Skip to content

ci: explicit Latest flag + empty-tagset hardening #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
julian-goldstein merged 1 commit into from
Jun 19, 2026
Merged

ci: explicit Latest flag + empty-tagset hardening #20

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 15 additions & 6 deletions .github/workflows/vendor.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,7 +84,8 @@ jobs:
tagpat="^v${mm}(\.[0-9]+)?$" ;;
*) tagpat='^v[0-9]+\.[0-9]+(\.[0-9]+)?$' ;;
esac
prev="$(git tag -l 'v[0-9]*' | grep -E "$tagpat" | sed 's/^v//' | sort -V | tail -1)"
# `|| true` so an empty tag set (no match) doesn't fail under pipefail.
prev="$(git tag -l 'v[0-9]*' | { grep -E "$tagpat" || true; } | sed 's/^v//' | sort -V | tail -1)"
prevtag=""
[ -n "$prev" ] && prevtag="v$prev"
echo "prevtag=$prevtag" >> "$GITHUB_OUTPUT"
Expand Down Expand Up @@ -327,7 +328,8 @@ jobs:
esac
# Clean tags on this line only; suffixed tags (vX.Y.Z-<flavor>) are
# unordered variants and never advance the line.
latest="$(git tag -l 'v[0-9]*' | grep -E "$tagpat" | sed 's/^v//' | sort -V | tail -1)"
# `|| true` so an empty tag set (no match) doesn't fail under pipefail.
latest="$(git tag -l 'v[0-9]*' | { grep -E "$tagpat" || true; } | sed 's/^v//' | sort -V | tail -1)"
flavor="${FLAVOR:-}"
if [ -n "$flavor" ]; then
# A flavor build is an unordered VARIANT of an existing release: it
Expand Down Expand Up @@ -434,11 +436,18 @@ jobs:
cp libbpf-headers.tar.gz dist/libbpf-headers.tar.gz
# qemu for the optional kernel-matrix runner (fetched on demand, not by `make`).
for a in x86_64 aarch64; do cp "qemu-$a.tar.gz" "dist/qemu-$a.tar.gz"; done
# Flavored tags (vX.Y.Z-<flavor>) are opt-in variants — mark them
# prerelease so GitHub never surfaces one as "Latest".
prerelease=""; case "$tag" in *-*) prerelease="--prerelease" ;; esac
# Pick the "Latest" flag explicitly (GitHub's default is recency-based,
# so a release/* back-port cut after a newer mainline release would
# otherwise steal the badge):
# * flavor (vX.Y.Z-<flavor>) -> --prerelease (GitHub never marks it Latest)
# * mainline (master) -> --latest (newest mainline IS Latest)
# * release/* back-port -> --latest=false (can't steal it)
case "$tag" in
*-*) flags="--prerelease --latest=false" ;;
*) if [ "${GITHUB_REF_NAME}" = master ]; then flags="--latest"; else flags="--latest=false"; fi ;;
esac
gh release view "$tag" >/dev/null 2>&1 \
|| gh release create "$tag" --title "$tag" $prerelease \
|| gh release create "$tag" --title "$tag" $flags \
--notes "Static build toolchain $tag — clang/make/git built from source; bpftool/esbuild/libbpf headers re-hosted; qemu for the kernel-matrix runner."
# --clobber so a same-version re-run refreshes assets.
gh release upload "$tag" dist/* --clobber
Expand Down
Loading