v30.3-roots.1 · Commit 12: [PATCH 12/68] release: add pre-tag artifact rehearsal
contrib/roots/README.md
Before: contrib/roots/README.md · After: contrib/roots/README.md
File metadata
index 0a0ce8fab5e6a4f5f5c411aa1cb7d0f59bffa893..a56e8c5b289078d834fec8af38c172398c01d1c0 100644
Download original patch · Release notes
Diff rows 1–60 of 60. Line numbers refer to the original before/after files.
+ Added− RemovedUnmarked lines are context.
Scroll the code area horizontally to read long lines. Before is on the left; after is on the right. Unified view fits narrow screens more easily.
contrib/roots/README.md
CHANGED
|
@@ -215,12 +215,34 @@ Never force-push release tags. Preserve archival branches.
|
|
| 215 |
|
| 216 |
Release tags use the Roots form `v<core-version>-roots.<positive-integer>`;
|
| 217 |
release candidates may use `v<core-version>rc<n>-roots.<positive-integer>`.
|
| 218 |
-
Before creating or pushing a tag, run the repository checks and verify the
|
| 219 |
-
annotated tag target and ancestry:
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 220 |
|
| 221 |
```sh
|
| 222 |
release_tag=v30.3-roots.1
|
| 223 |
git check-ref-format "refs/tags/$release_tag"
|
|
|
|
|
|
|
|
|
|
| 224 |
git tag --annotate "$release_tag" -m "Bitcoin Roots $release_tag"
|
| 225 |
git rev-parse "$release_tag^{commit}"
|
| 226 |
test "$(git rev-parse "$release_tag^{commit}")" = \
|
|
@@ -232,6 +254,7 @@ Run the retained release metadata tests before pushing:
|
|
| 232 |
|
| 233 |
```sh
|
| 234 |
python3 ci/test/test_prepare_release.py
|
|
|
|
| 235 |
python3 ci/test/test_create_patch_series.py
|
| 236 |
python3 ci/test/test_sign_manifest.py
|
| 237 |
python3 ci/test/test_validate_release_tag.py
|
|
@@ -258,9 +281,15 @@ ci/release/create-patch-series.sh "$release_tag" \
|
|
| 258 |
"/tmp/bitcoin-roots-${release_tag#v}.patch"
|
| 259 |
```
|
| 260 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 261 |
Pushing the annotated tag builds Linux x86_64, Linux aarch64, macOS x86_64,
|
| 262 |
macOS arm64, and Windows x86_64 archives. The draft release also contains the
|
| 263 |
Git-am-compatible patch series and `SHA512SUMS`; `SHA512SUMS.asc` is included
|
| 264 |
when the release environment has a matching signing key configured. The
|
| 265 |
-
workflow can be dispatched manually with an existing tag to build and validate
|
| 266 |
-
the same artifacts without creating or updating a GitHub release.
|
|
|
|
|
|
| 215 |
|
| 216 |
Release tags use the Roots form `v<core-version>-roots.<positive-integer>`;
|
| 217 |
release candidates may use `v<core-version>rc<n>-roots.<positive-integer>`.
|
| 218 |
+
Before creating a permanent tag, merge the reviewed promotion so the trusted
|
| 219 |
+
workflow is present on the default branch. Then dispatch `Release artifacts`
|
| 220 |
+
with the future tag name and the full 40-hex canonical commit. Manual dispatch
|
| 221 |
+
fetches the official Core tag from the Bitcoin Core repository, verifies the
|
| 222 |
+
commit against `origin/roots/<core-version>`, creates an annotated tag only in
|
| 223 |
+
each disposable runner checkout, and builds the same five-platform artifact
|
| 224 |
+
set. It has read-only repository permissions and cannot create a GitHub
|
| 225 |
+
release. It also refuses to run if the future tag already exists remotely.
|
| 226 |
+
|
| 227 |
+
For example:
|
| 228 |
+
|
| 229 |
+
```sh
|
| 230 |
+
release_tag=v30.3-roots.1
|
| 231 |
+
release_commit=$(git rev-parse origin/roots/30.3^{commit})
|
| 232 |
+
gh workflow run release.yml --ref main \
|
| 233 |
+
-f release_tag="$release_tag" -f release_commit="$release_commit"
|
| 234 |
+
```
|
| 235 |
+
|
| 236 |
+
Download and inspect that run's five packages and patch artifact before
|
| 237 |
+
assigning the permanent version. After the rehearsal passes, fetch again and
|
| 238 |
+
verify the annotated tag target and ancestry immediately before pushing it:
|
| 239 |
|
| 240 |
```sh
|
| 241 |
release_tag=v30.3-roots.1
|
| 242 |
git check-ref-format "refs/tags/$release_tag"
|
| 243 |
+
git fetch origin roots/30.3
|
| 244 |
+
git fetch https://github.com/bitcoin/bitcoin.git \
|
| 245 |
+
refs/tags/v30.3:refs/tags/v30.3
|
| 246 |
git tag --annotate "$release_tag" -m "Bitcoin Roots $release_tag"
|
| 247 |
git rev-parse "$release_tag^{commit}"
|
| 248 |
test "$(git rev-parse "$release_tag^{commit}")" = \
|
|
|
|
| 254 |
|
| 255 |
```sh
|
| 256 |
python3 ci/test/test_prepare_release.py
|
| 257 |
+
python3 ci/test/test_prepare_release_source.py
|
| 258 |
python3 ci/test/test_create_patch_series.py
|
| 259 |
python3 ci/test/test_sign_manifest.py
|
| 260 |
python3 ci/test/test_validate_release_tag.py
|
|
|
|
| 281 |
"/tmp/bitcoin-roots-${release_tag#v}.patch"
|
| 282 |
```
|
| 283 |
|
| 284 |
+
The series contains inherited CRLF files. Apply the released mbox with
|
| 285 |
+
`git am -3 --keep-cr <bitcoin-roots-*.patch>` so Git's mail parser preserves
|
| 286 |
+
those bytes. Replay verification uses the same command and checks tree equality
|
| 287 |
+
outside `.github/**`.
|
| 288 |
+
|
| 289 |
Pushing the annotated tag builds Linux x86_64, Linux aarch64, macOS x86_64,
|
| 290 |
macOS arm64, and Windows x86_64 archives. The draft release also contains the
|
| 291 |
Git-am-compatible patch series and `SHA512SUMS`; `SHA512SUMS.asc` is included
|
| 292 |
when the release environment has a matching signing key configured. The
|
| 293 |
+
tag-triggered workflow creates a draft, not an immediately public release.
|
| 294 |
+
Independently verify the draft's archives, patch, checksums, optional signature,
|
| 295 |
+
tag target, and source tree before changing only the draft's visibility.
|