# quarry's release (RFC 0020 §releases): a tag version-X.Y.Z on a trunk
# check-in builds X.Y.Z and publishes it to this repository's unversioned
# files under releases/X.Y.Z/, where deploy.sh --release X.Y.Z fetches it.
# To repeat a release whose publish failed, cancel the tag and add it
# again: release.sh skips what the forge already holds. There is no
# workflow_dispatch, so a Re-run of any check-in does not start a release
# job that can only refuse.
#
# The job publishes with a run token (RFC 0021 §runs), never an account:
# uv: write is y, which the release environment allows (allowed "y",
# starter "a", branches trunk; docs/running.md, "Cutting a release"), so a
# tag pushed by someone without a on quarry builds and cannot publish. The
# token reaches only a runner started with --job-users, and only
# quarry-runner-release polls quarry.job (scripts/systemd).
on:
tag:
tags: [version-*]
permissions:
contents: read
uv: write
jobs:
release:
environment: release
timeout-minutes: 60
env:
# The pinned zit's tarballs on the release runner's machine, as
# quarry-runner.service gives CI (scripts/ci-zit.sh).
ZIT_RELEASE_DIR: /home/dmestas/zit-release
# The forge on the same machine: no trip out through the edge.
RELEASE_URL: http://127.0.0.1:8950/r/quarry
steps:
- name: release
run: sh scripts/release.sh "${QUARRY_TAG#version-}"