rickub/cli · 900561e

⑂ 900561e

ci: use the marketplace actions with plain @vN tags, as a normal job wouldUnverified

Back to actions/checkout@v4, actions/setup-go@v5, actions/upload-artifact@v4
and softprops/action-gh-release@v2, and drop scripts/publish-release.sh.
These workflows are meant to read as an ordinary GitHub Actions job;
anonymous action fetches being rate-limited on the fleet is a runner
configuration matter (RICKUB_ACTIONS_GITHUB_TOKEN), documented in
RELEASING.md rather than worked around here. Keeps the GITHUB_WORKFLOW fix.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FgkcT3UPxwxukBKojB5eg4

Olivier Girardot committed 2026-09-02T21:44:32+02:00 Browse files

900561e parent: 5bbf166

modified .github/workflows/ci.yml +2 -2 Viewed

@@ -23,10 +23,10 @@ jobs:
23	23	runs-on: ubuntu-latest
24	24	steps:
25	25	- name: Checkout
26		- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
	26	+ uses: actions/checkout@v4
27	27
28	28	- name: Set up Go
29		- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
	29	+ uses: actions/setup-go@v5
30	30	with:
31	31	go-version-file: go.mod
32	32	cache: true

      runs-on: ubuntu-latest
      steps:
        - name: Checkout
--        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
++        uses: actions/checkout@v4
        - name: Set up Go
--        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
++        uses: actions/setup-go@v5
          with:
            go-version-file: go.mod
            cache: true

modified .github/workflows/rc.yml +17 -12 Viewed

@@ -26,10 +26,10 @@ jobs:
26	26	runs-on: ubuntu-latest
27	27	steps:
28	28	- name: Checkout
29		- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
	29	+ uses: actions/checkout@v4
30	30
31	31	- name: Set up Go
32		- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
	32	+ uses: actions/setup-go@v5
33	33	with:
34	34	go-version-file: go.mod
35	35	cache: true
@@ -89,7 +89,7 @@ jobs:
89	89	echo "path=${RUNNER_TEMP}/rc-notes.md" >> "$GITHUB_OUTPUT"
90	90
91	91	- name: Upload build artifacts
92		- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
	92	+ uses: actions/upload-artifact@v4
93	93	with:
94	94	name: rickub-${{ steps.version.outputs.version }}
95	95	path: dist/
@@ -97,12 +97,17 @@ jobs:
97	97	retention-days: 14
98	98
99	99	- name: Publish prerelease
100		- env:
101		- TAG: ${{ steps.version.outputs.tag }}
102		- NOTES: ${{ steps.notes.outputs.path }}
103		- # The tag does not exist yet: the release shim creates it at --target,
104		- # so CI cuts its own RC tags.
105		- run: \|
106		- bash scripts/publish-release.sh --prerelease \
107		- --tag "${TAG}" --target "${GITHUB_SHA}" --notes "${NOTES}" \
108		- dist/*.tar.gz dist/SHA256SUMS
	100	+ uses: softprops/action-gh-release@v2
	101	+ with:
	102	+ tag_name: ${{ steps.version.outputs.tag }}
	103	+ name: ${{ steps.version.outputs.tag }}
	104	+ body_path: ${{ steps.notes.outputs.path }}
	105	+ # The tag does not exist yet: the rickub release shim creates it at
	106	+ # target_commitish, so CI cuts its own RC tags.
	107	+ target_commitish: ${{ github.sha }}
	108	+ draft: false
	109	+ prerelease: true
	110	+ files: \|
	111	+ dist/*.tar.gz
	112	+ dist/SHA256SUMS
	113	+ fail_on_unmatched_files: true

      runs-on: ubuntu-latest
      steps:
        - name: Checkout
--        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
++        uses: actions/checkout@v4
        - name: Set up Go
--        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
++        uses: actions/setup-go@v5
          with:
            go-version-file: go.mod
            cache: true
            echo "path=${RUNNER_TEMP}/rc-notes.md" >> "$GITHUB_OUTPUT"
        - name: Upload build artifacts
--        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
++        uses: actions/upload-artifact@v4
          with:
            name: rickub-${{ steps.version.outputs.version }}
            path: dist/
            retention-days: 14
        - name: Publish prerelease
--        env:
++        uses: softprops/action-gh-release@v2
--          TAG: ${{ steps.version.outputs.tag }}
++        with:
--          NOTES: ${{ steps.notes.outputs.path }}
++          tag_name: ${{ steps.version.outputs.tag }}
--        # The tag does not exist yet: the release shim creates it at --target,
++          name: ${{ steps.version.outputs.tag }}
--        # so CI cuts its own RC tags.
++          body_path: ${{ steps.notes.outputs.path }}
--        run: |
++          # The tag does not exist yet: the rickub release shim creates it at
--          bash scripts/publish-release.sh --prerelease \
++          # target_commitish, so CI cuts its own RC tags.
--            --tag "${TAG}" --target "${GITHUB_SHA}" --notes "${NOTES}" \
++          target_commitish: ${{ github.sha }}
--            dist/*.tar.gz dist/SHA256SUMS
++          draft: false
++          prerelease: true
++          files: |
++            dist/*.tar.gz
++            dist/SHA256SUMS
++          fail_on_unmatched_files: true

modified .github/workflows/release.yml +17 -12 Viewed

@@ -36,7 +36,7 @@ jobs:
36	36	runs-on: ubuntu-latest
37	37	steps:
38	38	- name: Checkout
39		- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
	39	+ uses: actions/checkout@v4
40	40	with:
41	41	# Full history + tags so the "tag already exists" check is meaningful.
42	42	fetch-depth: 0
@@ -133,7 +133,7 @@ jobs:
133	133	esac
134	134
135	135	- name: Set up Go
136		- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
	136	+ uses: actions/setup-go@v5
137	137	with:
138	138	go-version-file: go.mod
139	139	cache: true
@@ -180,7 +180,7 @@ jobs:
180	180	echo "path=${RUNNER_TEMP}/release-notes.md" >> "$GITHUB_OUTPUT"
181	181
182	182	- name: Upload build artifacts
183		- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
	183	+ uses: actions/upload-artifact@v4
184	184	with:
185	185	name: rickub-${{ steps.check.outputs.version }}
186	186	path: dist/
@@ -189,15 +189,20 @@ jobs:
189	189
190	190	- name: Publish release
191	191	if: steps.check.outputs.dry_run != 'true'
192		- env:
193		- TAG: ${{ steps.check.outputs.tag }}
194		- NOTES: ${{ steps.notes.outputs.path }}
195		- # The tag does not exist yet: the release shim creates it at --target,
196		- # so the dispatched ref's commit is what gets tagged.
197		- run: \|
198		- bash scripts/publish-release.sh \
199		- --tag "${TAG}" --target "${GITHUB_SHA}" --notes "${NOTES}" \
200		- dist/*.tar.gz dist/SHA256SUMS
	192	+ uses: softprops/action-gh-release@v2
	193	+ with:
	194	+ tag_name: ${{ steps.check.outputs.tag }}
	195	+ name: ${{ steps.check.outputs.tag }}
	196	+ body_path: ${{ steps.notes.outputs.path }}
	197	+ # The tag does not exist yet: the rickub release shim creates it at
	198	+ # target_commitish, so the dispatched ref's commit is what gets tagged.
	199	+ target_commitish: ${{ github.sha }}
	200	+ draft: false
	201	+ prerelease: false
	202	+ files: \|
	203	+ dist/*.tar.gz
	204	+ dist/SHA256SUMS
	205	+ fail_on_unmatched_files: true
201	206
202	207	- name: Dry run summary
203	208	if: steps.check.outputs.dry_run == 'true'

      runs-on: ubuntu-latest
      steps:
        - name: Checkout
--        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
++        uses: actions/checkout@v4
          with:
            # Full history + tags so the "tag already exists" check is meaningful.
            fetch-depth: 0
            esac
        - name: Set up Go
--        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
++        uses: actions/setup-go@v5
          with:
            go-version-file: go.mod
            cache: true
            echo "path=${RUNNER_TEMP}/release-notes.md" >> "$GITHUB_OUTPUT"
        - name: Upload build artifacts
--        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
++        uses: actions/upload-artifact@v4
          with:
            name: rickub-${{ steps.check.outputs.version }}
            path: dist/
        - name: Publish release
          if: steps.check.outputs.dry_run != 'true'
--        env:
++        uses: softprops/action-gh-release@v2
--          TAG: ${{ steps.check.outputs.tag }}
++        with:
--          NOTES: ${{ steps.notes.outputs.path }}
++          tag_name: ${{ steps.check.outputs.tag }}
--        # The tag does not exist yet: the release shim creates it at --target,
++          name: ${{ steps.check.outputs.tag }}
--        # so the dispatched ref's commit is what gets tagged.
++          body_path: ${{ steps.notes.outputs.path }}
--        run: |
++          # The tag does not exist yet: the rickub release shim creates it at
--          bash scripts/publish-release.sh \
++          # target_commitish, so the dispatched ref's commit is what gets tagged.
--            --tag "${TAG}" --target "${GITHUB_SHA}" --notes "${NOTES}" \
++          target_commitish: ${{ github.sha }}
--            dist/*.tar.gz dist/SHA256SUMS
++          draft: false
++          prerelease: false
++          files: |
++            dist/*.tar.gz
++            dist/SHA256SUMS
++          fail_on_unmatched_files: true
        - name: Dry run summary
          if: steps.check.outputs.dry_run == 'true'

modified RELEASING.md +42 -53 Viewed

@@ -9,50 +9,40 @@ GitHub-Actions-compatible CI:
9	9	\| [`.github/workflows/rc.yml`](.github/workflows/rc.yml) \| every push to `main` \| tests, cross-compiles all four targets, publishes a prerelease `v<BASE>-rc.<run_number>` \|
10	10	\| [`.github/workflows/release.yml`](.github/workflows/release.yml) \| manual only (`workflow_dispatch`) \| tests, cross-compiles, publishes a real release `v<version>` \|
11	11
12		-Both release-producing workflows call the same two scripts,
13		-[`scripts/build-dist.sh`](scripts/build-dist.sh) to build and
14		-[`scripts/publish-release.sh`](scripts/publish-release.sh) to publish, so an RC
15		-and a real release are byte-for-byte the same pipeline with a different version
16		-stamp and the `--prerelease` flag.
	12	+Both release-producing workflows call the same script,
	13	+[`scripts/build-dist.sh`](scripts/build-dist.sh), so an RC and a real release
	14	+are byte-for-byte the same pipeline with a different version stamp.
17	15
18	16	---
19	17
20	18	## How the pipeline reaches the release API
21	19
22		-Two things about rickub's CI shape this repository's workflows; both are
23		-enforced in the files, and both bite as a failed step if forgotten.
24		-
25		-`uses:` actions are pinned to commit SHAs, not tags. The runner fetches
26		-every action from github.com. A full-SHA ref is served from the fleet's
27		-SHA-keyed action cache with no GitHub round-trip; a tag such as `@v5` first
28		-needs an anonymous `ls-remote` against github.com, which GitHub rate-limits per
29		-datacenter IP — the run then dies in "Set up Go" with
30		-`could not read Username for 'https://github.com'`. The three actions used here
31		-(`actions/checkout`, `actions/setup-go`, `actions/upload-artifact`) are pinned
32		-to the same SHAs as rickub's own `.rickub/workflows/ci.yml`, so they are always
33		-warm in that cache. When bumping one, pin the new SHA and add the `# vN`
34		-comment.
35		-
36		-**Releases are published by [`scripts/publish-release.sh`](scripts/publish-release.sh),
37		-not by a marketplace action.** It POSTs the release, then each asset, to the
38		-GitHub-compatible REST shim the job is handed as `$GITHUB_API_URL`
39		-(`…/gh`), authenticated with the per-job `GITHUB_TOKEN`. Two `curl` calls do
40		-not justify fetching `softprops/action-gh-release` (which would be a cold,
41		-rate-limited GitHub fetch), and the shim's exact contract — `target_commitish`
42		-cuts the tag, `422` on a duplicate release or asset name, `upload_url`
43		-template — is handled in one readable place. Both `rc.yml` and `release.yml`
44		-call it; a real release and a candidate differ only in `--prerelease`.
45		-
46		-Server-side requirement (rickub, not this repo). The CI guest reaches the
47		-control plane only through the node's results proxy (`web/ciproxy` in the
48		-rickub server), and `$GITHUB_API_URL` points at that proxy. The proxy must
49		-forward the `/gh/` prefix — shipped in rickub PR
50		-[ogirardot/rickub#3](https://github.com/ogirardot/rickub/pull/3) and active on a
	20	+The workflows are written as ordinary GitHub Actions jobs — `actions/checkout@v4`,
	21	+`actions/setup-go@v5`, `actions/upload-artifact@v4`,
	22	+`softprops/action-gh-release@v2` — and rickub's CI is expected to run them as
	23	+such. Two platform facts matter when a run fails before or at publishing:
	24	+
	25	+Fetching `uses:` actions. rickub's runner fetches every action from
	26	+github.com. A `@vN` tag is resolved with a `git ls-remote` against github.com;
	27	+when that call is anonymous, GitHub rate-limits it per datacenter IP and the run
	28	+dies in "Set up Go" with `could not read Username for 'https://github.com'`.
	29	+That is a fleet configuration matter, not a workflow one: the runner
	30	+authenticates those fetches when `RICKUB_ACTIONS_GITHUB_TOKEN` is set
	31	+(`web/actions/runtime/stage.go` in the rickub server). Do not work around it by
	32	+pinning SHAs here — the point of this repository's workflows is to be a normal
	33	+job.
	34	+
	35	+Publishing goes through the node's CI proxy. The CI guest reaches the
	36	+control plane only through the results proxy (`web/ciproxy` in the rickub
	37	+server), and `$GITHUB_API_URL` — what `softprops/action-gh-release` talks to —
	38	+points at that proxy with the `/gh` REST shim behind it. The proxy must forward
	39	+the `/gh/` prefix: shipped in rickub PR
	40	+[ogirardot/rickub#3](https://github.com/ogirardot/rickub/pull/3), active on a
51	41	node once its `rickub-fleetd` has been rebuilt from that change. On a node
52	42	running an older fleetd, both workflows build, test and upload their
53		-`actions/upload-artifact` bundle, then fail on the "Publish …" step with
54		-`HTTP 403 creating the release`; the archives are still downloadable from the
55		-run's artifacts, so a release can be published by hand in the meantime.
	43	+`actions/upload-artifact` bundle, then fail on the "Publish …" step with a
	44	+`403`; the archives are still downloadable from the run's artifacts, so a
	45	+release can be published by hand in the meantime.
56	46
57	47	You can rehearse the whole pipeline without publishing by dispatching
58	48	`release.yml` with `dry_run: true` — it builds, tests, verifies the tag is
@@ -87,13 +77,12 @@ Every push to `main` runs `rc.yml`:
87	77
88	78	1. `go test ./...`
89	79	2. `scripts/build-dist.sh <BASE>-rc.<run_number>`
90		-3. `scripts/publish-release.sh --prerelease …` publishes a prerelease at
91		- tag `v<BASE>-rc.<run_number>`, with the four `.tar.gz` archives and
92		- `SHA256SUMS` attached.
	80	+3. publishes a prerelease at tag `v<BASE>-rc.<run_number>`, with the four
	81	+ `.tar.gz` archives and `SHA256SUMS` attached.
93	82
94	83	The tag does not exist beforehand — the release shim creates it at
95		-`target_commitish`, which the script is given as `${{ github.sha }}`, so CI
96		-cuts its own RC tags.
	84	+`target_commitish`, which the workflow sets to `${{ github.sha }}`, so CI cuts
	85	+its own RC tags.
97	86
98	87	`concurrency: { group: rc, cancel-in-progress: true }` means only the newest
99	88	push to `main` is building at any moment; superseded RC runs are cancelled, so
@@ -124,9 +113,9 @@ The workflow then:
124	113	non-404 answer is only a warning — the git tag check is the real gate);
125	114	* runs `go vet` and `go test`;
126	115	* builds the four archives + `SHA256SUMS` via `scripts/build-dist.sh`;
127		-* runs `scripts/publish-release.sh` to publish a non-prerelease release at
128		- `v<version>`, targeting `${{ github.sha }}` — the exact commit of the ref you
129		- dispatched — so the tag is created at that commit.
	116	+* publishes a non-prerelease release at `v<version>`, targeting
	117	+ `${{ github.sha }}` — the exact commit of the ref you dispatched — so the tag
	118	+ is created at that commit.
130	119
131	120	There is no approval gate: rickub CI silently drops `environment:`, so the
132	121	permission to run this workflow is the permission to release.
@@ -209,11 +198,12 @@ leaves nothing untracked behind — `dist/` is already in `.gitignore`.
209	198
210	199	## Troubleshooting
211	200
212		-`HTTP 403 creating the release`. The node's CI proxy does not forward
213		-`/gh/` yet — see "Server-side requirement" above.
	201	+`403` publishing the release. The node's CI proxy does not forward `/gh/`
	202	+yet — see "Publishing goes through the node's CI proxy" above.
214	203
215		-`could not read Username for 'https://github.com'` in "Set up Go". A
216		-`uses:` reference is a tag, not a pinned SHA — see the pinning note above.
	204	+`could not read Username for 'https://github.com'` in "Set up Go". The
	205	+fleet is fetching actions from GitHub anonymously and got rate-limited — see
	206	+"Fetching `uses:` actions" above; the fix is on the runner, not here.
217	207
218	208	`Resource not accessible by integration` / `404` on release creation. The
219	209	`GITHUB_TOKEN` is read-only by default; the workflow must declare
@@ -224,10 +214,9 @@ or an asset with that name, already exists — the shim rejects duplicates. This
224	214	normally means a partially completed run is being retried; delete the release
225	215	(or the asset) and re-run.
226	216
227		-Editing a release via `PATCH`. The workflows never edit a release, but if
228		-you script one: the shim reads `draft` and `prerelease` unconditionally, so
229		-always send both fields in a PATCH body or you will silently flip a
230		-release to draft.
	217	+Editing a release via `PATCH`. The shim reads `draft` and `prerelease`
	218	+unconditionally, so always send both fields in a PATCH body or you will
	219	+silently flip a release to draft.
231	220
232	221	Nothing to release / `make_latest` ignored. The shim does not implement
233	222	`make_latest` or `generate_release_notes`, and there is no

  | [`.github/workflows/rc.yml`](.github/workflows/rc.yml) | every push to `main` | tests, cross-compiles all four targets, publishes a **prerelease** `v<BASE>-rc.<run_number>` |
  | [`.github/workflows/release.yml`](.github/workflows/release.yml) | **manual only** (`workflow_dispatch`) | tests, cross-compiles, publishes a real release `v<version>` |
--Both release-producing workflows call the same two scripts,
++Both release-producing workflows call the same script,
--[`scripts/build-dist.sh`](scripts/build-dist.sh) to build and
++[`scripts/build-dist.sh`](scripts/build-dist.sh), so an RC and a real release
--[`scripts/publish-release.sh`](scripts/publish-release.sh) to publish, so an RC
++are byte-for-byte the same pipeline with a different version stamp.
--and a real release are byte-for-byte the same pipeline with a different version
--stamp and the `--prerelease` flag.
  ---
  ## How the pipeline reaches the release API
--Two things about rickub's CI shape this repository's workflows; both are
++The workflows are written as ordinary GitHub Actions jobs — `actions/checkout@v4`,
--enforced in the files, and both bite as a failed step if forgotten.
++`actions/setup-go@v5`, `actions/upload-artifact@v4`,
--
++`softprops/action-gh-release@v2` — and rickub's CI is expected to run them as
--**`uses:` actions are pinned to commit SHAs, not tags.** The runner fetches
++such. Two platform facts matter when a run fails before or at publishing:
--every action from github.com. A full-SHA ref is served from the fleet's
++
--SHA-keyed action cache with no GitHub round-trip; a tag such as `@v5` first
++**Fetching `uses:` actions.** rickub's runner fetches every action from
--needs an anonymous `ls-remote` against github.com, which GitHub rate-limits per
++github.com. A `@vN` tag is resolved with a `git ls-remote` against github.com;
--datacenter IP — the run then dies in "Set up Go" with
++when that call is anonymous, GitHub rate-limits it per datacenter IP and the run
--`could not read Username for 'https://github.com'`. The three actions used here
++dies in "Set up Go" with `could not read Username for 'https://github.com'`.
--(`actions/checkout`, `actions/setup-go`, `actions/upload-artifact`) are pinned
++That is a fleet configuration matter, not a workflow one: the runner
--to the same SHAs as rickub's own `.rickub/workflows/ci.yml`, so they are always
++authenticates those fetches when `RICKUB_ACTIONS_GITHUB_TOKEN` is set
--warm in that cache. When bumping one, pin the new SHA and add the `# vN`
++(`web/actions/runtime/stage.go` in the rickub server). Do not work around it by
--comment.
++pinning SHAs here — the point of this repository's workflows is to be a normal
--
++job.
--**Releases are published by [`scripts/publish-release.sh`](scripts/publish-release.sh),
++
--not by a marketplace action.** It POSTs the release, then each asset, to the
++**Publishing goes through the node's CI proxy.** The CI guest reaches the
--GitHub-compatible REST shim the job is handed as `$GITHUB_API_URL`
++control plane only through the results proxy (`web/ciproxy` in the rickub
--(`…/gh`), authenticated with the per-job `GITHUB_TOKEN`. Two `curl` calls do
++server), and `$GITHUB_API_URL` — what `softprops/action-gh-release` talks to —
--not justify fetching `softprops/action-gh-release` (which would be a cold,
++points at that proxy with the `/gh` REST shim behind it. The proxy must forward
--rate-limited GitHub fetch), and the shim's exact contract — `target_commitish`
++the `/gh/` prefix: shipped in rickub PR
--cuts the tag, `422` on a duplicate release or asset name, `upload_url`
++[ogirardot/rickub#3](https://github.com/ogirardot/rickub/pull/3), active on a
--template — is handled in one readable place. Both `rc.yml` and `release.yml`
--call it; a real release and a candidate differ only in `--prerelease`.
--
--**Server-side requirement (rickub, not this repo).** The CI guest reaches the
--control plane only through the node's results proxy (`web/ciproxy` in the
--rickub server), and `$GITHUB_API_URL` points at that proxy. The proxy must
--forward the `/gh/` prefix — shipped in rickub PR
--[ogirardot/rickub#3](https://github.com/ogirardot/rickub/pull/3) and active on a
  node once its `rickub-fleetd` has been rebuilt from that change. On a node
  running an older fleetd, both workflows build, test and upload their
--`actions/upload-artifact` bundle, then fail on the "Publish …" step with
++`actions/upload-artifact` bundle, then fail on the "Publish …" step with a
--`HTTP 403 creating the release`; the archives are still downloadable from the
++`403`; the archives are still downloadable from the run's artifacts, so a
--run's artifacts, so a release can be published by hand in the meantime.
++release can be published by hand in the meantime.
  You can rehearse the whole pipeline without publishing by dispatching
  `release.yml` with **`dry_run: true`** — it builds, tests, verifies the tag is
 . `go test ./...`
 . `scripts/build-dist.sh <BASE>-rc.<run_number>`
--3. `scripts/publish-release.sh --prerelease …` publishes a **prerelease** at
++3. publishes a **prerelease** at tag `v<BASE>-rc.<run_number>`, with the four
--   tag `v<BASE>-rc.<run_number>`, with the four `.tar.gz` archives and
++   `.tar.gz` archives and `SHA256SUMS` attached.
--   `SHA256SUMS` attached.
  The tag does not exist beforehand — the release shim creates it at
--`target_commitish`, which the script is given as `${{ github.sha }}`, so CI
++`target_commitish`, which the workflow sets to `${{ github.sha }}`, so CI cuts
--cuts its own RC tags.
++its own RC tags.
  `concurrency: { group: rc, cancel-in-progress: true }` means only the newest
  push to `main` is building at any moment; superseded RC runs are cancelled, so
    non-404 answer is only a warning — the git tag check is the real gate);
  * runs `go vet` and `go test`;
  * builds the four archives + `SHA256SUMS` via `scripts/build-dist.sh`;
--* runs `scripts/publish-release.sh` to publish a non-prerelease release at
++* publishes a non-prerelease release at `v<version>`, targeting
--  `v<version>`, targeting `${{ github.sha }}` — the exact commit of the ref you
++  `${{ github.sha }}` — the exact commit of the ref you dispatched — so the tag
--  dispatched — so the tag is created at that commit.
++  is created at that commit.
  There is no approval gate: rickub CI silently drops `environment:`, so the
  permission to run this workflow *is* the permission to release.
  ## Troubleshooting
--**`HTTP 403 creating the release`.** The node's CI proxy does not forward
++**`403` publishing the release.** The node's CI proxy does not forward `/gh/`
--`/gh/` yet — see "Server-side requirement" above.
++yet — see "Publishing goes through the node's CI proxy" above.
--**`could not read Username for 'https://github.com'` in "Set up Go".** A
++**`could not read Username for 'https://github.com'` in "Set up Go".** The
--`uses:` reference is a tag, not a pinned SHA — see the pinning note above.
++fleet is fetching actions from GitHub anonymously and got rate-limited — see
++"Fetching `uses:` actions" above; the fix is on the runner, not here.
  **`Resource not accessible by integration` / `404` on release creation.** The
  `GITHUB_TOKEN` is read-only by default; the workflow must declare
  normally means a partially completed run is being retried; delete the release
  (or the asset) and re-run.
--**Editing a release via `PATCH`.** The workflows never edit a release, but if
++**Editing a release via `PATCH`.** The shim reads `draft` and `prerelease`
--you script one: the shim reads `draft` and `prerelease` unconditionally, so
++unconditionally, so **always send both fields** in a PATCH body or you will
--**always send both fields** in a PATCH body or you will silently flip a
++silently flip a release to draft.
--release to draft.
  **Nothing to release / `make_latest` ignored.** The shim does not implement
  `make_latest` or `generate_release_notes`, and there is no

deleted scripts/publish-release.sh +0 -110 Viewed

deleted file mode 100755
@@ -1,110 +0,0 @@
1		-#!/usr/bin/env bash
2		-#
3		-# publish-release.sh — create a release on the rickub host and attach assets,
4		-# straight against the GitHub-compatible REST shim the CI job is handed.
5		-#
6		-# Usage: scripts/publish-release.sh --tag v1.2.3 --target <sha> --notes notes.md \
7		-# [--name v1.2.3] [--prerelease] [--draft] file...
8		-#
9		-# Environment (all injected by rickub CI; set them by hand to run elsewhere):
10		-# GITHUB_API_URL shim base, e.g. http://172.30.255.1:8888/gh
11		-# GITHUB_TOKEN the per-job token (contents: write)
12		-# GITHUB_REPOSITORY owner/repo
13		-#
14		-# Why a script and not softprops/action-gh-release: rickub's runner fetches every
15		-# `uses:` action from github.com, and an action that is not already in the fleet's
16		-# SHA-keyed cache costs an anonymous GitHub fetch that github.com rate-limits per
17		-# datacenter IP. The two calls the release needs — POST the release, POST each
18		-# asset — are trivial with curl, and this way the release pipeline depends on
19		-# nothing that has to be fetched at run time. It needs curl and jq, both present
20		-# in the CI guest.
21		-
22		-set -euo pipefail
23		-
24		-usage() { sed -n '2,20p' "${BASH_SOURCE[0]}" >&2; exit 2; }
25		-
26		-tag=""; target=""; notes=""; name=""; prerelease=false; draft=false
27		-files=()
28		-while [ $# -gt 0 ]; do
29		- case "$1" in
30		- --tag) tag="$2"; shift 2 ;;
31		- --target) target="$2"; shift 2 ;;
32		- --notes) notes="$2"; shift 2 ;;
33		- --name) name="$2"; shift 2 ;;
34		- --prerelease) prerelease=true; shift ;;
35		- --draft) draft=true; shift ;;
36		- -h\|--help) usage ;;
37		- --) shift; files+=("$@"); break ;;
38		- -*) echo "publish-release.sh: unknown flag $1" >&2; usage ;;
39		- *) files+=("$1"); shift ;;
40		- esac
41		-done
42		-
43		-[ -n "${tag}" ] \|\| { echo "publish-release.sh: --tag is required" >&2; exit 2; }
44		-[ -n "${notes}" ] && [ -f "${notes}" ] \|\| { echo "publish-release.sh: --notes must name a file" >&2; exit 2; }
45		-[ "${#files[@]}" -gt 0 ] \|\| { echo "publish-release.sh: no asset files given" >&2; exit 2; }
46		-for f in "${files[@]}"; do
47		- [ -f "${f}" ] \|\| { echo "publish-release.sh: asset not found: ${f}" >&2; exit 2; }
48		-done
49		-for v in GITHUB_API_URL GITHUB_TOKEN GITHUB_REPOSITORY; do
50		- [ -n "${!v:-}" ] \|\| { echo "publish-release.sh: ${v} is not set" >&2; exit 2; }
51		-done
52		-command -v curl >/dev/null \|\| { echo "publish-release.sh: curl not found" >&2; exit 2; }
53		-command -v jq >/dev/null \|\| { echo "publish-release.sh: jq not found" >&2; exit 2; }
54		-
55		-api="${GITHUB_API_URL%/}"
56		-name="${name:-${tag}}"
57		-
58		-# Never echo the token: -H is passed through a config file, not the command line
59		-# (the guest's own process list is untrusted-code territory).
60		-auth_cfg="$(mktemp)"
61		-trap 'rm -f "${auth_cfg}"' EXIT
62		-printf 'header = "Authorization: Bearer %s"\n' "${GITHUB_TOKEN}" > "${auth_cfg}"
63		-
64		-body="$(mktemp)"
65		-trap 'rm -f "${auth_cfg}" "${body}"' EXIT
66		-
67		-# request METHOD URL [curl args...]: the response body lands in ${body}, the
68		-# HTTP status is printed (000 when curl itself failed).
69		-request() {
70		- local method="$1" url="$2"; shift 2
71		- curl -sS -o "${body}" -w '%{http_code}' -K "${auth_cfg}" \
72		- -H 'Accept: application/vnd.github+json' -X "${method}" "$@" "${url}" \|\| true
73		-}
74		-message() { jq -r '.message // .' "${body}" 2>/dev/null \|\| cat "${body}"; }
75		-
76		-echo "==> creating release ${tag} on ${GITHUB_REPOSITORY} (prerelease=${prerelease}, draft=${draft})"
77		-payload="$(jq -n \
78		- --arg tag "${tag}" --arg target "${target}" --arg name "${name}" \
79		- --rawfile body "${notes}" --argjson prerelease "${prerelease}" --argjson draft "${draft}" \
80		- '{tag_name: $tag, name: $name, body: $body, draft: $draft, prerelease: $prerelease}
81		- + (if $target == "" then {} else {target_commitish: $target} end)')"
82		-status="$(request POST "${api}/repos/${GITHUB_REPOSITORY}/releases" \
83		- -H 'Content-Type: application/json' --data-binary "${payload}")"
84		-case "${status}" in
85		- 200\|201) ;;
86		- 422) echo "::error::release ${tag} was refused (HTTP 422): $(message)"; exit 1 ;;
87		- 403) echo "::error::HTTP 403 creating the release — the node's CI proxy does not forward ${api}; see RELEASING.md"; exit 1 ;;
88		- *) echo "::error::creating release ${tag} failed (HTTP ${status}): $(message)"; exit 1 ;;
89		-esac
90		-release_id="$(jq -r '.id // empty' "${body}")"
91		-upload_url="$(jq -r '.upload_url // empty' "${body}" \| sed 's/{[^}]*}$//')"
92		-html_url="$(jq -r '.html_url // empty' "${body}")"
93		-[ -n "${release_id}" ] \|\| { echo "::error::release response carried no id: $(cat "${body}")"; exit 1; }
94		-[ -n "${upload_url}" ] \|\| { echo "::error::release response carried no upload_url: $(cat "${body}")"; exit 1; }
95		-echo " release id ${release_id}${html_url:+ — ${html_url}}"
96		-
97		-for f in "${files[@]}"; do
98		- asset="$(basename "${f}")"
99		- echo "==> uploading ${asset} ($(wc -c < "${f}" \| tr -d ' ') bytes)"
100		- encoded="$(jq -rn --arg n "${asset}" '$n\|@uri')"
101		- status="$(request POST "${upload_url}?name=${encoded}" \
102		- -H 'Content-Type: application/octet-stream' --data-binary "@${f}")"
103		- case "${status}" in
104		- 200\|201) ;;
105		- 422) echo "::error::asset ${asset} was refused (HTTP 422): $(message) — a partial earlier run? delete the release and retry"; exit 1 ;;
106		- *) echo "::error::uploading ${asset} failed (HTTP ${status}): $(message)"; exit 1 ;;
107		- esac
108		-done
109		-
110		-echo "==> published ${tag} with ${#files[@]} asset(s)"

--#!/usr/bin/env bash
--#
--# publish-release.sh — create a release on the rickub host and attach assets,
--# straight against the GitHub-compatible REST shim the CI job is handed.
--#
--# Usage:  scripts/publish-release.sh --tag v1.2.3 --target <sha> --notes notes.md \
--#             [--name v1.2.3] [--prerelease] [--draft] file...
--#
--# Environment (all injected by rickub CI; set them by hand to run elsewhere):
--#   GITHUB_API_URL     shim base, e.g. http://172.30.255.1:8888/gh
--#   GITHUB_TOKEN       the per-job token (contents: write)
--#   GITHUB_REPOSITORY  owner/repo
--#
--# Why a script and not softprops/action-gh-release: rickub's runner fetches every
--# `uses:` action from github.com, and an action that is not already in the fleet's
--# SHA-keyed cache costs an anonymous GitHub fetch that github.com rate-limits per
--# datacenter IP. The two calls the release needs — POST the release, POST each
--# asset — are trivial with curl, and this way the release pipeline depends on
--# nothing that has to be fetched at run time. It needs curl and jq, both present
--# in the CI guest.
--
--set -euo pipefail
--
--usage() { sed -n '2,20p' "${BASH_SOURCE[0]}" >&2; exit 2; }
--
--tag=""; target=""; notes=""; name=""; prerelease=false; draft=false
--files=()
--while [ $# -gt 0 ]; do
--  case "$1" in
--    --tag)        tag="$2"; shift 2 ;;
--    --target)     target="$2"; shift 2 ;;
--    --notes)      notes="$2"; shift 2 ;;
--    --name)       name="$2"; shift 2 ;;
--    --prerelease) prerelease=true; shift ;;
--    --draft)      draft=true; shift ;;
--    -h|--help)    usage ;;
--    --)           shift; files+=("$@"); break ;;
--    -*)           echo "publish-release.sh: unknown flag $1" >&2; usage ;;
--    *)            files+=("$1"); shift ;;
--  esac
--done
--
--[ -n "${tag}" ] || { echo "publish-release.sh: --tag is required" >&2; exit 2; }
--[ -n "${notes}" ] && [ -f "${notes}" ] || { echo "publish-release.sh: --notes must name a file" >&2; exit 2; }
--[ "${#files[@]}" -gt 0 ] || { echo "publish-release.sh: no asset files given" >&2; exit 2; }
--for f in "${files[@]}"; do
--  [ -f "${f}" ] || { echo "publish-release.sh: asset not found: ${f}" >&2; exit 2; }
--done
--for v in GITHUB_API_URL GITHUB_TOKEN GITHUB_REPOSITORY; do
--  [ -n "${!v:-}" ] || { echo "publish-release.sh: ${v} is not set" >&2; exit 2; }
--done
--command -v curl >/dev/null || { echo "publish-release.sh: curl not found" >&2; exit 2; }
--command -v jq   >/dev/null || { echo "publish-release.sh: jq not found" >&2; exit 2; }
--
--api="${GITHUB_API_URL%/}"
--name="${name:-${tag}}"
--
--# Never echo the token: -H is passed through a config file, not the command line
--# (the guest's own process list is untrusted-code territory).
--auth_cfg="$(mktemp)"
--trap 'rm -f "${auth_cfg}"' EXIT
--printf 'header = "Authorization: Bearer %s"\n' "${GITHUB_TOKEN}" > "${auth_cfg}"
--
--body="$(mktemp)"
--trap 'rm -f "${auth_cfg}" "${body}"' EXIT
--
--# request METHOD URL [curl args...]: the response body lands in ${body}, the
--# HTTP status is printed (000 when curl itself failed).
--request() {
--  local method="$1" url="$2"; shift 2
--  curl -sS -o "${body}" -w '%{http_code}' -K "${auth_cfg}" \
--    -H 'Accept: application/vnd.github+json' -X "${method}" "$@" "${url}" || true
--}
--message() { jq -r '.message // .' "${body}" 2>/dev/null || cat "${body}"; }
--
--echo "==> creating release ${tag} on ${GITHUB_REPOSITORY} (prerelease=${prerelease}, draft=${draft})"
--payload="$(jq -n \
--  --arg tag "${tag}" --arg target "${target}" --arg name "${name}" \
--  --rawfile body "${notes}" --argjson prerelease "${prerelease}" --argjson draft "${draft}" \
--  '{tag_name: $tag, name: $name, body: $body, draft: $draft, prerelease: $prerelease}
--   + (if $target == "" then {} else {target_commitish: $target} end)')"
--status="$(request POST "${api}/repos/${GITHUB_REPOSITORY}/releases" \
--  -H 'Content-Type: application/json' --data-binary "${payload}")"
--case "${status}" in
--  200|201) ;;
--  422) echo "::error::release ${tag} was refused (HTTP 422): $(message)"; exit 1 ;;
--  403) echo "::error::HTTP 403 creating the release — the node's CI proxy does not forward ${api}; see RELEASING.md"; exit 1 ;;
--  *)   echo "::error::creating release ${tag} failed (HTTP ${status}): $(message)"; exit 1 ;;
--esac
--release_id="$(jq -r '.id // empty' "${body}")"
--upload_url="$(jq -r '.upload_url // empty' "${body}" | sed 's/{[^}]*}$//')"
--html_url="$(jq -r '.html_url // empty' "${body}")"
--[ -n "${release_id}" ] || { echo "::error::release response carried no id: $(cat "${body}")"; exit 1; }
--[ -n "${upload_url}" ] || { echo "::error::release response carried no upload_url: $(cat "${body}")"; exit 1; }
--echo "    release id ${release_id}${html_url:+ — ${html_url}}"
--
--for f in "${files[@]}"; do
--  asset="$(basename "${f}")"
--  echo "==> uploading ${asset} ($(wc -c < "${f}" | tr -d ' ') bytes)"
--  encoded="$(jq -rn --arg n "${asset}" '$n|@uri')"
--  status="$(request POST "${upload_url}?name=${encoded}" \
--    -H 'Content-Type: application/octet-stream' --data-binary "@${f}")"
--  case "${status}" in
--    200|201) ;;
--    422) echo "::error::asset ${asset} was refused (HTTP 422): $(message) — a partial earlier run? delete the release and retry"; exit 1 ;;
--    *)   echo "::error::uploading ${asset} failed (HTTP ${status}): $(message)"; exit 1 ;;
--  esac
--done
--
--echo "==> published ${tag} with ${#files[@]} asset(s)"