xavierk/voculinux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

fix(release): attach the snap to GitHub Releases (#839)

Browse Source 
* fix(release): attach the snap to GitHub Releases

v0.17.0 packed the snap, then Store review of uinput failed the job, so
the file never reached the tag. Build and attach first. A Store hold is
a warning, not a failed release. SHA256SUMS covers the .snap.

snap-backfill.yml rebuilds an existing tag, appends the snap to the
manifest, and attests only that file.

* fix(release): keep snap tags out of the shell and fail real Store errors

Pass the tag through the environment like verify-release.yml. Treat only
an allow-installation review as a successful Store publish. snap-backfill
runs verify_release.py after it rewrites SHA256SUMS.

* style(test): format snap-backfill shell-injection guard with black
This commit is contained in:
Jatin K Malik
2026-09-16 19:40:13 -07:00
committed by GitHub
parent 47dd983def
commit 1f121546fb
10 changed files with 321 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/RELEASE_PROCESS.md
+18 -8
View File
@@ -88,7 +88,9 @@ Install `just` from https://just.systems or the distro package `just`.
`verify-release.yml` runs the same check when the release workflow finishes.
It cannot see a hand edit made afterwards, which is how every v0.16.2 defect
arrived, so run it yourself after touching a published release.
arrived, so run it yourself after touching a published release. The one
exception is `snap-backfill.yml`: that workflow attaches the snap, rewrites
`SHA256SUMS`, and then runs `scripts/verify_release.py` itself.
## Detailed Release Steps
@@ -166,7 +168,8 @@ Use these rules for every GitHub Release body (and for the draft pasted into the
5. `## Bug Fixes` - group by area (IBus, Installer, AUR, Text injection, …)
6. Optional: `## Improvements`, `## Docs`, `## Packaging`
7. `## Thanks` - external PR authors and issue reporters by `@handle`
8. `## Install / Upgrade` - `install.sh`, AUR, PyPI, **AppImage**, Flatpak status (honest)
8. `## Install / Upgrade` - `install.sh`, AUR, PyPI, **AppImage**, Flatpak, Snap
(Store channels plus GitHub `.snap` sideload when Store review is pending)
9. `### Verifying what you downloaded` (required, and easy to lose). `release.yml`
generates it, with `sha256sum -c --ignore-missing SHA256SUMS` and
`gh attestation verify`. A hand-written body replaces the generated one, so carry
@@ -380,21 +383,28 @@ After pushing the tag, the GitHub Actions workflow will automatically:
rebuilding, so the wheel on PyPI is byte-for-byte the wheel on the release
2. Build and attach AppImages for x86_64 and aarch64, both from that same wheel
3. Create a GitHub Release with auto-generated notes
4. Attach `SHA256SUMS` covering all four artifacts, and generate build provenance
attestations from that manifest (runs after the aarch64 AppImage lands, so a
partial manifest never gets published)
4. Attach `SHA256SUMS` covering every GitHub asset (wheel, sdist, both AppImages,
both Flatpaks, the amd64 snap) and generate build provenance from that
manifest (runs after the aarch64 AppImage, both Flatpaks, and the snap land,
so a partial manifest never gets published)
5. Publish to PyPI via trusted publishing
6. Publish the AUR package (when the `AUR_SSH_PRIVATE_KEY` secret is configured)
7. Deploy the website to vocalinux.com
8. Mark as pre-release if version contains alpha/beta/rc
8. Build the amd64 snap, attach it to the GitHub Release, and try Snap Store
`edge`/`candidate`. Store human review (for example `uinput` allow-installation)
must not block the GitHub `.snap`. `stable` is still a manual promote
9. Mark as pre-release if version contains alpha/beta/rc
Monitor at: https://github.com/VocaHQ/vocalinux/actions
### Step 9: Post-Release Tasks
- [ ] Verify GitHub Release was created correctly
- [ ] Verify `SHA256SUMS` is attached and lists all four artifacts (wheel, sdist,
both AppImages) - the release notes tell users to run `sha256sum -c` against it
- [ ] Verify `SHA256SUMS` is attached and lists every GitHub asset (wheel, sdist,
both AppImages, both Flatpaks, the amd64 snap) - the release notes tell
users to run `sha256sum -c` against it
- [ ] If the Store held the snap for `uinput` review, confirm the GitHub `.snap`
is still attached and the notes document `snap install --dangerous`
- [ ] Verify provenance: `gh attestation verify <artifact> --repo VocaHQ/vocalinux`
- [ ] Verify PyPI package was published (if applicable), and that its wheel sha256
matches the line for that wheel in `SHA256SUMS`