@@ -3,7 +3,7 @@ name: vendor-toolchain
33# Build and publish the static toolchain for x86_64 and aarch64: clang, make
44# and git are compiled from source on NATIVE runners per arch (no QEMU — the
55# multi-hour x86_64 LLVM build runs here in normal CI time), while bpftool,
6- # esbuild and the libbpf headers are re-hosted from upstream. All are published
6+ # esbuild, gh and the libbpf headers are re-hosted from upstream. All are published
77# as version-addressed assets on the `toolchain` release, with checksums
88# recorded back into build/versions.env.
99#
8484 tagpat="^v${mm}(\.[0-9]+)?$" ;;
8585 *) tagpat='^v[0-9]+\.[0-9]+(\.[0-9]+)?$' ;;
8686 esac
87- prev="$(git tag -l 'v[0-9]*' | grep -E "$tagpat" | sed 's/^v//' | sort -V | tail -1)"
87+ # `|| true` so an empty tag set (no match) doesn't fail under pipefail.
88+ prev="$(git tag -l 'v[0-9]*' | { grep -E "$tagpat" || true; } | sed 's/^v//' | sort -V | tail -1)"
8889 prevtag=""
8990 [ -n "$prev" ] && prevtag="v$prev"
9091 echo "prevtag=$prevtag" >> "$GITHUB_OUTPUT"
@@ -226,7 +227,7 @@ jobs:
226227 strategy :
227228 fail-fast : false
228229 matrix :
229- tool : [bpftool, veristat, lvh, esbuild]
230+ tool : [bpftool, veristat, lvh, esbuild, gh ]
230231 arch :
231232 - { platform: amd64, name: x86_64 }
232233 - { platform: arm64, name: aarch64 }
@@ -268,7 +269,7 @@ jobs:
268269 # <tool>-<arch> holding one file, so install them all the same way.
269270 # qemu is the exception (a bin/+share tree), packed separately below.
270271 for a in x86_64 aarch64; do
271- for t in clang make git bpftool veristat lvh esbuild; do
272+ for t in clang make git bpftool veristat lvh esbuild gh ; do
272273 install -Dm755 "artifacts/${t}-${a}/${t}" "${a}/${t}"
273274 done
274275 done
@@ -327,7 +328,8 @@ jobs:
327328 esac
328329 # Clean tags on this line only; suffixed tags (vX.Y.Z-<flavor>) are
329330 # unordered variants and never advance the line.
330- latest="$(git tag -l 'v[0-9]*' | grep -E "$tagpat" | sed 's/^v//' | sort -V | tail -1)"
331+ # `|| true` so an empty tag set (no match) doesn't fail under pipefail.
332+ latest="$(git tag -l 'v[0-9]*' | { grep -E "$tagpat" || true; } | sed 's/^v//' | sort -V | tail -1)"
331333 flavor="${FLAVOR:-}"
332334 if [ -n "$flavor" ]; then
333335 # A flavor build is an unordered VARIANT of an existing release: it
@@ -380,7 +382,7 @@ jobs:
380382 # Record the checksum of every binary we publish, so a consumer
381383 # verifies the exact artifact it downloads from our release.
382384 for arch in x86_64 aarch64; do
383- for tool in clang make bpftool veristat lvh esbuild git; do
385+ for tool in clang make bpftool veristat lvh esbuild git gh ; do
384386 s="$(sha256sum "$arch/$tool" | awk '{print $1}')"
385387 key="$(echo "$tool" | tr a-z A-Z)_SHA256_${arch}"
386388 sed -i "s|^${key}=.*|${key}=${s}|" build/versions.env
@@ -429,17 +431,24 @@ jobs:
429431 # Consumers pin this one tag.
430432 mkdir -p dist
431433 for a in x86_64 aarch64; do
432- for t in clang make bpftool veristat lvh esbuild git; do cp "$a/$t" "dist/${t}-${a}"; done
434+ for t in clang make bpftool veristat lvh esbuild git gh ; do cp "$a/$t" "dist/${t}-${a}"; done
433435 done
434436 cp libbpf-headers.tar.gz dist/libbpf-headers.tar.gz
435437 # qemu for the optional kernel-matrix runner (fetched on demand, not by `make`).
436438 for a in x86_64 aarch64; do cp "qemu-$a.tar.gz" "dist/qemu-$a.tar.gz"; done
437- # Flavored tags (vX.Y.Z-<flavor>) are opt-in variants — mark them
438- # prerelease so GitHub never surfaces one as "Latest".
439- prerelease=""; case "$tag" in *-*) prerelease="--prerelease" ;; esac
439+ # Pick the "Latest" flag explicitly (GitHub's default is recency-based,
440+ # so a release/* back-port cut after a newer mainline release would
441+ # otherwise steal the badge):
442+ # * flavor (vX.Y.Z-<flavor>) -> --prerelease (GitHub never marks it Latest)
443+ # * mainline (master) -> --latest (newest mainline IS Latest)
444+ # * release/* back-port -> --latest=false (can't steal it)
445+ case "$tag" in
446+ *-*) flags="--prerelease --latest=false" ;;
447+ *) if [ "${GITHUB_REF_NAME}" = master ]; then flags="--latest"; else flags="--latest=false"; fi ;;
448+ esac
440449 gh release view "$tag" >/dev/null 2>&1 \
441- || gh release create "$tag" --title "$tag" $prerelease \
442- --notes "Static build toolchain $tag — clang/make/git built from source; bpftool/esbuild/libbpf headers re-hosted; qemu for the kernel-matrix runner."
450+ || gh release create "$tag" --title "$tag" $flags \
451+ --notes "Static build toolchain $tag — clang/make/git built from source; bpftool/veristat/ esbuild/gh /libbpf headers re-hosted; qemu for the kernel-matrix runner."
443452 # --clobber so a same-version re-run refreshes assets.
444453 gh release upload "$tag" dist/* --clobber
445454
0 commit comments