Merge pull request #21 from theupriser/feature/iso-release-notes

Feature/iso release notes

.github/workflows/iso-1-github-tag.yml

@@ -20,6 +20,10 @@ on:
         type: choice
         options: [auto, release, dev]
         default: auto
+      steamify_ref:
+        description: "Steamify branch or tag to build the ISO with (empty: the newest published release). A release branch tests its own version."
+        type: string
+        default: ""
 
 permissions:
   contents: write
@@ -34,6 +38,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Tag and release
         env:
@@ -42,43 +48,65 @@ jobs:
         run: |
           steamify="$(gh release view -R theupriser/steamify-cachyos --json tagName -q .tagName)"
           steamify="${steamify#v}"
+          # A branch or tag of Steamify to build with (a release branch before its release), else the newest release.
+          sref="${{ inputs.steamify_ref }}"
+          if [ -n "$sref" ]; then
+            steamify="$(gh api "repos/theupriser/steamify-cachyos/contents/steamify.sh?ref=$sref" -q .content | base64 -d | sed -n 's/^VERSION=//p' | head -n 1)"
+            [ -n "$steamify" ] || { echo "::error::no VERSION in steamify.sh at $sref"; exit 1; }
+          fi
           stamp="$(date -u +%y%m%d)" day="$(date -u +%Y.%m.%d)"
+          base="$(head -n 1 CHANGELOG.md | sed 's/^# *//')"   # the CachyOS version (first line of the changelog)
           kind="${{ inputs.kind }}"
           if [ -z "$kind" ] || [ "$kind" = auto ]; then
             if [ "${{ github.ref }}" = refs/heads/master ]; then kind=release; else kind=dev; fi
           fi
           if [ "$kind" = release ]; then
-            tag="v$steamify-$stamp" pre="" name="CachyOS with Steamify Live ISO $steamify ($day UTC)"
+            tag="v$steamify-$stamp" pre="" name="CachyOS $base with Steamify $steamify ($day UTC)"
           else
-            tag="v$steamify-dev-$stamp" pre="--prerelease" name="CachyOS with Steamify Live ISO $steamify (test build $day UTC)"
+            tag="v$steamify-dev-$stamp" pre="--prerelease" name="CachyOS $base with Steamify $steamify (test build $day UTC)"
           fi
           # The ISO's file on the mirror is named after the tag (iso-2-gitea-build.yml, profiledef.sh), so its
           # download link is known now.
           file="steamify-cachyos-${tag#v}-x86_64.iso" dl="$GITEA_URL/$GITEA_REPO/releases/download/$tag"
-          # The Steamify section of CHANGELOG.md ("## CachyOS with Steamify Live ISO"), without its heading.
+          # The notes are generated, nothing is written by hand:
-          section="$(awk '/^## CachyOS with Steamify Live ISO/ {found = 1; next} found && /^#/ {exit} found' CHANGELOG.md)"
+          #  - the CachyOS base version (first line of CHANGELOG.md, the fork's upstream changelog),
-          notes="The ISO is built from \`$(git rev-parse --short HEAD)\` (${{ github.ref_name }}) with Steamify $steamify and published on the mirror (GitHub releases take at most 2 GB per file), about half an hour after this release (the mirror's sync, then the build):
+          #  - the Steamify version's own changelog section (steamify-cachyos CHANGELOG.md at the ref or tag it is built from),
+          #  - this repository's commits since the previous release of the same kind.
+          steamify_notes="$(gh api "repos/theupriser/steamify-cachyos/contents/CHANGELOG.md?ref=${sref:-v$steamify}" -q .content 2> /dev/null | base64 -d 2> /dev/null |
+              awk -v v="$steamify" 'index($0, "## " v " ") == 1 {f = 1; next} f && /^## / {exit} f')"
+          [ "$kind" = release ] && want_pre=false || want_pre=true
+          [ "$kind" = release ] && kind_name="real release" || kind_name="dev build"
+          prev="$(gh release list -L 50 --json tagName,isPrerelease,createdAt -q "[.[] | select(.isPrerelease == $want_pre and .tagName != \"$tag\")] | sort_by(.createdAt) | reverse | .[0].tagName // empty")"
+          # Commits that change the ISO itself: not the workflow ones (type or scope ci, e.g. ci: / fix(ci):) and not docs:.
+          if [ -n "$prev" ] && git rev-parse -q --verify "refs/tags/$prev" > /dev/null; then
+            range="$prev..HEAD"; limit=40; since="Since \`$prev\`:"
+          else
+            range="HEAD"; limit=12; since="The latest commits (there is no earlier $kind_name to compare with):"
+          fi
+          changes="$(git log --no-merges --format='%s' "$range" | grep -Ev '^(ci|docs)(\(.*\))?:|^[a-z]+\(ci\):' | sed 's/^/- /' | head -n "$limit" || true)"
+          [ -n "$changes" ] || changes="- No changes to the ISO itself."
+          notes="![ISO build](https://img.shields.io/badge/ISO_build-running-yellow)
+
+          **CachyOS $base with Steamify $steamify${sref:+ (branch $sref)} built in.** Install CachyOS and turn the PC into a Steam Machine in one go.
+
+          The ISO is built from \`$(git rev-parse --short HEAD)\` (${{ github.ref_name }}). It is about 3 GB, more than a GitHub release can hold (2 GB per file), so it is published on the mirror about 20 minutes after this release is created:
 
           **Download: [$file]($dl/$file)** ([SHA-256]($dl/$file.sha256), [release page]($GITEA_URL/$GITEA_REPO/releases/tag/$tag))
 
-          Sources: [Steamify](https://github.com/theupriser/steamify-cachyos/tree/v$steamify), this repository at this tag, and the packages' sources at [CachyOS](https://github.com/CachyOS) and [Arch Linux](https://archlinux.org/packages/).
+          ### Steamify $steamify
+          ${steamify_notes:-There is no changelog section for this version.}
 
-          $section"
+          ### Changes in this ISO
+          $since
+          $changes
+
+          ### Sources
+          [Steamify](https://github.com/theupriser/steamify-cachyos/tree/${sref:-v$steamify}), this repository at this tag, and the packages' sources at [CachyOS](https://github.com/CachyOS) and [Arch Linux](https://archlinux.org/packages/)."
           # One ISO per day and kind: the newest build of a day replaces the earlier one (space), here and on the mirror.
-          mirror_sync() { [ -n "$GIT_UPRISER_TOKEN" ] && curl -fsS --retry 5 --retry-delay 10 --retry-all-errors -X POST -H "Authorization: token $GIT_UPRISER_TOKEN" "$GITEA_URL/api/v1/repos/$GITEA_REPO/mirror-sync" > /dev/null; }
           if git ls-remote --exit-code --tags origin "refs/tags/$tag" > /dev/null 2>&1 || gh release view "$tag" > /dev/null 2>&1; then
             echo "$tag exists: replacing it"
             gh release delete "$tag" --cleanup-tag -y 2> /dev/null || true
             git push origin ":refs/tags/$tag" 2> /dev/null || true
-            # The mirror has to see the tag go (it drops the tag and its release with the ISO); otherwise the new tag is only an
-            # update there and starts no build.
-            if mirror_sync; then
-              # The tag list, not .../tags/<tag>: that URL answers 404 on this server even for tags that exist.
-              for _ in $(seq 36); do
-                curl -s "$GITEA_URL/api/v1/repos/$GITEA_REPO/tags?limit=100" | grep -q "\"name\":\"$tag\"" || break
-                sleep 5
-              done
-            fi
           fi
           # An annotated tag: its own date, so the mirror sorts releases on the same commit in order (a
           # lightweight tag only has its commit's date).
@@ -87,6 +115,8 @@ jobs:
           git tag -a "$tag" -m "$name" "$GITHUB_SHA" && git push origin "refs/tags/$tag"
           gh release create "$tag" --verify-tag $pre --title "$name" --notes "$notes"
           echo "Released $tag"
+          echo "ISO_TAG=$tag" >> "$GITHUB_ENV"
+          echo "STEAMIFY_REF=$sref" >> "$GITHUB_ENV"
 
           # Retention (space): at most 10 dev and 10 real releases; the oldest go, release and tag. The mirror drops the
           # tag with its release and ISO at its next sync (the step below).
@@ -97,12 +127,25 @@ jobs:
               while read -r old; do echo "Retention: removing $old"; gh release delete "$old" --cleanup-tag -y; done
           done
 
-      # Optional: sync the mirror at once instead of at its interval (a Gitea token with repository write
+      # The mirror takes the tag (sync), then the build on the mirror is started explicitly (its dispatch API): a tag that
-      # access as the secret GIT_UPRISER_TOKEN).
+      # is replaced (same name, a new tag object) starts no run there by itself. Needs a Gitea token with repository write
-      - name: Sync the Gitea mirror
+      # access as the secret GIT_UPRISER_TOKEN; without it the mirror picks the tag up later and nothing is built.
+      - name: Sync the Gitea mirror and start its build
         env:
           GIT_UPRISER_TOKEN: ${{ secrets.GIT_UPRISER_TOKEN }}
         run: |
-          if [ -z "$GIT_UPRISER_TOKEN" ]; then echo "No GIT_UPRISER_TOKEN: the mirror picks the tag up at its next sync."; exit 0; fi
+          if [ -z "$GIT_UPRISER_TOKEN" ]; then echo "No GIT_UPRISER_TOKEN: the mirror is not synced and no build is started."; exit 0; fi
-          curl -fsS --retry 5 --retry-delay 10 --retry-all-errors -X POST -H "Authorization: token $GIT_UPRISER_TOKEN" "$GITEA_URL/api/v1/repos/$GITEA_REPO/mirror-sync" &&
+          api="$GITEA_URL/api/v1/repos/$GITEA_REPO"
+          curl -fsS --retry 5 --retry-delay 10 --retry-all-errors -X POST -H "Authorization: token $GIT_UPRISER_TOKEN" "$api/mirror-sync"
           echo "Mirror sync started"
+          want="$(git rev-parse "refs/tags/$ISO_TAG")"
+          for _ in $(seq 60); do
+            got="$(curl -s "$api/tags/$ISO_TAG" | python3 -c 'import json,sys; print(json.load(sys.stdin).get("id",""))' 2> /dev/null)"
+            [ "$got" = "$want" ] && break
+            sleep 5
+          done
+          [ "$got" = "$want" ] || { echo "::error::the mirror does not have $ISO_TAG ($want) after 5 minutes"; exit 1; }
+          # ref: the full name (refs/tags/...), as in Gitea's API documentation; --fail-with-body shows the server's reason.
+          curl -sS --fail-with-body --retry 3 -X POST -H "Authorization: token $GIT_UPRISER_TOKEN" -H "Content-Type: application/json" \
+              -d "{\"ref\":\"refs/tags/$ISO_TAG\",\"inputs\":{\"steamify_ref\":\"$STEAMIFY_REF\"}}" "$api/actions/workflows/iso-2-gitea-build.yml/dispatches"
+          echo "Started the mirror's build for $ISO_TAG"

.github/workflows/iso-2-gitea-build.yml

@@ -10,10 +10,15 @@
 # [repository.release] FILE_MAX_SIZE must allow the ISO (default 2 GB).
 name: ISO 2/2 · Build and publish (Gitea)
 
+# Started by iso-1-github-tag.yml through the mirror's dispatch API, with the tag as the ref (a replaced tag starts no
+# run by itself, so nothing is triggered by tag pushes).
 on:
-  push:
-    tags: ['v*']
   workflow_dispatch:
+    inputs:
+      steamify_ref:
+        description: "Steamify branch or tag to build with (set by iso-1; empty: the release the tag names)"
+        type: string
+        default: ""
 
 # One run at a time for the whole workflow (not per tag): a new run stops the running one and takes over.
 concurrency:
@@ -75,7 +80,15 @@ jobs:
           echo "steamify=${m[1]}" >> "$GITHUB_OUTPUT"
 
       - name: Steamify on the ISO (the version the tag names)
-        run: ./steamify-prepare.sh
+        run: |
+          ref="${{ inputs.steamify_ref }}"
+          if [ -n "$ref" ]; then
+            # A branch (a release branch before its release): its checkout goes on the ISO.
+            git clone -q --depth 1 --branch "$ref" https://github.com/theupriser/steamify-cachyos.git /tmp/steamify-src
+            ./steamify-prepare.sh /tmp/steamify-src
+          else
+            ./steamify-prepare.sh
+          fi
 
       - name: Build
         run: |
@@ -146,10 +159,11 @@ jobs:
           [ -f "$iso" ] || { echo "::error::no ISO in out/desktop"; exit 1; }
           tag="${{ github.ref_name }}" b="$STEAMIFY_BUILD_STAMP"
           stamp="20${b:0:2}.${b:2:2}.${b:4:2}"
+          base="$(head -n 1 CHANGELOG.md | sed 's/^# *//')"   # the CachyOS version, as in the GitHub release's title
           if [ "$ISO_PRERELEASE" = true ]; then
-            name="CachyOS with Steamify Live ISO $STEAMIFY_VERSION (test build $stamp UTC)"
+            name="CachyOS $base with Steamify $STEAMIFY_VERSION (test build $stamp UTC)"
           else
-            name="CachyOS with Steamify Live ISO $STEAMIFY_VERSION ($stamp UTC)"
+            name="CachyOS $base with Steamify $STEAMIFY_VERSION ($stamp UTC)"
           fi
           # One ISO per day and kind: a release of this tag from an earlier build of the day is replaced.
           api="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
@@ -159,15 +173,19 @@ jobs:
           fi
           { echo "publish=true"; echo "name=$name"; } >> "$GITHUB_OUTPUT"
           section="$(awk '/^## CachyOS with Steamify Live ISO/ {found = 1; next} found && /^#/ {exit} found' CHANGELOG.md)"
+          src="${{ inputs.steamify_ref }}"; src="${src:-v$STEAMIFY_VERSION}"
+          # The same notes as the GitHub release (one source: iso-1 generated them), without its badge line; the
+          # checksum line is added here. Fallback: a short text.
+          if curl -fsS "https://api.github.com/repos/theupriser/steamify-cachyos-live-iso/releases/tags/$tag" -o /tmp/ghrel.json; then
+            jq -r '.body // ""' /tmp/ghrel.json | sed '/ISO build\]/d' > release-notes.md
+          else
+            echo "Built from \`$(git rev-parse --short HEAD)\` ($tag) with Steamify $STEAMIFY_VERSION." > release-notes.md  # fallback when GitHub cannot be reached
+          fi
           {
-            echo "Built from \`$(git rev-parse --short HEAD)\` ($tag) with Steamify $STEAMIFY_VERSION."
             echo
-            echo "SHA-256: \`$(cut -d' ' -f1 "$iso.sha256")\`, label \`STEAMIFY_${STEAMIFY_VERSION//./_}_$b\`"
+            echo "### Checksum"
-            echo
+            echo "SHA-256 of the ISO: \`$(cut -d' ' -f1 "$iso.sha256")\` (label \`STEAMIFY_${STEAMIFY_VERSION//./_}_$b\`)."
-            echo "Sources: [Steamify](https://github.com/theupriser/steamify-cachyos/tree/v$STEAMIFY_VERSION), this repository at this tag, and the packages' sources at [CachyOS](https://github.com/CachyOS) and [Arch Linux](https://archlinux.org/packages/)."
+          } >> release-notes.md
-            echo
-            echo "$section"
-          } > release-notes.md
           cat release-notes.md
 
       - name: Publish ${{ github.ref_name }}
@@ -184,3 +202,46 @@ jobs:
             out/desktop/*.iso.sha256
             out/desktop/*.iso.sha1
             out/desktop/*.pkgs.txt
+
+  # The result goes back to GitHub: the badge at the top of the GitHub release (started as "running" by iso-1) becomes
+  # succeeded / failed / cancelled and links to this run. Needs a GitHub token as the secret GH_RELEASE_TOKEN here on the
+  # mirror (fine-grained, this repository only, Contents: read and write); without it the badge stays "running".
+  report:
+    name: Report the result to GitHub
+    needs: [build, release]
+    if: ${{ always() && github.server_url != 'https://github.com' }}
+    runs-on: ubuntu-latest
+    container:
+      image: docker.io/cachyos/cachyos:latest
+    steps:
+      - name: Badge in the GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GH_RELEASE_TOKEN }}
+          BUILD: ${{ needs.build.result }}
+          RELEASE: ${{ needs.release.result }}
+        run: |
+          [ -n "$GH_TOKEN" ] || { echo "No GH_RELEASE_TOKEN: GitHub's release keeps its 'running' badge."; exit 0; }
+          pacman -Sy --noconfirm --needed curl python > /dev/null
+          tag="${{ github.ref_name }}"
+          if [ "$BUILD" = success ] && [ "$RELEASE" = success ]; then st=succeeded col=brightgreen
+          elif [ "$BUILD" = cancelled ] || [ "$RELEASE" = cancelled ]; then st=cancelled col=lightgrey
+          else st=failed col=red; fi
+          run="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          api="https://api.github.com/repos/theupriser/steamify-cachyos-live-iso/releases"
+          curl -fsS -H "Authorization: Bearer $GH_TOKEN" "$api/tags/$tag" -o /tmp/rel.json || { echo "::warning::no GitHub release for $tag"; exit 0; }
+          ST="$st" COL="$col" RUN="$run" RUN_ID="${{ github.run_id }}" python3 - << 'PY'
+          import json, os, re
+          d = json.load(open("/tmp/rel.json"))
+          body = d.get("body") or ""
+          # This runner reports its internal address (http://server:3000) as the server URL: the public one is in the
+          # release page link that iso-1 wrote into the notes.
+          m = re.search(r"\]\((https?://[^)\s]+)/releases/tag/", body)
+          run = f"{m.group(1)}/actions/runs/{os.environ['RUN_ID']}" if m else os.environ["RUN"]
+          badge = f"[![ISO build](https://img.shields.io/badge/ISO_build-{os.environ['ST']}-{os.environ['COL']})]({run})"
+          pat = re.compile(r"\[?!\[ISO build\]\([^)]*\)(\]\([^)]*\))?")
+          body = pat.sub(lambda m: badge, body, count=1) if pat.search(body) else badge + "\n\n" + body
+          json.dump({"body": body}, open("/tmp/patch.json", "w"))
+          open("/tmp/rel.id", "w").write(str(d["id"]))
+          PY
+          curl -fsS -X PATCH -H "Authorization: Bearer $GH_TOKEN" -H "Content-Type: application/json" -d @/tmp/patch.json "$api/$(cat /tmp/rel.id)" > /dev/null
+          echo "GitHub release $tag: ISO build $st"

AGENTS.md

@@ -118,9 +118,9 @@ Full write-up, with every trap: `steamify-iso-release` in steamify-cachyos-dev.
   release, whose `bundle.yml` needs the secret `ISO_DISPATCH_TOKEN`) names the release like CachyOS does, by the day (GitHub's UTC
   date, no time): `vX.Y.Z-YYMMDD` (real) or `vX.Y.Z-dev-YYMMDD` (dev), file `steamify-cachyos-X.Y.Z-[dev-]YYMMDD-x86_64.iso`, an **annotated** tag and a
   release with notes and the direct download link. One ISO per day and kind: a second build the same day deletes
-  the earlier release and tag (GitHub), waits until the mirror has dropped them, then tags again. Retention: at most 10 dev and 10 real
+  the earlier release and tag (GitHub) and tags again; the mirror takes the new tag object, iso-2 replaces the old mirror release. Retention: at most 10 dev and 10 real
-  releases are kept (space); the oldest are deleted with `gh release delete --cleanup-tag`, and the mirror drops their tags, releases and ISOs at its next sync. The workflow always runs from `master`; its input `kind` (`release`, `dev`, or `auto`: release on master, dev on other branches) decides: `release` is a real release, `dev` a `dev-` pre-release. steamify-cachyos' bundle.yml passes it: a version published from main -> `release`, a version on a release branch -> `dev`.
+  releases are kept (space); the oldest are deleted with `gh release delete --cleanup-tag`, and the mirror drops their tags, releases and ISOs at its next sync. The workflow always runs from `master`; its input `steamify_ref` (a Steamify branch or tag, empty = the newest published release) builds the ISO with that checkout and names it after that branch's `VERSION` (a release branch tests its own version before it is released); its input `kind` (`release`, `dev`, or `auto`: release on master, dev on other branches) decides: `release` is a real release, `dev` a `dev-` pre-release. steamify-cachyos' bundle.yml passes it: a version published from main -> `release`, a version on a release branch -> `dev`.
-- `.github/workflows/iso-2-gitea-build.yml` (Gitea, `on: push: tags: v*`, skipped on GitHub) runs two jobs for that
+- `.github/workflows/iso-2-gitea-build.yml` (Gitea, `workflow_dispatch` with the tag as the ref, started by iso-1's last step through the mirror's dispatch API after the mirror has the new tag object; a tag push starts nothing, because a replaced tag of the same name starts no run; skipped on GitHub) runs two jobs for that
   tag: build the ISO, then attach it to the mirror's release. It is not tested there (the runner is small): the VM tests
   run on GitHub, in steamify-cachyos `vmtest.yml`, on the newest ISO release of the mirror. The tag decides everything: Steamify version (`steamify-prepare.sh`
   takes `STEAMIFY_VERSION`), file name (`STEAMIFY_ISO_VERSION` -> `iso_version` in `profiledef.sh`), label
@@ -134,3 +134,15 @@ Full write-up, with every trap: `steamify-iso-release` in steamify-cachyos-dev.
   `container: privileged: true` (archiso mounts `/proc`); the workflow's `--privileged` option is ignored.
 - Caches (`actions/cache`, the runner's cache server): pacman's package cache per job kind (build, test) and the VMs' packages (`VM_CACHE`, `~/vms/pkg-cache`), keys per ISO week. Each job first installs only node and git, restores the caches, then installs the rest.
 - CachyOS's own `Desktop ISO` workflow (`build.yml`) is removed here; the VM tests live in steamify-cachyos (GitHub).
+
+- **Build badge in the GitHub release:** iso-1 puts `![ISO build](...running-yellow)` at the top of the release notes;
+  iso-2's last job `report` (`if: always()`) replaces it with succeeded / failed / cancelled, linked to the Gitea run,
+  through the GitHub API with the Gitea secret `GH_RELEASE_TOKEN` (fine-grained, this repo, Contents read and write).
+  Without the secret the badge stays "running". Gitea's own badge can't show these runs (they run on a tag ref).
+- **Release notes are generated, not written by hand** (iso-1): the CachyOS base version (first line of CHANGELOG.md), the
+  Steamify version's own changelog section (steamify-cachyos CHANGELOG.md at the ref or tag it is built from) and this
+  repository's commits since the previous release of the same kind (newest 40). iso-2 takes the same text from the GitHub
+  release for the mirror's release (one source), without the badge line, and adds the checksum line. The old hand-written
+  "## CachyOS with Steamify Live ISO" section in CHANGELOG.md is no longer used.
+- **Release title:** `CachyOS <base> with Steamify <version> (<YYYY.MM.DD> UTC)` (dev: `(test build <date> UTC)`), the same on GitHub
+  and on the mirror; `<base>` is the first line of CHANGELOG.md (e.g. 26.08).