From be20f20f72a7c3b6f4f4f989a976f4a062879a3b Mon Sep 17 00:00:00 2001
From: RoyalOughtness <129108030+RoyalOughtness@users.noreply.github.com>
Date: Wed, 8 Jul 2026 11:59:29 -0700
Subject: [PATCH 1/5] fixes

---
 .github/workflows/kernel-build.yml | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/kernel-build.yml b/.github/workflows/kernel-build.yml
index 741edf1..d019e97 100644
--- a/.github/workflows/kernel-build.yml
+++ b/.github/workflows/kernel-build.yml
@@ -9,11 +9,12 @@ concurrency:
   group: kernel-build
   cancel-in-progress: false
 
-permissions: {}
+permissions: # See VARS_TOKEN note
+  contents: write
 
 env:
   GH_REPO: ${{ github.repository }}
-  GH_TOKEN: ${{ secrets.VARS_TOKEN }}
+  GH_TOKEN: ${{ secrets.VARS_TOKEN }} # has Environments RW
 
 jobs:
   kernel-build:
@@ -73,7 +74,17 @@ jobs:
           SECUREBLUE_BUILDID_VERSION: ${{ steps.calculate_buildid.outputs.secureblue_buildid_version }}
           COPR_WEBHOOK_URL: ${{ secrets.COPR_WEBHOOK_URL }}
         run: |
+          payload=$(jq -cn --arg buildid_version "${SECUREBLUE_BUILDID_VERSION}" '{"secureblue_buildid_version": $buildid_version | tonumber}')
           gh variable set UPSTREAM_KERNEL_VERSION --env Build --body "${CURRENT_UPSTREAM_VERSION_PLUS_RELEASE}"
           gh variable set SECUREBLUE_BUILDID_VERSION --env Build --body "${SECUREBLUE_BUILDID_VERSION}"
-          payload=$(jq -cn --arg buildid_version "${SECUREBLUE_BUILDID_VERSION}" '{"secureblue_buildid_version": $buildid_version | tonumber}')
           curl -fLsS --retry 5 --json "${payload}" "${COPR_WEBHOOK_URL}"
+
+      - name: Create release
+        if: steps.calculate_buildid.outputs.need_build == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          CURRENT_UPSTREAM_VERSION_PLUS_RELEASE: ${{ steps.get_upstream_version.outputs.current_upstream_version_plus_release }}
+          SECUREBLUE_BUILDID_VERSION: ${{ steps.calculate_buildid.outputs.secureblue_buildid_version }}
+        run: |
+          TAG="${CURRENT_UPSTREAM_VERSION_PLUS_RELEASE}.secureblue.${SECUREBLUE_BUILDID_VERSION}"
+          gh release create "${TAG}" --generate-notes

From 16517fcad26b080a561c7fee2214b135c0ce997d Mon Sep 17 00:00:00 2001
From: RoyalOughtness <129108030+RoyalOughtness@users.noreply.github.com>
Date: Wed, 8 Jul 2026 12:02:41 -0700
Subject: [PATCH 2/5] job level secrets

---
 .github/workflows/kernel-build.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/kernel-build.yml b/.github/workflows/kernel-build.yml
index d019e97..5318a1a 100644
--- a/.github/workflows/kernel-build.yml
+++ b/.github/workflows/kernel-build.yml
@@ -9,8 +9,7 @@ concurrency:
   group: kernel-build
   cancel-in-progress: false
 
-permissions: # See VARS_TOKEN note
-  contents: write
+permissions: {} # See VARS_TOKEN note
 
 env:
   GH_REPO: ${{ github.repository }}
@@ -81,6 +80,8 @@ jobs:
 
       - name: Create release
         if: steps.calculate_buildid.outputs.need_build == 'true'
+        permissions:
+          contents: write # required to push new releases
         env:
           GH_TOKEN: ${{ github.token }}
           CURRENT_UPSTREAM_VERSION_PLUS_RELEASE: ${{ steps.get_upstream_version.outputs.current_upstream_version_plus_release }}

From a77961d8ff0e19e47f4f3e758e3004f3cc34db06 Mon Sep 17 00:00:00 2001
From: RoyalOughtness <129108030+RoyalOughtness@users.noreply.github.com>
Date: Wed, 8 Jul 2026 12:24:01 -0700
Subject: [PATCH 3/5] comments

---
 .github/workflows/kernel-build.yml | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/kernel-build.yml b/.github/workflows/kernel-build.yml
index 5318a1a..5a48698 100644
--- a/.github/workflows/kernel-build.yml
+++ b/.github/workflows/kernel-build.yml
@@ -9,19 +9,19 @@ concurrency:
   group: kernel-build
   cancel-in-progress: false
 
-permissions: {} # See VARS_TOKEN note
-
-env:
-  GH_REPO: ${{ github.repository }}
-  GH_TOKEN: ${{ secrets.VARS_TOKEN }} # has Environments RW
+permissions: {}
 
 jobs:
   kernel-build:
     runs-on: ubuntu-26.04
     environment: Build
+    permissions:
+      contents: write # required to push new releases
     steps:
       - name: Read env variables
         id: env_variables
+        env:
+          GH_TOKEN: ${{ secrets.VARS_TOKEN }} # has Environments RW
         run: |
           stored_upstream=$(gh variable get UPSTREAM_KERNEL_VERSION --env Build)
           stored_secureblue_buildid_version="$(gh variable get SECUREBLUE_BUILDID_VERSION --env Build)"
@@ -69,6 +69,7 @@ jobs:
       - name: Run build
         if: steps.calculate_buildid.outputs.need_build == 'true'
         env:
+          GH_TOKEN: ${{ secrets.VARS_TOKEN }} # has Environments RW
           CURRENT_UPSTREAM_VERSION_PLUS_RELEASE: ${{ steps.get_upstream_version.outputs.current_upstream_version_plus_release }}
           SECUREBLUE_BUILDID_VERSION: ${{ steps.calculate_buildid.outputs.secureblue_buildid_version }}
           COPR_WEBHOOK_URL: ${{ secrets.COPR_WEBHOOK_URL }}
@@ -80,8 +81,6 @@ jobs:
 
       - name: Create release
         if: steps.calculate_buildid.outputs.need_build == 'true'
-        permissions:
-          contents: write # required to push new releases
         env:
           GH_TOKEN: ${{ github.token }}
           CURRENT_UPSTREAM_VERSION_PLUS_RELEASE: ${{ steps.get_upstream_version.outputs.current_upstream_version_plus_release }}

From 702d5829ae16efb9c68c8a32a6305eef68851ff1 Mon Sep 17 00:00:00 2001
From: RoyalOughtness <129108030+RoyalOughtness@users.noreply.github.com>
Date: Wed, 8 Jul 2026 13:04:50 -0700
Subject: [PATCH 4/5] add state check

---
 .github/workflows/kernel-build.yml | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/kernel-build.yml b/.github/workflows/kernel-build.yml
index 5a48698..a34204c 100644
--- a/.github/workflows/kernel-build.yml
+++ b/.github/workflows/kernel-build.yml
@@ -67,6 +67,8 @@ jobs:
           echo "secureblue_buildid_version=${secureblue_buildid_version}" >> "${GITHUB_OUTPUT}"
 
       - name: Run build
+        id: build
+        timeout-minutes: 120
         if: steps.calculate_buildid.outputs.need_build == 'true'
         env:
           GH_TOKEN: ${{ secrets.VARS_TOKEN }} # has Environments RW
@@ -77,10 +79,23 @@ jobs:
           payload=$(jq -cn --arg buildid_version "${SECUREBLUE_BUILDID_VERSION}" '{"secureblue_buildid_version": $buildid_version | tonumber}')
           gh variable set UPSTREAM_KERNEL_VERSION --env Build --body "${CURRENT_UPSTREAM_VERSION_PLUS_RELEASE}"
           gh variable set SECUREBLUE_BUILDID_VERSION --env Build --body "${SECUREBLUE_BUILDID_VERSION}"
-          curl -fLsS --retry 5 --json "${payload}" "${COPR_WEBHOOK_URL}"
+          build_id=$(curl -fLsS --retry 5 --json "${payload}" "${COPR_WEBHOOK_URL}")
+          while true; do
+            state=$(curl -fLsS --retry 5 "https://copr.fedorainfracloud.org/api_3/build/${BUILD_ID}" | jq -r '.state')
+            if [[ "${state}" == "succeeded" ]]; then
+              echo "build_succeeded=true" >> "${GITHUB_OUTPUT}"
+              exit 0
+            fi
+            
+            if [[ "${state}" =~ ^(canceled|skipped|failed)$ ]]; then
+              exit 1
+            fi
+            
+            sleep 60
+          done
 
       - name: Create release
-        if: steps.calculate_buildid.outputs.need_build == 'true'
+        if: steps.build.outputs.success == 'true'
         env:
           GH_TOKEN: ${{ github.token }}
           CURRENT_UPSTREAM_VERSION_PLUS_RELEASE: ${{ steps.get_upstream_version.outputs.current_upstream_version_plus_release }}

From a54f65b5cb600f9401d2539e5c93a5c96eced4be Mon Sep 17 00:00:00 2001
From: RoyalOughtness <129108030+RoyalOughtness@users.noreply.github.com>
Date: Wed, 8 Jul 2026 13:20:45 -0700
Subject: [PATCH 5/5] default bash

---
 .github/workflows/kernel-build.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/kernel-build.yml b/.github/workflows/kernel-build.yml
index a34204c..01db531 100644
--- a/.github/workflows/kernel-build.yml
+++ b/.github/workflows/kernel-build.yml
@@ -11,6 +11,10 @@ concurrency:
 
 permissions: {}
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
   kernel-build:
     runs-on: ubuntu-26.04