v29.4-roots.2 · Commit 12: [PATCH 12/21] release: add pre-tag artifact rehearsal
contrib/roots/README.md
Before: contrib/roots/README.md · After: contrib/roots/README.md
File metadata
index e7a56e2af192e601ca5b7728564639ccb4cbe88f..f4e927306c09392e9dcc491ed74646b276bf3a72 100644
Download original patch · Release notes
Diff rows 1–60 of 60. Line numbers refer to the original before/after files.
+ Added− RemovedUnmarked lines are context.
Scroll the code area horizontally to read long lines. The two line-number columns refer to before and after.
contrib/roots/README.md
CHANGED
|
@@ -215,12 +215,34 @@ Never force-push release tags. Preserve archival branches.
|
|
|
215
215
|
|
|
216
216
|
Release tags use the Roots form `v<core-version>-roots.<positive-integer>`;
|
|
217
217
|
release candidates may use `v<core-version>rc<n>-roots.<positive-integer>`.
|
|
218
|
-
Before creating or pushing a tag, run the repository checks and verify the
|
|
219
|
-
annotated tag target and ancestry:
|
|
218
|
+
Before creating a permanent tag, merge the reviewed promotion so the trusted
|
|
219
|
+
workflow is present on the default branch. Then dispatch `Release artifacts`
|
|
220
|
+
with the future tag name and the full 40-hex canonical commit. Manual dispatch
|
|
221
|
+
fetches the official Core tag from the Bitcoin Core repository, verifies the
|
|
222
|
+
commit against `origin/roots/<core-version>`, creates an annotated tag only in
|
|
223
|
+
each disposable runner checkout, and builds the same five-platform artifact
|
|
224
|
+
set. It has read-only repository permissions and cannot create a GitHub
|
|
225
|
+
release. It also refuses to run if the future tag already exists remotely.
|
|
226
|
+
|
|
227
|
+
For example:
|
|
228
|
+
|
|
229
|
+
```sh
|
|
230
|
+
release_tag=v29.4-roots.1
|
|
231
|
+
release_commit=$(git rev-parse origin/roots/29.4^{commit})
|
|
232
|
+
gh workflow run release.yml --ref main \
|
|
233
|
+
-f release_tag="$release_tag" -f release_commit="$release_commit"
|
|
234
|
+
```
|
|
235
|
+
|
|
236
|
+
Download and inspect that run's five packages and patch artifact before
|
|
237
|
+
assigning the permanent version. After the rehearsal passes, fetch again and
|
|
238
|
+
verify the annotated tag target and ancestry immediately before pushing it:
|
|
220
239
|
|
|
221
240
|
```sh
|
|
222
241
|
release_tag=v29.4-roots.1
|
|
223
242
|
git check-ref-format "refs/tags/$release_tag"
|
|
243
|
+
git fetch origin roots/29.4
|
|
244
|
+
git fetch https://github.com/bitcoin/bitcoin.git \
|
|
245
|
+
refs/tags/v29.4:refs/tags/v29.4
|
|
224
246
|
git tag --annotate "$release_tag" -m "Bitcoin Roots $release_tag"
|
|
225
247
|
git rev-parse "$release_tag^{commit}"
|
|
226
248
|
test "$(git rev-parse "$release_tag^{commit}")" = \
|
|
@@ -232,6 +254,7 @@ Run the retained release metadata tests before pushing:
|
|
|
232
254
|
|
|
233
255
|
```sh
|
|
234
256
|
python3 ci/test/test_prepare_release.py
|
|
257
|
+
python3 ci/test/test_prepare_release_source.py
|
|
235
258
|
python3 ci/test/test_create_patch_series.py
|
|
236
259
|
python3 ci/test/test_sign_manifest.py
|
|
237
260
|
python3 ci/test/test_validate_release_tag.py
|
|
@@ -258,9 +281,15 @@ ci/release/create-patch-series.sh "$release_tag" \
|
|
|
258
281
|
"/tmp/bitcoin-roots-${release_tag#v}.patch"
|
|
259
282
|
```
|
|
260
283
|
|
|
284
|
+
The series contains inherited CRLF files. Apply the released mbox with
|
|
285
|
+
`git am -3 --keep-cr <bitcoin-roots-*.patch>` so Git's mail parser preserves
|
|
286
|
+
those bytes. Replay verification uses the same command and checks tree equality
|
|
287
|
+
outside `.github/**`.
|
|
288
|
+
|
|
261
289
|
Pushing the annotated tag builds Linux x86_64, Linux aarch64, macOS x86_64,
|
|
262
290
|
macOS arm64, and Windows x86_64 archives. The draft release also contains the
|
|
263
291
|
Git-am-compatible patch series and `SHA512SUMS`; `SHA512SUMS.asc` is included
|
|
264
292
|
when the release environment has a matching signing key configured. The
|
|
265
|
-
workflow can be dispatched manually with an existing tag to build and validate
|
|
266
|
-
the same artifacts without creating or updating a GitHub release.
|
|
293
|
+
tag-triggered workflow creates a draft, not an immediately public release.
|
|
294
|
+
Independently verify the draft's archives, patch, checksums, optional signature,
|
|
295
|
+
tag target, and source tree before changing only the draft's visibility.
|