Native releases: plain X.Y.Z tags from 3.0, and a GitHub Release per release

.github/workflows/native-github-release.yml

@@ -0,0 +1,74 @@
+name: Native GitHub Release
+
+# Creates the GitHub Release for a native release tag after its
+# native-release.yml run has published the image (Server #325). That run is
+# dispatched from the tag's own ref and holds no contents: write; this one
+# runs only from protected main, in the main-only github-release
+# Environment, and verifies what the run published before it writes:
+# the tag's commit is on main, the run is native-release.yml dispatched from
+# that tag at that commit and succeeded, both registries' exact version tags
+# name one index, and that index's build provenance was signed by
+# native-release.yml from the tag's ref at its commit in that run.
+#
+# The Release is titled with the plain version. A candidate is a prerelease;
+# a final release is Latest only when the live latest alias names its index
+# in both registries. The job holds the rolling-alias lock, so no alias
+# moves between that read and the write. An existing Release is left as it
+# is.
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Published native release tag: X.Y.Z or X.Y.Z-rc.N from major 3, or a historical native-<version>'
+        required: true
+        type: string
+      release_run_id:
+        description: 'Id of the successful native-release.yml run that published it'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+env:
+  DOCKERHUB_IMAGE: durableworkflow/server
+  GHCR_IMAGE: ghcr.io/durable-workflow/server
+
+jobs:
+  release:
+    name: Create the GitHub Release
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    environment: github-release
+    concurrency:
+      group: durable-workflow-server-rolling-aliases
+      cancel-in-progress: false
+    permissions:
+      contents: write
+      packages: read
+      actions: read
+      attestations: read
+    steps:
+      - name: Check out trusted release tooling
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4
+
+      - name: Log in to GHCR
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Verify the published release and create its GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.tag }}
+          RELEASE_RUN_ID: ${{ inputs.release_run_id }}
+        run: bash scripts/ci/native-release-github-release.sh

.github/workflows/native-release.yml

@@ -1,9 +1,13 @@
 name: Native release candidate
 
-# Publishes the native (Rust) server image for an existing immutable native
-# Git tag, native-<version> (Server #325). A native- tag never matches the PHP
-# Release workflow's tag filter, so it starts no PHP release; the image tag is
-# the version without the prefix. Each architecture builds on its own runner and pushes by
+# Publishes the native (Rust) server image for an existing immutable Git tag:
+# a plain X.Y.Z (or X.Y.Z-rc.N) from major 3, or a native-<version> tag from
+# before plain tags (Server #325). PHP Server releases are 2.x and earlier, and
+# the PHP Release workflow refuses any other tag, so a native tag never starts
+# a PHP release; the image tag is the version without any native- prefix.
+# Its GitHub Release is created afterwards from protected main by
+# native-github-release.yml, which verifies what this run published; this
+# workflow holds no contents: write. Each architecture builds on its own runner and pushes by
 # digest only; that exact digest is pulled back and smoke-tested there, so a
 # failed smoke leaves no tag. The publish job then refuses tags that already
 # exist, gives both smoked digests
@@ -41,7 +45,7 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Existing immutable native Git tag, native-<version> (for example native-2.12.0-rc.1); the image tag drops native-'
+        description: 'Existing immutable native Git tag: X.Y.Z or X.Y.Z-rc.N from major 3 (for example 3.0.2), or a historical native-<version>; the image tag drops native-'
         required: true
       release_commit:
         description: 'Full source commit of that tag'
@@ -68,6 +72,7 @@ jobs:
     outputs:
       dockerhub: ${{ steps.plan.outputs.dockerhub }}
       version: ${{ steps.plan.outputs.version }}
+      tag_prefix: ${{ steps.plan.outputs.tag_prefix }}
     steps:
       - name: Check out trusted release tooling
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
@@ -90,10 +95,16 @@ jobs:
           RELEASE_TAG: ${{ inputs.tag }}
         run: |
           set -euo pipefail
-          [[ "$RELEASE_TAG" =~ ^native-[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$ ]] \
-            || { echo 'tag must be native-X.Y.Z or native-X.Y.Z-rc.N' >&2; exit 1; }
+          # Plain X.Y.Z from major 3, above every PHP release; native- names
+          # the releases tagged before plain tags.
+          if ! [[ "$RELEASE_TAG" =~ ^(native-[0-9]+|[3-9]|[1-9][0-9]+)\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$ ]]; then
+            echo 'tag must be X.Y.Z or X.Y.Z-rc.N from major 3, or native-X.Y.Z(-rc.N)' >&2
+            exit 1
+          fi
           echo dockerhub=true >> "$GITHUB_OUTPUT"
           echo "version=${RELEASE_TAG#native-}" >> "$GITHUB_OUTPUT"
+          if [[ "$RELEASE_TAG" == native-* ]]; then prefix=native-; else prefix=; fi
+          echo "tag_prefix=$prefix" >> "$GITHUB_OUTPUT"
 
   build-amd64:
     name: Build and smoke linux/amd64
@@ -126,7 +137,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ inputs.tag }}
-          RELEASE_TAG_PREFIX: native-
+          RELEASE_TAG_PREFIX: ${{ needs.plan.outputs.tag_prefix }}
           RELEASE_COMMIT: ${{ inputs.release_commit }}
         run: |
           set -euo pipefail
@@ -219,7 +230,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ inputs.tag }}
-          RELEASE_TAG_PREFIX: native-
+          RELEASE_TAG_PREFIX: ${{ needs.plan.outputs.tag_prefix }}
           RELEASE_COMMIT: ${{ inputs.release_commit }}
         run: |
           set -euo pipefail

.github/workflows/release.yml

@@ -3,9 +3,11 @@ name: Release
 run-name: Release ${{ inputs.tag || github.ref_name }} at ${{ inputs.release_commit || github.sha }}
 
 on:
+  # PHP Server releases are 2.x and earlier; plain tags from 3.0 are native
+  # releases (native-release.yml).
   push:
     tags:
-      - '[0-9]+.[0-9]+.[0-9]+*'
+      - '[0-2].[0-9]+.[0-9]+*'
   workflow_dispatch:
     inputs:
       tag:
@@ -56,6 +58,18 @@ jobs:
       exact_publish_outcome: ${{ steps.exact.outputs.exact_publish_outcome }}
       published_database_tls_outcome: ${{ steps.published_database_tls.outcome }}
     steps:
+      - name: Refuse a native release tag
+        env:
+          REQUESTED_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
+        run: |
+          set -euo pipefail
+          # Pushed or dispatched, a PHP release is 2.x or earlier. A 3.x (or
+          # later) or native- tag belongs to native-release.yml.
+          if ! [[ "$REQUESTED_TAG" =~ ^[0-2]\.[0-9]+\.[0-9]+ ]]; then
+            printf 'tag %s is not a PHP Server release (2.x or earlier)\n' "$REQUESTED_TAG" >&2
+            exit 1
+          fi
+
       - name: Check out trusted release tooling
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
         with: