build: make-owned release lifecycle (tag, publish, unpublish, untag)#5684
Merged
norman-abramovitz merged 4 commits intoJul 23, 2026
Merged
Conversation
make now owns the full release lifecycle so any runner (human, GitHub Actions, Concourse) is a thin caller of identical targets: - make release bakes SHA256SUMS in as the final step of artifact creation, staging the cf/korifi zip into dist/release first (glue that previously lived in release.yml). Exact-version filenames so stale zips from earlier builds are never checksummed. - make stamp tag / stamp untag — create+push / delete the annotated release tag (TAG defaults to the version with build metadata stripped; TAG_REMOTE defaults to origin). - make publish — gh release create --verify-tag with assets; notes from NOTES=<file>, else the version's CHANGELOG.md section, else a pointer line; --prerelease derived from any prerelease part in the tag (dev included, unlike the old alpha|beta|rc regex — a dev tag is not a production release). DRAFT=yes for a draft. - make unpublish — delete the GitHub release + assets, echoing what will be deleted first; the tag survives for stamp untag, so a half-done rollback never orphans it. - All four honor DRYRUN=yes. gh auth comes from the environment (GH_TOKEN/GITHUB_TOKEN or gh auth login), never argv.
Consume the new make-owned release lifecycle: the cp-zip glue and the checksum step collapse into 'make release' itself, and the changelog extraction + gh release create steps become 'make publish TAG=...'. Nothing release-specific remains encoded in workflow YAML that another runner can't reuse. Also aligns validate-version's prerelease check with make publish's derivation (any '-' in the tag): previously a dev.N tag counted as a production release, which would have tagged the docker image 'latest' and triggered the production docker build. The old inline awk changelog extraction never actually worked: its range pattern (/^## ver/,/^## [0-9]/) started and ended on the same header line, so after 'sed 1d;$d' the notes were always empty and every release got the fallback line. make publish's extraction prints the section body correctly (and anchors the version so 5.0.0 does not match the 5.0.0-rc.1 header).
Reverts the any-dash prerelease derivation introduced on this branch: dev.N tags can be published as full releases (the alpha|beta|rc match in validate-version was deliberate, and plan'd behavior). make publish and release.yml now derive --prerelease the same way: an alpha/beta/rc part in the tag.
norman-abramovitz
approved these changes
Jul 23, 2026
norman-abramovitz
left a comment
norman-abramovitz
left a comment
Contributor
There was a problem hiding this comment.
LGTM - Needs more testing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes `make` own the full release lifecycle so every runner — a human at a terminal, GitHub Actions, or a future Concourse pipeline — is a thin caller of identical targets. Nothing release-specific remains encoded in workflow YAML that another runner can't reuse.
New surface
Forward path: `build` → `release cf github` → `stamp tag` → `publish`. Rollback runs in reverse — release first, so a half-done rollback never orphans the tag. All four lifecycle targets honor `DRYRUN=yes`. `gh` authenticates from the environment (`GH_TOKEN`/`GITHUB_TOKEN` or `gh auth login`) — credentials never appear on a command line. `TAG` defaults to the version with build metadata stripped (`v5.0.0-dev.142+build...` → `v5.0.0-dev.142`).
release.yml becomes a thin caller
Latent bug fixed on the way
The inline changelog extraction never worked. Its awk range `/^## ver/,/^## [0-9]/` started and ended on the same header line, so after `sed '1d;$d'` the notes were always empty and every release shipped the fallback pointer line. The extraction in `make publish` prints the section body correctly, and anchors the version so `5.0.0` doesn't match the `5.0.0-rc.1` header.
Verification
Version bumped to v5.0.0-dev.143.