v30.3-roots.1 · Commit 62: [PATCH 62/68] fix(release): create drafts from reviewed immutable assets
ci/release/README.md
Before: ci/release/README.md · After: ci/release/README.md
File metadata
index bdb57d69bdd4d9baccc2583202c93b0e2e03e24f..6fac0115d61b93777f982345a85a7c269bb4842b 100644
Download original patch · Release notes
Diff rows 1–65 of 65. Line numbers refer to the original before/after files.
+ Added− RemovedUnmarked lines are context.
Scroll the code area horizontally to read long lines. The two line-number columns refer to before and after.
ci/release/README.md
CHANGED
|
@@ -2,10 +2,11 @@
|
|
|
2
2
|
|
|
3
3
|
Platform build artifacts are intermediate packages. A green build proves the
|
|
4
4
|
built product, but its package must also pass notice assembly before becoming a
|
|
5
|
-
release asset. The workflow's draft job runs `prepare-release.sh` before signing
|
|
6
|
-
or uploading anything. It fails closed if the downloaded packages lack valid
|
|
7
|
-
platform-specific notices. Automatic discovery or acquisition of dependency
|
|
8
|
-
notice inputs is not part of release execution.
|
|
5
|
+
release asset. `release.yml` is a read-only `workflow_dispatch` build/rehearsal;
|
|
6
|
+
permanent tag pushes do not start builds or create a draft. Maintainers explicitly
|
|
7
|
+
assemble reviewed platform notices, validate the final packet and use the draft
|
|
8
|
+
helper below. Unassembled packages are rejected before upload. Automatic discovery
|
|
9
|
+
or acquisition of dependency notice inputs is not part of release execution.
|
|
9
10
|
|
|
10
11
|
The supported assembly interface uses explicitly reviewed inputs:
|
|
11
12
|
|
|
@@ -66,3 +67,50 @@ source correction requires a reviewed source/portable-patch reconciliation;
|
|
|
66
67
|
it does not turn an old run into a build of the new commit. Signing, permanent
|
|
67
68
|
tagging and publication remain separate reviewed actions. These checks verify
|
|
68
69
|
notice contents and provenance, not general legal compliance.
|
|
70
|
+
|
|
71
|
+
## Immutable reviewed-assets draft
|
|
72
|
+
|
|
73
|
+
Complete source review, canonical/main integration and asset review first.
|
|
74
|
+
Authorize the exact annotated tag target and push only that tag; no tag-triggered
|
|
75
|
+
build or draft job runs. The canonical tip must remain unchanged. Release assets
|
|
76
|
+
must be outside the clean tagged source checkout and contain exactly the five
|
|
77
|
+
platform archives, `bitcoin-roots-<version>.patch` and `SHA512SUMS`. Record the
|
|
78
|
+
manifest's SHA512 digest and curated notes' SHA256 digest in the review; passing
|
|
79
|
+
newly calculated digests is not a substitute for acceptance of those bytes.
|
|
80
|
+
|
|
81
|
+
From the clean checkout at the approved commit, validate the complete handoff:
|
|
82
|
+
|
|
83
|
+
```sh
|
|
84
|
+
python3 ci/release/create-draft.py \
|
|
85
|
+
--tag v30.3-roots.1 --commit <approved-40-hex-commit> \
|
|
86
|
+
--repository LuganoPlanB/bitcoin-roots \
|
|
87
|
+
--assets /absolute/path/to/reviewed-release-assets \
|
|
88
|
+
--notes /absolute/path/to/reviewed-release-notes.md \
|
|
89
|
+
--manifest-sha512 <reviewed-128-hex-digest> \
|
|
90
|
+
--notes-sha256 <reviewed-64-hex-digest>
|
|
91
|
+
```
|
|
92
|
+
|
|
93
|
+
The default validates without a remote write. After explicit draft authority,
|
|
94
|
+
repeat the same command with `--create-draft`. The helper copies the exact packet
|
|
95
|
+
and notes into a private temporary snapshot, verifies all six checksums, archive
|
|
96
|
+
roots/COPYING/platform notice indexes, local annotated tag/source/linear ancestry,
|
|
97
|
+
and the exact portable patch regenerated and replayed from that tag. It then
|
|
98
|
+
refreshes remote canonical/tag object/peeled identities and checks every page of
|
|
99
|
+
the release inventory. Network/API failure or any existing draft/public release
|
|
100
|
+
blocks creation. The only write is `gh release create --draft --verify-tag` with
|
|
101
|
+
those seven immutable assets and the reviewed notes; it never updates, clobbers
|
|
102
|
+
or publishes an existing release. An interrupted upload requires independent
|
|
103
|
+
inspection of its partial draft, not an automatic helper retry or replacement.
|
|
104
|
+
|
|
105
|
+
This initial handoff accepts unsigned manifests only. `SHA512SUMS.asc` or any
|
|
106
|
+
unexpected file is rejected. Do not infer signing from the inherited public-key
|
|
107
|
+
comment in SHA512SUMS. Optional use of `sign-manifest.sh` remains a separate
|
|
108
|
+
signing operation, with signed-packet upload requiring its own reviewed path;
|
|
109
|
+
never access signing secrets for unsigned draft creation. State the actual Git
|
|
110
|
+
tag, manifest and platform-code signature status in the notes.
|
|
111
|
+
|
|
112
|
+
Independently download and verify the newly created draft, including notes and
|
|
113
|
+
contributor credit, before separately authorized visibility-only publication.
|
|
114
|
+
After publication verify all public assets unauthenticated. The helper requires
|
|
115
|
+
canonical-tip equality before draft creation; later consumer verification uses
|
|
116
|
+
the immutable release tag when the canonical branch has advanced.
|