revise build workflow (#262)

* change build to tags

* more changes

* d

---------

Co-authored-by: Meliox <na>

.github/workflows/create-release-tag.yml

@@ -0,0 +1,36 @@
+name: Tag Release
+
+# Triggered when the chore/version-bump PR is merged to main.
+# debian/changelog is already on main from the merged PR — just create the tag.
+# release.yml triggers on the tag push and builds the release.
+
+on:
+  pull_request:
+    types:
+      - closed
+    branches:
+      - main
+
+permissions:
+  contents: write
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    if: |
+      github.event.pull_request.merged == true &&
+      github.event.pull_request.head.ref == 'chore/version-bump'
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create and push tag
+        run: |
+          VERSION=$(grep -m1 '(' debian/changelog | sed 's/.*(\(.*\)).*/\1/')
+          git config user.name  "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag "v${VERSION}"
+          git push origin "v${VERSION}"

.github/workflows/pr-create.yml

@@ -1,10 +1,10 @@
 name: Open / Update Version Bump PR
 
-# Triggered when any PR merges to main touching src/ or debian/.
-# Accumulates changes on chore/version-bump branch by appending to CHANGES.md.
-# Opens the bump PR if it doesn't exist, updates body if it does.
-# Label is never changed on update — preserving manual bump:minor / bump:major.
-# Bot guard prevents firing on the changelog commit from version-bump.yml.
+# Triggered when any PR merges to main touching src/ or debian/ (push),
+# or when a bump:* label is added to the chore/version-bump PR (labeled).
+# Accumulates changes in CHANGES.md, writes debian/changelog with the correct
+# bumped version, and keeps the PR body up to date.
+# On label change the changelog entry is rewritten with the new version.
 
 on:
   push:
@@ -13,6 +13,11 @@ on:
     paths:
       - 'src/**'
       - 'debian/**'
+  pull_request:
+    types:
+      - labeled
+    branches:
+      - main
 
 permissions:
   contents: write
@@ -21,7 +26,11 @@ permissions:
 jobs:
   pr:
     runs-on: ubuntu-latest
-    if: github.actor != 'github-actions[bot]'
+    if: |
+      (github.event_name == 'push' && github.actor != 'github-actions[bot]') ||
+      (github.event_name == 'pull_request' &&
+       github.event.pull_request.head.ref == 'chore/version-bump' &&
+       startsWith(github.event.label.name, 'bump:'))
 
     steps:
       - uses: actions/checkout@v7
@@ -29,8 +38,9 @@ jobs:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Collect src/ commits from this merge
-        id: commits
+      - name: Collect new commits (push only)
+        id: new_commits
+        if: github.event_name == 'push'
         run: |
           LOG=$(git log "HEAD~1..HEAD" --oneline -- src/ | head -50)
           EOF=$(openssl rand -hex 16)
@@ -38,14 +48,13 @@ jobs:
           echo "$LOG"      >> "$GITHUB_OUTPUT"
           echo "$EOF"      >> "$GITHUB_OUTPUT"
 
-      - name: Update chore/version-bump branch
+      - name: Set up chore/version-bump branch
         env:
-          COMMITS: ${{ steps.commits.outputs.log }}
+          NEW_COMMITS: ${{ steps.new_commits.outputs.log }}
         run: |
           git config user.name  "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
-          # Always rebase the bump branch on the latest main so the PR is testable
           git fetch origin main
           if git fetch origin chore/version-bump 2>/dev/null; then
             git checkout chore/version-bump
@@ -54,36 +63,106 @@ jobs:
             git checkout -b chore/version-bump origin/main
           fi
 
-          # Append this merge's changes to the top of CHANGES.md
-          mkdir -p .github/version-bump
-          PREV=$(cat .github/version-bump/CHANGES.md 2>/dev/null || true)
+          if [[ "${{ github.event_name }}" == "push" ]]; then
+            mkdir -p .github/version-bump
+            PREV=$(cat .github/version-bump/CHANGES.md 2>/dev/null || true)
+            {
+              echo "${NEW_COMMITS:-No src/ changes detected.}"
+              [[ -n "$PREV" ]] && echo "$PREV"
+            } > .github/version-bump/CHANGES.md
+            git add .github/version-bump/CHANGES.md
+            MAIN_SHA=$(git rev-parse --short origin/main)
+            git commit -m "chore: accumulate changes from ${MAIN_SHA}"
+            git push --force-with-lease origin chore/version-bump
+          fi
+
+      - name: Determine bump type
+        id: bump_type
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            LABEL="${{ github.event.label.name }}"
+          else
+            # Use existing PR label if present, otherwise default to patch
+            LABEL=$(gh pr list \
+              --head "chore/version-bump" \
+              --base main \
+              --json labels \
+              --jq '.[0].labels[].name' 2>/dev/null | grep '^bump:' | head -1 || echo "bump:patch")
+          fi
+
+          if [[ "$LABEL" == "bump:major" ]]; then
+            echo "type=major" >> "$GITHUB_OUTPUT"
+          elif [[ "$LABEL" == "bump:minor" ]]; then
+            echo "type=minor" >> "$GITHUB_OUTPUT"
+          else
+            echo "type=patch" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Compute new version
+        id: version
+        env:
+          BUMP_TYPE: ${{ steps.bump_type.outputs.type }}
+        run: |
+          # Always base version on main's latest tag to avoid double-bumping on reruns
+          CURRENT=$(git describe --tags --abbrev=0 origin/main 2>/dev/null | sed 's/^v//' \
+            || git show origin/main:debian/changelog | grep -m1 '(' | sed 's/.*(\(.*\)).*/\1/')
+          MAJOR=$(echo "$CURRENT" | cut -d. -f1)
+          MINOR=$(echo "$CURRENT" | cut -d. -f2)
+          PATCH=$(echo "$CURRENT" | cut -d. -f3)
+
+          if [[ "$BUMP_TYPE" == "major" ]]; then
+            NEW="$((MAJOR + 1)).0.0"
+          elif [[ "$BUMP_TYPE" == "minor" ]]; then
+            NEW="${MAJOR}.$((MINOR + 1)).0"
+          else
+            NEW="${MAJOR}.${MINOR}.$((PATCH + 1))"
+          fi
+
+          echo "Bumping $CURRENT → $NEW ($BUMP_TYPE)"
+          echo "new=$NEW" >> "$GITHUB_OUTPUT"
+
+      - name: Write debian/changelog
+        env:
+          NEW_VERSION: ${{ steps.version.outputs.new }}
+        run: |
+          LOG=$(cat .github/version-bump/CHANGES.md 2>/dev/null || true)
+          DATE=$(date -R)
+          # Base on main's changelog so reruns always replace the previous bot entry cleanly
+          MAIN_CHANGELOG=$(git show origin/main:debian/changelog)
           {
-            echo "${COMMITS:-No src/ changes detected.}"
-            echo "$PREV"
-          } > .github/version-bump/CHANGES.md
-
-          git add .github/version-bump/CHANGES.md
-          MAIN_SHA=$(git rev-parse --short origin/main)
-          git commit -m "chore: accumulate changes from ${MAIN_SHA}"
-
-          # Rebase rewrites history, so the push must be a force (lease-guarded).
+            echo "pve-mod ($NEW_VERSION) stable; urgency=low"
+            echo ""
+            while IFS= read -r line; do
+              [[ -n "$line" ]] && echo "  * $line"
+            done <<< "$LOG"
+            [[ -z "$LOG" ]] && echo "  * Automated version bump."
+            echo ""
+            echo " -- github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>  $DATE"
+            echo ""
+            echo "$MAIN_CHANGELOG"
+          } > debian/changelog
+          git add debian/changelog
+          git diff --cached --quiet || git commit -m "chore: update changelog to v${NEW_VERSION}"
           git push --force-with-lease origin chore/version-bump
 
-      - name: Build PR body from accumulated changes
+      - name: Build PR body
+        env:
+          NEW_VERSION: ${{ steps.version.outputs.new }}
         run: |
-          VERSION=$(grep -m1 '(' debian/changelog | sed 's/.*(\(.*\)).*/\1/')
           {
-            echo "## Pending changes for next release (current: v${VERSION})"
+            echo "## Release v${NEW_VERSION}"
             echo ""
-            cat .github/version-bump/CHANGES.md
+            cat .github/version-bump/CHANGES.md 2>/dev/null || echo "No changes recorded."
             echo ""
             echo "---"
             echo "*Change label to \`bump:minor\` or \`bump:major\` before merging if needed.*"
-            echo "*Default is \`bump:patch\`.*"
             echo "*Merge this PR when ready to release.*"
           } > /tmp/pr-body.md
 
-      - name: Create or update version bump PR
+      - name: Create or update PR (push)
+        if: github.event_name == 'push'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
@@ -96,9 +175,7 @@ jobs:
             --json number --jq '.[0].number' 2>/dev/null || true)
 
           if [[ -n "$EXISTING" ]]; then
-            gh pr edit "$EXISTING" \
-              --title "$TITLE" \
-              --body-file /tmp/pr-body.md
+            gh pr edit "$EXISTING" --title "$TITLE" --body-file /tmp/pr-body.md
             echo "Updated PR #${EXISTING} (label unchanged)"
           else
             gh pr create \
@@ -107,5 +184,13 @@ jobs:
               --base main \
               --head "$BUMP_BRANCH" \
               --label "bump:patch"
-            echo "Opened new version bump PR with label bump:patch"
-          fi
+            echo "Opened new PR with label bump:patch"
+          fi
+
+      - name: Update PR body (label change)
+        if: github.event_name == 'pull_request'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          gh pr edit "$PR_NUMBER" --body-file /tmp/pr-body.md

.github/workflows/prepare-release-pr.yml

@@ -0,0 +1,196 @@
+name: Open / Update Version Bump PR
+
+# Triggered when any PR merges to main touching src/ or debian/ (push),
+# or when a bump:* label is added to the chore/version-bump PR (labeled).
+# Accumulates changes in CHANGES.md, writes debian/changelog with the correct
+# bumped version, and keeps the PR body up to date.
+# On label change the changelog entry is rewritten with the new version.
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'src/**'
+      - 'debian/**'
+  pull_request:
+    types:
+      - labeled
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  pr:
+    runs-on: ubuntu-latest
+    if: |
+      (github.event_name == 'push' && github.actor != 'github-actions[bot]') ||
+      (github.event_name == 'pull_request' &&
+       github.event.pull_request.head.ref == 'chore/version-bump' &&
+       startsWith(github.event.label.name, 'bump:'))
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Collect new commits (push only)
+        id: new_commits
+        if: github.event_name == 'push'
+        run: |
+          LOG=$(git log "HEAD~1..HEAD" --oneline -- src/ | head -50)
+          EOF=$(openssl rand -hex 16)
+          echo "log<<$EOF" >> "$GITHUB_OUTPUT"
+          echo "$LOG"      >> "$GITHUB_OUTPUT"
+          echo "$EOF"      >> "$GITHUB_OUTPUT"
+
+      - name: Set up chore/version-bump branch
+        env:
+          NEW_COMMITS: ${{ steps.new_commits.outputs.log }}
+        run: |
+          git config user.name  "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+          git fetch origin main
+          if git fetch origin chore/version-bump 2>/dev/null; then
+            git checkout chore/version-bump
+            git rebase origin/main
+          else
+            git checkout -b chore/version-bump origin/main
+          fi
+
+          if [[ "${{ github.event_name }}" == "push" ]]; then
+            mkdir -p .github/version-bump
+            PREV=$(cat .github/version-bump/CHANGES.md 2>/dev/null || true)
+            {
+              echo "${NEW_COMMITS:-No src/ changes detected.}"
+              [[ -n "$PREV" ]] && echo "$PREV"
+            } > .github/version-bump/CHANGES.md
+            git add .github/version-bump/CHANGES.md
+            MAIN_SHA=$(git rev-parse --short origin/main)
+            git commit -m "chore: accumulate changes from ${MAIN_SHA}"
+            git push --force-with-lease origin chore/version-bump
+          fi
+
+      - name: Determine bump type
+        id: bump_type
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            LABEL="${{ github.event.label.name }}"
+          else
+            # Use existing PR label if present, otherwise default to patch
+            LABEL=$(gh pr list \
+              --head "chore/version-bump" \
+              --base main \
+              --json labels \
+              --jq '.[0].labels[].name' 2>/dev/null | grep '^bump:' | head -1 || echo "bump:patch")
+          fi
+
+          if [[ "$LABEL" == "bump:major" ]]; then
+            echo "type=major" >> "$GITHUB_OUTPUT"
+          elif [[ "$LABEL" == "bump:minor" ]]; then
+            echo "type=minor" >> "$GITHUB_OUTPUT"
+          else
+            echo "type=patch" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Compute new version
+        id: version
+        env:
+          BUMP_TYPE: ${{ steps.bump_type.outputs.type }}
+        run: |
+          # Always base version on main's latest tag to avoid double-bumping on reruns
+          CURRENT=$(git describe --tags --abbrev=0 origin/main 2>/dev/null | sed 's/^v//' \
+            || git show origin/main:debian/changelog | grep -m1 '(' | sed 's/.*(\(.*\)).*/\1/')
+          MAJOR=$(echo "$CURRENT" | cut -d. -f1)
+          MINOR=$(echo "$CURRENT" | cut -d. -f2)
+          PATCH=$(echo "$CURRENT" | cut -d. -f3)
+
+          if [[ "$BUMP_TYPE" == "major" ]]; then
+            NEW="$((MAJOR + 1)).0.0"
+          elif [[ "$BUMP_TYPE" == "minor" ]]; then
+            NEW="${MAJOR}.$((MINOR + 1)).0"
+          else
+            NEW="${MAJOR}.${MINOR}.$((PATCH + 1))"
+          fi
+
+          echo "Bumping $CURRENT → $NEW ($BUMP_TYPE)"
+          echo "new=$NEW" >> "$GITHUB_OUTPUT"
+
+      - name: Write debian/changelog
+        env:
+          NEW_VERSION: ${{ steps.version.outputs.new }}
+        run: |
+          LOG=$(cat .github/version-bump/CHANGES.md 2>/dev/null || true)
+          DATE=$(date -R)
+          # Base on main's changelog so reruns always replace the previous bot entry cleanly
+          MAIN_CHANGELOG=$(git show origin/main:debian/changelog)
+          {
+            echo "pve-mod ($NEW_VERSION) stable; urgency=low"
+            echo ""
+            while IFS= read -r line; do
+              [[ -n "$line" ]] && echo "  * $line"
+            done <<< "$LOG"
+            [[ -z "$LOG" ]] && echo "  * Automated version bump."
+            echo ""
+            echo " -- github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>  $DATE"
+            echo ""
+            echo "$MAIN_CHANGELOG"
+          } > debian/changelog
+          git add debian/changelog
+          git diff --cached --quiet || git commit -m "chore: update changelog to v${NEW_VERSION}"
+          git push --force-with-lease origin chore/version-bump
+
+      - name: Build PR body
+        env:
+          NEW_VERSION: ${{ steps.version.outputs.new }}
+        run: |
+          {
+            echo "## Release v${NEW_VERSION}"
+            echo ""
+            cat .github/version-bump/CHANGES.md 2>/dev/null || echo "No changes recorded."
+            echo ""
+            echo "---"
+            echo "*Change label to \`bump:minor\` or \`bump:major\` before merging if needed.*"
+            echo "*Merge this PR when ready to release.*"
+          } > /tmp/pr-body.md
+
+      - name: Create or update PR (push)
+        if: github.event_name == 'push'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          BUMP_BRANCH="chore/version-bump"
+          TITLE="chore: release next version"
+
+          EXISTING=$(gh pr list \
+            --head "$BUMP_BRANCH" \
+            --base main \
+            --json number --jq '.[0].number' 2>/dev/null || true)
+
+          if [[ -n "$EXISTING" ]]; then
+            gh pr edit "$EXISTING" --title "$TITLE" --body-file /tmp/pr-body.md
+            echo "Updated PR #${EXISTING} (label unchanged)"
+          else
+            gh pr create \
+              --title "$TITLE" \
+              --body-file /tmp/pr-body.md \
+              --base main \
+              --head "$BUMP_BRANCH" \
+              --label "bump:patch"
+            echo "Opened new PR with label bump:patch"
+          fi
+
+      - name: Update PR body (label change)
+        if: github.event_name == 'pull_request'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          gh pr edit "$PR_NUMBER" --body-file /tmp/pr-body.md

.github/workflows/release.yml

@@ -1,15 +1,12 @@
 name: Build and Release
 
-# Triggered when debian/changelog changes on main — meaning version-bump.yml
-# just committed a new version. Builds the .deb, signs it, and publishes a GitHub Release.
-# The actor guard ensures this only fires for the bot's changelog commit.
+# Triggered when version-bump.yml pushes a vX.Y.Z tag.
+# Builds the .deb, signs it, and publishes a GitHub Release.
 
 on:
   push:
-    branches:
-      - main
-    paths:
-      - 'debian/changelog'
+    tags:
+      - 'v*'
 
 permissions:
   contents: write
@@ -22,6 +19,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         with:
+          ref: ${{ github.ref }}
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/version-bump.yml

@@ -1,10 +1,8 @@
-name: Version Bump
+name: Tag Release
 
 # Triggered when the chore/version-bump PR is merged to main.
-# Reads the bump:patch / bump:minor / bump:major label from the merged PR.
-# Updates debian/changelog and commits to main.
-# Cleans up the CHANGES.md accumulator file in the same commit.
-# release.yml picks up the changelog change and builds the release.
+# debian/changelog is already on main from the merged PR — just create the tag.
+# release.yml triggers on the tag push and builds the release.
 
 on:
   pull_request:
@@ -17,7 +15,7 @@ permissions:
   contents: write
 
 jobs:
-  bump:
+  tag:
     runs-on: ubuntu-latest
     if: |
       github.event.pull_request.merged == true &&
@@ -29,81 +27,10 @@ jobs:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Determine bump type from PR label
-        id: bump_type
-        env:
-          GH_TOKEN:  ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          LABELS=$(gh pr view "$PR_NUMBER" --json labels --jq '[.labels[].name] | join(",")')
-          echo "Labels found: $LABELS"
-
-          if echo "$LABELS" | grep -q 'bump:major'; then
-            echo "type=major" >> "$GITHUB_OUTPUT"
-          elif echo "$LABELS" | grep -q 'bump:minor'; then
-            echo "type=minor" >> "$GITHUB_OUTPUT"
-          else
-            echo "type=patch" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Extract and bump version
-        id: version
-        env:
-          BUMP_TYPE: ${{ steps.bump_type.outputs.type }}
-        run: |
-          CURRENT=$(grep -m1 '(' debian/changelog | sed 's/.*(\(.*\)).*/\1/')
-          MAJOR=$(echo "$CURRENT" | cut -d. -f1)
-          MINOR=$(echo "$CURRENT" | cut -d. -f2)
-          PATCH=$(echo "$CURRENT" | cut -d. -f3)
-
-          if [[ "$BUMP_TYPE" == "major" ]]; then
-            NEW="$((MAJOR + 1)).0.0"
-          elif [[ "$BUMP_TYPE" == "minor" ]]; then
-            NEW="${MAJOR}.$((MINOR + 1)).0"
-          else
-            NEW="${MAJOR}.${MINOR}.$((PATCH + 1))"
-          fi
-
-          echo "Bumping $CURRENT → $NEW ($BUMP_TYPE)"
-          echo "current=$CURRENT" >> "$GITHUB_OUTPUT"
-          echo "new=$NEW"         >> "$GITHUB_OUTPUT"
-
-      - name: Collect accumulated changes
-        id: commits
-        run: |
-          # Read from the CHANGES.md that was merged in
-          LOG=$(cat .github/version-bump/CHANGES.md 2>/dev/null || true)
-          EOF=$(openssl rand -hex 16)
-          echo "log<<$EOF" >> "$GITHUB_OUTPUT"
-          echo "$LOG"      >> "$GITHUB_OUTPUT"
-          echo "$EOF"      >> "$GITHUB_OUTPUT"
-
-      - name: Prepend new changelog entry
-        env:
-          NEW_VERSION: ${{ steps.version.outputs.new }}
-          COMMITS:     ${{ steps.commits.outputs.log }}
-        run: |
-          DATE=$(date -R)
-          {
-            echo "pve-mod ($NEW_VERSION) stable; urgency=low"
-            echo ""
-            while IFS= read -r line; do
-              [[ -n "$line" ]] && echo "  * $line"
-            done <<< "$COMMITS"
-            [[ -z "$COMMITS" ]] && echo "  * Automated version bump."
-            echo ""
-            echo " -- github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>  $DATE"
-            echo ""
-            cat debian/changelog
-          } > debian/changelog.new
-          mv debian/changelog.new debian/changelog
-
-      - name: Commit changelog and clean up accumulator
+      - name: Create and push tag
         run: |
+          VERSION=$(grep -m1 '(' debian/changelog | sed 's/.*(\(.*\)).*/\1/')
           git config user.name  "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git checkout -b release/v${{ steps.version.outputs.new }}
-          git add debian/changelog
-          git rm --ignore-unmatch .github/version-bump/CHANGES.md
-          git commit -m "Release v${{ steps.version.outputs.new }}"
-          git push -u origin release/v${{ steps.version.outputs.new }}
+          git tag "v${VERSION}"
+          git push origin "v${VERSION}"