Skip to content

Commit da0e535

Browse files
tstellartstellar
authored
workflows: Add a new job for packaging release sources (#91834)
This job uses the new artifact attestations: https://github.blog/2024-05-02-introducing-artifact-attestations-now-in-public-beta/ This will allow users to verify that the sources came from a specific workflow run in the llvm-project repository. Currently, this job does not automatically upload sources to the release page, but rather it attaches them the workflow run as artifacts. The release manager is expected to download, verify, and sign the sources before uploading them to the release page. We may be able to automatically upload them in the future once we have a process for signing the binaries within the github workflow. Technically, though, the binaries are being signed as part of the attestation process, but the only way to verify the signatures is using the gh command line tool, and I don't think it is best to rely on that, since the tool may not be easily available on all systems.
1 parent 083c683 commit da0e535

File tree

3 files changed

+126
-8
lines changed

3 files changed

+126
-8
lines changed

‎.github/workflows/release-sources.yml

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
name: Release Sources
2+
3+
permissions:
4+
contents: read
5+
6+
on:
7+
workflow_dispatch:
8+
inputs:
9+
release-version:
10+
description: Release Version
11+
required: true
12+
type: string
13+
workflow_call:
14+
inputs:
15+
release-version:
16+
description: Release Version
17+
required: true
18+
type: string
19+
# Run on pull_requests for testing purposes.
20+
pull_request:
21+
paths:
22+
- '.github/workflows/release-sources.yml'
23+
types:
24+
- opened
25+
- synchronize
26+
- reopened
27+
# When a PR is closed, we still start this workflow, but then skip
28+
# all the jobs, which makes it effectively a no-op. The reason to
29+
# do this is that it allows us to take advantage of concurrency groups
30+
# to cancel in progress CI jobs whenever the PR is closed.
31+
- closed
32+
33+
concurrency:
34+
group: ${{ github.workflow }}-${{ inputs.release-version || github.event.pull_request.number }}
35+
cancel-in-progress: True
36+
37+
jobs:
38+
inputs:
39+
name: Collect Job Inputs
40+
if: >-
41+
github.repository_owner == 'llvm' &&
42+
github.event.action != 'closed'
43+
outputs:
44+
ref: ${{ steps.inputs.outputs.ref }}
45+
export-args: ${{ steps.inputs.outputs.export-args }}
46+
runs-on: ubuntu-latest
47+
steps:
48+
- id: inputs
49+
run: |
50+
ref=${{ inputs.release-version || github.sha }}
51+
if [ -n "${{ inputs.release-version }}" ]; then
52+
export_args="-release ${{ inputs.release-version }} -final"
53+
else
54+
export_args="-git-ref ${{ github.sha }}"
55+
fi
56+
echo "ref=$ref" >> $GITHUB_OUTPUT
57+
echo "export-args=$export_args" >> $GITHUB_OUTPUT
58+
59+
release-sources:
60+
name: Package Release Sources
61+
if: github.repository_owner == 'llvm'
62+
runs-on: ubuntu-latest
63+
needs:
64+
- inputs
65+
permissions:
66+
id-token: write
67+
attestations: write
68+
steps:
69+
- name: Checkout LLVM
70+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
71+
with:
72+
ref: ${{ needs.inputs.outputs.ref }}
73+
fetch-tags: true
74+
- name: Install Dependencies
75+
run: |
76+
pip install --require-hashes -r ./llvm/utils/git/requirements.txt
77+
78+
- name: Check Permissions
79+
if: github.event_name != 'pull_request'
80+
env:
81+
GITHUB_TOKEN: ${{ github.token }}
82+
USER_TOKEN: ${{ secrets.RELEASE_TASKS_USER_TOKEN }}
83+
run: |
84+
./llvm/utils/release/./github-upload-release.py --token "$GITHUB_TOKEN" --user ${{ github.actor }} --user-token "$USER_TOKEN" check-permissions
85+
- name: Create Tarballs
86+
run: |
87+
./llvm/utils/release/export.sh ${{ needs.inputs.outputs.export-args }}
88+
- name: Attest Build Provenance
89+
if: github.event_name != 'pull_request'
90+
id: provenance
91+
uses: actions/attest-build-provenance@897ed5eab6ed058a474202017ada7f40bfa52940 # v1.0.0
92+
with:
93+
subject-path: "*.xz"
94+
- if: github.event_name != 'pull_request'
95+
run: |
96+
mv ${{ steps.provenance.outputs.bundle-path }} .
97+
- name: Create Tarball Artifacts
98+
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 #v4.3.3
99+
with:
100+
path: |
101+
*.xz
102+
attestation.jsonl
103+
104+

‎.github/workflows/release-tasks.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,3 +85,14 @@ jobs:
8585
with:
8686
release-version: ${{ needs.validate-tag.outputs.release-version }}
8787
upload: true
88+
89+
release-sources:
90+
name: Package Release Sources
91+
permissions:
92+
id-token: write
93+
attestations: write
94+
needs:
95+
- validate-tag
96+
uses: ./.github/workflows/release-sources.yml
97+
with:
98+
release-version: ${{ needs.validate-tag.outputs.release-version }}

‎llvm/docs/HowToReleaseLLVM.rst

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -144,8 +144,17 @@ Tag release candidates:
144144

145145
$ git tag -sa llvmorg-X.Y.Z-rcN
146146

147-
The Release Manager must supply pre-packaged source tarballs for users. This can
148-
be done with the export.sh script in utils/release.
147+
The pre-packaged source tarballs will be automatically generated via the
148+
"Release Sources" workflow on GitHub. This workflow will create an artifact
149+
containing all the release tarballs and the artifact attestation. The
150+
Release Manager should download the artifact, verify the tarballs, sign them,
151+
and then upload them to the release page.
152+
153+
::
154+
155+
$ unzip artifact.zip
156+
$ gh auth login
157+
$ for f in *.xz; do gh attestation verify --owner llvm $f && gpg -b $f; done
149158

150159
Tarballs, release binaries, or any other release artifacts must be uploaded to
151160
GitHub. This can be done using the github-upload-release.py script in utils/release.
@@ -154,12 +163,6 @@ GitHub. This can be done using the github-upload-release.py script in utils/rel
154163

155164
$ github-upload-release.py upload --token <github-token> --release X.Y.Z-rcN --files <release_files>
156165

157-
::
158-
159-
$ ./export.sh -release X.Y.Z -rc $RC
160-
161-
This will generate source tarballs for each LLVM project being validated, which
162-
can be uploaded to github for further testing.
163166

164167
Build The Binary Distribution
165168
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

0 commit comments

Comments
 (0)