GitHub release on tag push Add a 'release' job that reuses the existing artifact build. On a tag push it downloads the built binaries and tarballs, renames them with the version, regenerates a CHECKSUMS file, extracts the release notes from NEWS, and opens a draft GitHub release with the assets attached. It is a draft so the maintainer can add the local GPG (.asc) signatures before publishing. Co-Authored-By: Claude Opus 4.8 Signed-off-by: Giuseppe Scrivano --- .github/workflows/release.yaml | 46 ++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 41cd62a879..9da6f0e104 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -104,3 +104,49 @@ jobs: with: name: CHECKSUMS path: /tmp/artifact/CHECKSUMS + + release: + needs: artifact + if: startsWith(github.ref, 'refs/tags/') + runs-on: ubuntu-latest + permissions: + contents: write + steps: + - uses: actions/checkout@v7 + + - uses: actions/download-artifact@v7 + with: + path: artifacts + merge-multiple: true + + - name: Assemble release assets + run: | + set -ex + VERSION="${GITHUB_REF_NAME}" + mkdir -p release + for ARCH in amd64 arm64 ppc64le riscv64 s390x; do + mv "artifacts/crun-linux-${ARCH}" "release/crun-${VERSION}-linux-${ARCH}" + mv "artifacts/crun-linux-${ARCH}-disable-systemd" "release/crun-${VERSION}-linux-${ARCH}-disable-systemd" + done + mv artifacts/crun.tar.gz "release/crun-${VERSION}.tar.gz" + mv artifacts/crun.tar.zst "release/crun-${VERSION}.tar.zst" + (cd release && sha256sum -- * > CHECKSUMS) + + - name: Extract release notes from NEWS + run: | + awk -v hdr="* crun-${GITHUB_REF_NAME}" ' + $0 == hdr { capture = 1; next } + capture && /^\* crun-/ { exit } + capture { print } + ' NEWS > release-notes.md + cat release-notes.md + + - name: Create draft release + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + gh release create "${GITHUB_REF_NAME}" \ + --draft \ + --title "crun ${GITHUB_REF_NAME}" \ + --notes-file release-notes.md \ + release/* From 28ff31892792370128b778b9e258a5519118526c Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Thu, 13 Aug 2026 07:23:25 +0000 Subject: [PATCH 7/8] ci: fail the release if NEWS has no notes for the tag Guarantee the release notes come from NEWS: abort the job when the '* crun-' section is missing or empty instead of publishing a release with an empty body. Co-Authored-By: Claude Opus 4.8 Signed-off-by: Giuseppe Scrivano --- .github/workflows/release.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 9da6f0e104..f02d079323 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -139,6 +139,10 @@ jobs: capture && /^\* crun-/ { exit } capture { print } ' NEWS > release-notes.md + if ! grep -q '[^[:space:]]' release-notes.md; then + echo "no '* crun-${GITHUB_REF_NAME}' section found in NEWS" >&2 + exit 1 + fi cat release-notes.md - name: Create draft release From 504be222d9ca331f1476a1b068324ca4f4bb8636 Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Thu, 13 Aug 2026 09:19:01 +0000 Subject: [PATCH 8/8] build-aux: add download-release.sh to fetch release assets Add a helper that downloads all assets of a (draft) GitHub release into a local directory, so the maintainer can GPG-sign them before publishing. The version defaults to git-version-gen and the repository is auto-detected from the git remotes. Co-Authored-By: Claude Opus 4.8 Signed-off-by: Giuseppe Scrivano --- build-aux/download-release.sh | 37 +++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100755 build-aux/download-release.sh diff --git a/build-aux/download-release.sh b/build-aux/download-release.sh new file mode 100755 index 0000000000..4473dd8d75 --- /dev/null +++ b/build-aux/download-release.sh @@ -0,0 +1,37 @@ +#!/bin/bash + +set -euo pipefail + +# Download the assets of a (draft) GitHub release into a local directory so +# they can be signed with GPG before publishing. +# +# Usage: download-release.sh [VERSION] +# +# VERSION defaults to the version reported by git-version-gen (the current +# checkout). The repository is auto-detected from the git remotes; override +# it with REPO=owner/name. The output directory defaults to release-$VERSION +# and can be overridden with OUTDIR. + +if ! command -v gh >/dev/null 2>&1; then + echo "required tool not found: gh" >&2 + exit 1 +fi + +VERSION=${1:-} +if test "$VERSION" = ""; then + VERSION="$("$(dirname "$0")/git-version-gen" --prefix "" .)" +fi + +OUTDIR=${OUTDIR:-release-$VERSION} +mkdir -p "$OUTDIR" + +GH_ARGS=(release download "$VERSION" --dir "$OUTDIR" --clobber) +if test "${REPO:-}" != ""; then + GH_ARGS+=(--repo "$REPO") +fi + +gh "${GH_ARGS[@]}" + +echo "downloaded release $VERSION into $OUTDIR" >&2 +echo "sign the assets with, e.g.:" >&2 +echo " for i in \"$OUTDIR\"/*; do gpg2 -b --armour \"\$i\"; done" >&2