The release is built on the maintainer's x86_64 Void host, not in CI. The
bongbetic-ci runner is ARM64 and cannot build the glibc x86_64 package. A tag
push no longer starts the xbps workflow: it is manual dispatch only, and its
header says why.
- build-release.sh release refuses an uncommitted or untracked checkout before
any container starts. It writes BUILT_FROM (the tag and the commit it was
built from), which nothing recorded before.
- publish-release.sh TAG --out-dir DIR publishes a built out-dir to the Gitea
release API in the workflow's order. It refuses unless origin's tag peels to
the BUILT_FROM commit, the sdist digest matches, and the client key is the
committed one. --dry-run runs every check and prints the planned calls
without sending one. The token comes from GITEA_TOKEN or the tea login and is
never printed.
- Tests run both scripts offline against a local bare origin and a stateful
Gitea stand-in.
- docs/RELEASE_PROCESS.md and packaging/void/README.md describe the local
sequence: merge, annotated tag by ref, clean build, dry-run, publish, checksum.
xavierk
dc7e964981