v30.3-roots.1 · Commit 62: [PATCH 62/68] fix(release): create drafts from reviewed immutable assets
ci/release/README.md
Before: ci/release/README.md · After: ci/release/README.md
File metadata
index bdb57d69bdd4d9baccc2583202c93b0e2e03e24f..6fac0115d61b93777f982345a85a7c269bb4842b 100644
Download original patch · Release notes
Diff rows 1–65 of 65. Line numbers refer to the original before/after files.
+ Added− RemovedUnmarked lines are context.
Scroll the code area horizontally to read long lines. Before is on the left; after is on the right. Unified view fits narrow screens more easily.
ci/release/README.md
CHANGED
|
@@ -2,10 +2,11 @@
|
|
| 2 |
|
| 3 |
Platform build artifacts are intermediate packages. A green build proves the
|
| 4 |
built product, but its package must also pass notice assembly before becoming a
|
| 5 |
-
release asset. The workflow's draft job runs `prepare-release.sh` before signing
|
| 6 |
-
or uploading anything. It fails closed if the downloaded packages lack valid
|
| 7 |
-
platform-specific notices. Automatic discovery or acquisition of dependency
|
| 8 |
-
notice inputs is not part of release execution.
|
|
|
|
| 9 |
|
| 10 |
The supported assembly interface uses explicitly reviewed inputs:
|
| 11 |
|
|
@@ -66,3 +67,50 @@ source correction requires a reviewed source/portable-patch reconciliation;
|
|
| 66 |
it does not turn an old run into a build of the new commit. Signing, permanent
|
| 67 |
tagging and publication remain separate reviewed actions. These checks verify
|
| 68 |
notice contents and provenance, not general legal compliance.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 2 |
|
| 3 |
Platform build artifacts are intermediate packages. A green build proves the
|
| 4 |
built product, but its package must also pass notice assembly before becoming a
|
| 5 |
+
release asset. `release.yml` is a read-only `workflow_dispatch` build/rehearsal;
|
| 6 |
+
permanent tag pushes do not start builds or create a draft. Maintainers explicitly
|
| 7 |
+
assemble reviewed platform notices, validate the final packet and use the draft
|
| 8 |
+
helper below. Unassembled packages are rejected before upload. Automatic discovery
|
| 9 |
+
or acquisition of dependency notice inputs is not part of release execution.
|
| 10 |
|
| 11 |
The supported assembly interface uses explicitly reviewed inputs:
|
| 12 |
|
|
|
|
| 67 |
it does not turn an old run into a build of the new commit. Signing, permanent
|
| 68 |
tagging and publication remain separate reviewed actions. These checks verify
|
| 69 |
notice contents and provenance, not general legal compliance.
|
| 70 |
+
|
| 71 |
+
## Immutable reviewed-assets draft
|
| 72 |
+
|
| 73 |
+
Complete source review, canonical/main integration and asset review first.
|
| 74 |
+
Authorize the exact annotated tag target and push only that tag; no tag-triggered
|
| 75 |
+
build or draft job runs. The canonical tip must remain unchanged. Release assets
|
| 76 |
+
must be outside the clean tagged source checkout and contain exactly the five
|
| 77 |
+
platform archives, `bitcoin-roots-<version>.patch` and `SHA512SUMS`. Record the
|
| 78 |
+
manifest's SHA512 digest and curated notes' SHA256 digest in the review; passing
|
| 79 |
+
newly calculated digests is not a substitute for acceptance of those bytes.
|
| 80 |
+
|
| 81 |
+
From the clean checkout at the approved commit, validate the complete handoff:
|
| 82 |
+
|
| 83 |
+
```sh
|
| 84 |
+
python3 ci/release/create-draft.py \
|
| 85 |
+
--tag v30.3-roots.1 --commit <approved-40-hex-commit> \
|
| 86 |
+
--repository LuganoPlanB/bitcoin-roots \
|
| 87 |
+
--assets /absolute/path/to/reviewed-release-assets \
|
| 88 |
+
--notes /absolute/path/to/reviewed-release-notes.md \
|
| 89 |
+
--manifest-sha512 <reviewed-128-hex-digest> \
|
| 90 |
+
--notes-sha256 <reviewed-64-hex-digest>
|
| 91 |
+
```
|
| 92 |
+
|
| 93 |
+
The default validates without a remote write. After explicit draft authority,
|
| 94 |
+
repeat the same command with `--create-draft`. The helper copies the exact packet
|
| 95 |
+
and notes into a private temporary snapshot, verifies all six checksums, archive
|
| 96 |
+
roots/COPYING/platform notice indexes, local annotated tag/source/linear ancestry,
|
| 97 |
+
and the exact portable patch regenerated and replayed from that tag. It then
|
| 98 |
+
refreshes remote canonical/tag object/peeled identities and checks every page of
|
| 99 |
+
the release inventory. Network/API failure or any existing draft/public release
|
| 100 |
+
blocks creation. The only write is `gh release create --draft --verify-tag` with
|
| 101 |
+
those seven immutable assets and the reviewed notes; it never updates, clobbers
|
| 102 |
+
or publishes an existing release. An interrupted upload requires independent
|
| 103 |
+
inspection of its partial draft, not an automatic helper retry or replacement.
|
| 104 |
+
|
| 105 |
+
This initial handoff accepts unsigned manifests only. `SHA512SUMS.asc` or any
|
| 106 |
+
unexpected file is rejected. Do not infer signing from the inherited public-key
|
| 107 |
+
comment in SHA512SUMS. Optional use of `sign-manifest.sh` remains a separate
|
| 108 |
+
signing operation, with signed-packet upload requiring its own reviewed path;
|
| 109 |
+
never access signing secrets for unsigned draft creation. State the actual Git
|
| 110 |
+
tag, manifest and platform-code signature status in the notes.
|
| 111 |
+
|
| 112 |
+
Independently download and verify the newly created draft, including notes and
|
| 113 |
+
contributor credit, before separately authorized visibility-only publication.
|
| 114 |
+
After publication verify all public assets unauthenticated. The helper requires
|
| 115 |
+
canonical-tip equality before draft creation; later consumer verification uses
|
| 116 |
+
the immutable release tag when the canonical branch has advanced.
|