From f26a241ac6be7e92a4e4a02fdfd3462fe5e05f0e Mon Sep 17 00:00:00 2001
From: Ozan Durgut <ozan.durgut@analog.com>
Date: Tue, 15 Sep 2026 11:01:19 +0200
Subject: [PATCH] .github: prepare releases with annotated tags

Tags created through the GitHub Release UI are lightweight and ignored by
the plain git describe invocation used by setlocalversion. This results in
an invalid VERSION value in /etc/os-release.

Add a manually dispatched workflow that creates an annotated tag for the
selected revision and prepares a draft GitHub Release from that tag. The
draft can then be reviewed and published to trigger the existing release
builds.

Validate published release tags before starting those builds to prevent
artifacts from being generated from lightweight tags.

Fixes: #77
Signed-off-by: Ozan Durgut <ozan.durgut@analog.com>
---
 .github/workflows/prepare-release.yml | 86 +++++++++++++++++++++++++++
 .github/workflows/top-level.yml       | 29 +++++++++
 2 files changed, 115 insertions(+)
 create mode 100644 .github/workflows/prepare-release.yml

diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml
new file mode 100644
index 0000000..f2355c9
--- /dev/null
+++ b/.github/workflows/prepare-release.yml
@@ -0,0 +1,86 @@
+name: Prepare release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Release version, e.g. 2026.02-1.1.2"
+        required: true
+        type: string
+      target:
+        description: "Branch, tag, or commit to release"
+        required: true
+        default: main
+        type: string
+
+permissions:
+  contents: write
+
+concurrency:
+  group: prepare-release
+  cancel-in-progress: false
+
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout release target
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.target }}
+          fetch-depth: 0
+
+      - name: Validate release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.version }}
+        run: |
+          if [[ ! "$VERSION" =~ ^20[0-9]{2}\.[0-9]{2}-[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Invalid release version: $VERSION"
+            exit 1
+          fi
+
+          if git rev-parse --verify --quiet "refs/tags/$VERSION"; then
+            echo "Tag already exists: $VERSION"
+            exit 1
+          fi
+
+          if gh release view "$VERSION" >/dev/null 2>&1; then
+            echo "Release already exists: $VERSION"
+            exit 1
+          fi
+
+      - name: Create annotated tag
+        env:
+          ACTOR: ${{ github.actor }}
+          VERSION: ${{ inputs.version }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email \
+            "41898282+github-actions[bot]@users.noreply.github.com"
+
+          git tag -a "$VERSION" \
+            -m "Release $VERSION (requested by @$ACTOR)"
+          test "$(git cat-file -t "$VERSION")" = tag
+          git push origin "refs/tags/$VERSION"
+
+      - name: Create draft release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.version }}
+        run: |
+          gh release create "$VERSION" \
+            --draft \
+            --generate-notes \
+            --title "$VERSION" \
+            --verify-tag
+
+      - name: Add summary
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          echo "## Release $VERSION prepared" >> "$GITHUB_STEP_SUMMARY"
+          echo >> "$GITHUB_STEP_SUMMARY"
+          echo "Review and publish the draft release to start the release builds." \
+            >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/top-level.yml b/.github/workflows/top-level.yml
index 3e753d5..057ce8e 100644
--- a/.github/workflows/top-level.yml
+++ b/.github/workflows/top-level.yml
@@ -16,7 +16,35 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  validate-release-tag:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout release tag
+        if: ${{ github.event_name == 'release' }}
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Require an annotated release tag
+        if: ${{ github.event_name == 'release' }}
+        env:
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          object_type="$(git cat-file -t "refs/tags/$TAG")"
+          if [ "$object_type" != tag ]; then
+            echo "Release tag $TAG must be annotated; found $object_type"
+            echo "Create and push the tag before publishing the release:"
+            echo "  git tag -a $TAG -m \"Release $TAG\" <commit>"
+            echo "  git push origin $TAG"
+            echo "Then select the existing tag in the GitHub Release UI."
+            exit 1
+          fi
+
   build-buildroot:
+    needs: validate-release-tag
     strategy:
       fail-fast: false
       matrix:
@@ -44,6 +72,7 @@ jobs:
       contents: write
 
   build-mkosi-fedora:
+    needs: validate-release-tag
     uses: ./.github/workflows/fedora.yml
     permissions:
       contents: write