[v2023.2.x] Backport various CI changes

.github/build-meta.sh

@@ -3,6 +3,23 @@
 set -euxo pipefail
 
 SCRIPT_DIR="$(dirname "$0")"
+UPSTREAM_REPO_NAME="freifunk-darmstadt/site-ffda"
+
+OVERRIDES_DIR="$SCRIPT_DIR/overrides/build-meta"
+
+function set_output_value() {
+	local output_file="$1"
+	local name="$2"
+	local value="$3"
+
+	# Check if override is defined
+	if [ -f "$OVERRIDES_DIR/$name" ]; then
+		value="$(cat "$OVERRIDES_DIR/$name")"
+		echo "::notice::Overriding $name with value \"$value\""
+	fi
+
+	echo "$name=$value" >> "$output_file"
+}
 
 # Get Git short hash for repo at $SCRIPT_DIR
 GIT_SHORT_HASH="$(git -C "$SCRIPT_DIR" rev-parse --short HEAD)"
@@ -19,6 +36,9 @@ DEPLOY="0"
 # Don't release by default. Enable for tags.
 CREATE_RELEASE="0"
 
+# This is not the latest release by default.
+LATEST_RELEASE="0"
+
 # Target whitelist
 if [ -n "$WORKFLOW_DISPATCH_TARGETS" ]; then
 	# Get targets from dispatch event
@@ -36,6 +56,8 @@ TESTING_TAG_RE="^[2-9].[0-9]-[0-9]{8}$"
 CUSTOM_TESTING_TAG_RE="^[2-9].[0-9]-[0-9]{8}"
 # Regex for release firmware tag
 RELEASE_TAG_RE="^[2-9].[0-9].[0-9]$"
+# Regex for release deployment firmware tag
+RELEASE_DEPLOYMENT_TAG_RE="^[2-9].[0-9].[0-9]"
 
 # Get Gluon version information
 if [ -n "$WORKFLOW_DISPATCH_REPOSITORY" ] && [ -n "$WORKFLOW_DISPATCH_REFERENCE" ]; then
@@ -110,9 +132,19 @@ elif [ "$GITHUB_EVENT_NAME" = "push"  ] && [ "$GITHUB_REF_TYPE" = "tag" ]; then
 		MANIFEST_BETA="1"
 		SIGN_MANIFEST="1"
 
+		LATEST_RELEASE="1"
+
 		RELEASE_VERSION="$GITHUB_REF_NAME"
 		BROKEN="0"
 		DEPLOY="1"
+	elif [[ "$GITHUB_REF_NAME" =~ $RELEASE_DEPLOYMENT_TAG_RE ]]; then
+		# Deployment release - autoupdater Branch is stable and enabled
+		AUTOUPDATER_ENABLED="1"
+		AUTOUPDATER_BRANCH="stable"
+
+		RELEASE_VERSION="$GITHUB_REF_NAME"
+		BROKEN="1"
+		DEPLOY="0"
 	else
 		# Unknown release - Disable autoupdater
 		AUTOUPDATER_ENABLED="0"
@@ -144,6 +176,21 @@ if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
 	SIGN_MANIFEST="0"
 fi
 
+# Signing should only happen when pushed to the upstream repository.
+# Skip this step for the pipeline to succeed but inform the user.
+if [ "$GITHUB_REPOSITORY" != "$UPSTREAM_REPO_NAME" ] && [ "$SIGN_MANIFEST" != "0" ]; then
+	SIGN_MANIFEST="0"
+
+	echo "::warning::Skip manifest signature due to action running in fork."
+fi
+
+# We should neither deploy in a fork, as the workflow is hard-coding out firmware-server
+if [ "$GITHUB_REPOSITORY" != "$UPSTREAM_REPO_NAME" ] && [ "$DEPLOY" != "0" ]; then
+	DEPLOY="0"
+
+	echo "::warning::Skip deployment due to action running in fork."
+fi
+
 # Determine Version to use
 RELEASE_VERSION="${RELEASE_VERSION:-$DEFAULT_RELEASE_VERSION}"
 
@@ -154,22 +201,23 @@ BUILD_META_OUTPUT="$BUILD_META_TMP_DIR/build-meta.txt"
 
 # shellcheck disable=SC2129
 # Not the nicest way to do this, but it works.
-echo "build-meta-output=$BUILD_META_TMP_DIR" >> "$BUILD_META_OUTPUT"
-echo "container-version=$CONTAINER_VERSION" >> "$BUILD_META_OUTPUT"
-echo "gluon-repository=$GLUON_REPOSITORY" >> "$BUILD_META_OUTPUT"
-echo "gluon-commit=$GLUON_COMMIT" >> "$BUILD_META_OUTPUT"
-echo "site-version=$SITE_VERSION" >> "$BUILD_META_OUTPUT"
-echo "release-version=$RELEASE_VERSION" >> "$BUILD_META_OUTPUT"
-echo "autoupdater-enabled=$AUTOUPDATER_ENABLED" >> "$BUILD_META_OUTPUT"
-echo "autoupdater-branch=$AUTOUPDATER_BRANCH" >> "$BUILD_META_OUTPUT"
-echo "broken=$BROKEN" >> "$BUILD_META_OUTPUT"
-echo "manifest-stable=$MANIFEST_STABLE" >> "$BUILD_META_OUTPUT"
-echo "manifest-beta=$MANIFEST_BETA" >> "$BUILD_META_OUTPUT"
-echo "manifest-testing=$MANIFEST_TESTING" >> "$BUILD_META_OUTPUT"
-echo "sign-manifest=$SIGN_MANIFEST" >> "$BUILD_META_OUTPUT"
-echo "deploy=$DEPLOY" >> "$BUILD_META_OUTPUT"
-echo "create-release=$CREATE_RELEASE" >> "$BUILD_META_OUTPUT"
-echo "target-whitelist=$TARGET_WHITELIST" >> "$BUILD_META_OUTPUT"
+set_output_value "$BUILD_META_OUTPUT" "build-meta-output" "$BUILD_META_TMP_DIR"
+set_output_value "$BUILD_META_OUTPUT" "container-version" "$CONTAINER_VERSION"
+set_output_value "$BUILD_META_OUTPUT" "gluon-repository" "$GLUON_REPOSITORY"
+set_output_value "$BUILD_META_OUTPUT" "gluon-commit" "$GLUON_COMMIT"
+set_output_value "$BUILD_META_OUTPUT" "site-version" "$SITE_VERSION"
+set_output_value "$BUILD_META_OUTPUT" "release-version" "$RELEASE_VERSION"
+set_output_value "$BUILD_META_OUTPUT" "autoupdater-enabled" "$AUTOUPDATER_ENABLED"
+set_output_value "$BUILD_META_OUTPUT" "autoupdater-branch" "$AUTOUPDATER_BRANCH"
+set_output_value "$BUILD_META_OUTPUT" "broken" "$BROKEN"
+set_output_value "$BUILD_META_OUTPUT" "manifest-stable" "$MANIFEST_STABLE"
+set_output_value "$BUILD_META_OUTPUT" "manifest-beta" "$MANIFEST_BETA"
+set_output_value "$BUILD_META_OUTPUT" "manifest-testing" "$MANIFEST_TESTING"
+set_output_value "$BUILD_META_OUTPUT" "sign-manifest" "$SIGN_MANIFEST"
+set_output_value "$BUILD_META_OUTPUT" "deploy" "$DEPLOY"
+set_output_value "$BUILD_META_OUTPUT" "create-release" "$CREATE_RELEASE"
+set_output_value "$BUILD_META_OUTPUT" "latest-release" "$LATEST_RELEASE"
+set_output_value "$BUILD_META_OUTPUT" "target-whitelist" "$TARGET_WHITELIST"
 
 # Copy over to GITHUB_OUTPUT
 cat "$BUILD_META_OUTPUT" >> "$GITHUB_OUTPUT"

.github/validate-overrides.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+
+# Validate no files in .github/overrides/build-meta contain newlines
+
+set -euo pipefail
+
+SCRIPT_DIR="$(dirname "$0")"
+
+OVERRIDES_DIR="$SCRIPT_DIR/overrides/build-meta"
+
+FILES_WITH_TWO_LINES=""
+
+# Find all files which contain at lest two lines
+while IFS= read -r -d '' file
+do
+	if [ "$(wc -l < "$file")" -gt 1 ]; then
+		FILES_WITH_TWO_LINES="$FILES_WITH_TWO_LINES $file"
+	fi
+done <   <(find "$OVERRIDES_DIR" -type f -print0)
+
+# Check for newlines in overrides
+if [ -n "$FILES_WITH_TWO_LINES" ]; then
+	echo "The following files contain newlines:"
+	echo "$FILES_WITH_TWO_LINES"
+	exit 1
+fi
+
+exit 0

.github/workflows/build.yml

@@ -18,7 +18,18 @@ on:
         required: false
 
 jobs:
+  validate-overrides:
+    runs-on: ubuntu-22.04
+    name: Validate CI overrides
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Validate overrides
+        run: |
+          bash .github/validate-overrides.sh
+
   build-meta:
+    needs: validate-overrides
     outputs:
       container-version: >-
         ${{ steps.build-metadata.outputs.container-version }}
@@ -46,6 +57,8 @@ jobs:
         ${{ steps.build-metadata.outputs.sign-manifest }}
       create-release: >-
         ${{ steps.build-metadata.outputs.create-release }}
+      latest-release: >-
+        ${{ steps.build-metadata.outputs.latest-release }}
       deploy: >-
         ${{ steps.build-metadata.outputs.deploy }}
       target-whitelist: >-
@@ -511,8 +524,9 @@ jobs:
             gluon-gha-data/release-artifacts/*
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
         with:
           body_path: gluon-gha-data/release-notes.md
+          make_latest: ${{ needs.build-meta.outputs.latest-release == '1' }}
           files: |
             gluon-gha-data/release-artifacts/*

contrib/create-release.sh

@@ -53,7 +53,7 @@ check_input_y "Proceed to tag firmware release for '$RELEASE_NAME' (Tag: '$TAG_N
 
 echo "Proceeding to tag firmware release with $RELEASE_NAME"
 
-git tag "$TAG_NAME"
+git tag -a -m "$TAG_NAME" "$TAG_NAME"
 
 echo "Tag was created"
 echo "Push with 'git push origin $TAG_NAME'"