Enable CI, disable CD

.github/workflows/release.yml

@@ -5,168 +5,50 @@ on:
       - 'release'
 concurrency:
   group: ${{ github.workflow }}
-  cancel-in-progress: true
+  cancel-in-progress: false
+
+# Uses only the built-in GITHUB_TOKEN to cut a release on a push to the
+# `release` branch: this bumps the version, then drafts the v<version> release.
+# The draft is published by hand. `release` only ever receives merges from `master`,
+# which test-pr.yml has already tested, so the one thing no CI covers is the merge
+# resolution itself — that is what the human check before publishing is for.
+permissions:
+  contents: write
 
 jobs:
-  draft-release:
-    name: 'Draft Release'
+  release:
+    name: 'Bump version and create release'
     runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.make-release.outputs.version }}
     steps:
-      - name: 'Check out code'
-        uses: actions/checkout@v4
-      - name: 'Make release'
-        id: 'make-release'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -x
-          VERSION=v$(cat package/version)
-          gh release create ${VERSION}                  \
-            --repo runtimeverification/evm-semantics  \
-            --draft                                     \
-            --title ${VERSION}                          \
-            --target ${{ github.sha }}
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-
-  nix-cache:
-    name: 'Populate Nix Caches'
-    strategy:
-      matrix:
-        include:
-          - runner: normal
-          - runner: ARM64
-    runs-on: ${{ matrix.runner }}
-    needs: draft-release
-    steps:
-      - name: 'Check out code'
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.push.head.sha }}
-          fetch-depth: 0
-      - name: 'Build KEVM'
+      - name: 'Check out release branch'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - name: 'Configure git identity'
         run: |
-          GC_DONT_GC=1 nix build --extra-experimental-features 'nix-command flakes' --print-build-logs
-      - name: 'Push KEVM dependencies to nix cache'
-        uses: workflow/nix-shell-action@v3.0.3
-        env:
-          GC_DONT_GC: 1
-          CACHIX_AUTH_TOKEN: '${{ secrets.CACHIX_PUBLIC_TOKEN }}'
-        with:
-          packages: jq
-          script: |
-            kevm=$(nix build --extra-experimental-features 'nix-command flakes' .#kevm --json | jq -r '.[].outputs | to_entries[].value')
-            drv=$(nix-store --query --deriver ${kevm})
-            nix-store --query --requisites --include-outputs ${drv} | cachix push k-framework || true
-      - name: 'Publish KEVM to k-framework-binary cache'
-        uses: workflow/nix-shell-action@v3.0.3
-        env:
-          GC_DONT_GC: '1'
-          CACHIX_AUTH_TOKEN: '${{ secrets.CACHIX_PRIVATE_KFB_TOKEN }}'
-          OWNER_REPO: '${{ github.repository }}'
-          REV: '${{ github.sha }}'
-        with:
-          packages: jq
-          script: |
-            export PATH="$(nix build github:runtimeverification/kup --no-link --json | jq -r '.[].outputs | to_entries[].value')/bin:$PATH"
-            kup publish k-framework-binary .#kevm --keep-days 180 || true
-            # Cachix has not been responding to 'cachix pin' requests made under the hood by kup. Verify the push and pin manually.
-            .github/scripts/check-cachix-pin.sh
-      - name: 'On failure, delete drafted release'
-        if: failure()
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          git config user.name 'github-actions[bot]'
+          git config user.email 'github-actions[bot]@users.noreply.github.com'
+      - name: 'Get uv release'
+        id: uv_release
         run: |
-          set -x
-          VERSION=v$(cat package/version)
-          gh release delete ${VERSION}                  \
-            --repo runtimeverification/evm-semantics  \
-            --yes                                       \
-            --cleanup-tag
-      - name: 'Post failure to channel'
-        if: failure()
-        uses: slackapi/slack-github-action@v1.24.0
-        with:
-          channel-id: "#kevm-notifications"
-          slack-message: "Failed to create KEVM release: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-        env:
-            SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-
-  make-release:
-    name: 'Cut Release'
-    runs-on: ubuntu-latest
-    needs: [draft-release, nix-cache]
-    steps:
-      - name: 'Check out code'
-        uses: actions/checkout@v4
+          echo uv_version=$(cat deps/uv_release) >> "${GITHUB_OUTPUT}"
+      - name: 'Install uv'
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
         with:
-          ref: ${{ github.event.push.head.sha }}
-          fetch-depth: 0
-      - name: 'Make release'
+          version: ${{ steps.uv_release.outputs.uv_version }}
+          # The lock step runs once per release; a restored cache would only add a
+          # writable input to a workflow that publishes.
+          enable-cache: false
+      - name: 'Bump version, commit, push, and draft release'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          set -x
-          VERSION=v$(cat package/version)
-          gh release edit ${VERSION}                    \
-            --repo runtimeverification/evm-semantics  \
-            --draft=false
-      - name: 'Update dependents'
-        run: |
-          set -x
-          VERSION=$(cat package/version)
-          curl --fail                                                          \
-            -X POST                                                            \
-            -H "Accept: application/vnd.github+json"                           \
-            -H "Authorization: Bearer ${{ secrets.JENKINS_GITHUB_PAT }}"       \
-            -H "X-GitHub-Api-Version: 2022-11-28"                              \
-            https://api.github.com/repos/runtimeverification/devops/dispatches \
-            -d '{"event_type":"on-demand-test","client_payload":{"repo":"runtimeverification/evm-semantics","version":"'${VERSION}'"}}'
-
-  gh-pages:
-    name: 'Publish GH Pages'
-    runs-on: ubuntu-latest
-    needs: [make-release]
-    steps:
-      - name: 'Check out gh-pages'
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          submodules: true
-          ref: ${{ github.event.push.head.sha }}
-      - run: |
-         git config --global user.email 'devops@runtimeverification.com'
-         git config --global user.name  'rv-jenkins'
-      - name: 'Publish gh-pages'
-        run: |
-          git checkout -B gh-pages
-          cd web
-          npm install
-          npm run build
-          npm run build-sitemap
-          cd -
-          mv web/public_content ./
-          rm -rf $(find . -maxdepth 1 -not -name public_content -a -not -name .git -a -not -name .gitmodules -a -not -path . -a -not -path .. -a -not -name CNAME)
-          mv public_content/* ./
-          rm -rf public_content
-          git add ./
-          git commit -m 'gh-pages: Updated the website'
-          git merge --strategy ours origin/gh-pages --allow-unrelated-histories
-          git push origin gh-pages
-      - name: 'Post failure to channel'
-        if: failure()
-        uses: slackapi/slack-github-action@v1.24.0
-        with:
-          channel-id: "#kevm-notifications"
-          slack-message: "Failed to create KEVM release: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-        env:
-            SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-      - name: 'Post success to channel'
-        if: success()
-        uses: slackapi/slack-github-action@v1.24.0
-        with:
-          channel-id: "#kevm-notifications"
-          slack-message: "Created KEVM release: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-        env:
-            SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+          set -euxo pipefail
+          ./package/version.sh bump
+          ./package/version.sh sub
+          VERSION="v$(cat package/version)"
+          git commit --all --message "Set Version: ${VERSION}"
+          git push origin HEAD:release
+          gh release create "${VERSION}"     \
+            --draft                          \
+            --title "${VERSION}"             \
+            --target "$(git rev-parse HEAD)" \
+            --generate-notes