fix: ci: keep lotus checkout clean in the release workflow (#12028)

* ci: keep lotus checkout clean in the release workflow

* ci: allow providing custom ref to the release workflow

* ci: fix version check performed during the release

* ci: fix install go step of the release workflow

* ci: fix the working directory for the install go step in release workflow

* ci: provide github ref to lotus scripts explicitly

* ci: use actions from the chosen ref in release workflow

* ci: fix install go in release workflow

* ci: fix artifact upload in release workflow

* ci: set INPUTS_REF variable in release workflow

* ci: fix publish checksums script

* ci: allow releasing docker from an arbitrary ref

* ci: fix docker channel discovery

.github/actions/install-go/action.yml

@@ -1,6 +1,11 @@
 name: Install Go
 description: Install Go for Filecoin Lotus
 
+inputs:
+  working-directory:
+    description: Specifies the working directory where the command is run.
+    required: false
+
 runs:
   using: composite
   steps:
@@ -10,6 +15,8 @@ runs:
         cache: false
     - id: go-mod
       uses: ipdxco/unified-github-workflows/.github/actions/read-go-mod@main
+      with:
+        working-directory: ${{ inputs.working-directory || github.workspace }}
     - uses: actions/setup-go@v5
       with:
         go-version: ${{ fromJSON(steps.go-mod.outputs.json).Go }}.x

.github/workflows/docker.yml

@@ -10,6 +10,10 @@ on:
   schedule:
     - cron: '0 0 * * *'
   workflow_dispatch:
+    inputs:
+      ref:
+        description: The GitHub ref (e.g. refs/tags/v1.0.0) to release
+        required: false
 
 defaults:
   run:
@@ -19,7 +23,7 @@ permissions: {}
 
 jobs:
   docker:
-    name: Docker (${{ matrix.image }} / ${{ matrix.network }}) [publish=${{ github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/') }}]
+    name: Docker (${{ matrix.image }} / ${{ matrix.network }}) [publish=${{ (inputs.ref || github.ref) == 'refs/heads/master' || startsWith(inputs.ref || github.ref, 'refs/tags/') }}]
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -35,13 +39,13 @@ jobs:
           - image: lotus
             network: mainnet
     env:
-      PUBLISH: ${{ github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/') }}
+      PUBLISH: ${{ github.ref == 'refs/heads/master' || startsWith(inputs.ref || github.ref, 'refs/tags/') }}
     steps:
       - id: channel
         env:
-          IS_MASTER: ${{ github.ref == 'refs/heads/master' }}
-          IS_TAG: ${{ startsWith(github.ref, 'refs/tags/') }}
-          IS_RC: ${{ endsWith(github.ref, '-rc') }}
+          IS_MASTER: ${{ (inputs.ref || github.ref) == 'refs/heads/master' }}
+          IS_TAG: ${{ startsWith(inputs.ref || github.ref, 'refs/tags/') }}
+          IS_RC: ${{ contains(inputs.ref || github.ref, '-rc') }}
           IS_SCHEDULED: ${{ github.event_name == 'schedule' }}
         run: |
           channel=''
@@ -58,10 +62,11 @@ jobs:
               channel=stable
             fi
           fi
-          echo "channel=$channel" | tee -a $GITHUB_ENV
+          echo "channel=$channel" | tee -a $GITHUB_OUTPUT
       - uses: actions/checkout@v4
         with:
           submodules: 'recursive'
+          ref: ${{ inputs.ref || github.ref }}
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Docker meta

.github/workflows/release.yml

@@ -8,6 +8,10 @@ on:
     tags:
       - v*
   workflow_dispatch:
+    inputs:
+      ref:
+        description: The GitHub ref (e.g. refs/tags/v1.0.0) to release
+        required: false
 
 defaults:
   run:
@@ -41,38 +45,57 @@ jobs:
             echo "::error title=Unexpected Runner::Expected $OS/$ARCH, got $RUNNER_OS/$RUNNER_ARCH"
             exit 1
           fi
+      - uses: actions/checkout@v4
+        with:
+          path: actions
       - uses: actions/checkout@v4
         with:
           submodules: 'recursive'
-      - uses: ./.github/actions/install-system-dependencies
-      - uses: ./.github/actions/install-go
+          ref: ${{ inputs.ref || github.ref }}
+          path: lotus
+      - uses: ./actions/.github/actions/install-system-dependencies
+      - uses: ./actions/.github/actions/install-go
+        with:
+          working-directory: lotus
       - env:
           GITHUB_TOKEN: ${{ github.token }}
         run: make deps lotus lotus-miner lotus-worker
+        working-directory: lotus
       - if: runner.os == 'macOS'
         run: otool -hv lotus
-      - run: ./scripts/version-check.sh ./lotus
+        working-directory: lotus
+      - env:
+          INPUTS_REF: ${{ inputs.ref }}
+        run: |
+          export GITHUB_REF=${INPUTS_REF:-$GITHUB_REF}
+          ../actions/scripts/version-check.sh ./lotus
+        working-directory: lotus
       - uses: actions/upload-artifact@v4
         with:
           name: lotus-${{ matrix.os }}-${{ matrix.arch }}
           path: |
-            lotus
-            lotus-miner
-            lotus-worker
+            lotus/lotus
+            lotus/lotus-miner
+            lotus/lotus-worker
   release:
-    name: Release [publish=${{ startsWith(github.ref, 'refs/tags/') }}]
+    name: Release [publish=${{ startsWith(inputs.ref || github.ref, 'refs/tags/') }}]
     permissions:
       # This enables the job to create and/or update GitHub releases
       contents: write
     runs-on: ubuntu-latest
     needs: [build]
     env:
-      PUBLISH: ${{ startsWith(github.ref, 'refs/tags/') }}
+      PUBLISH: ${{ startsWith(inputs.ref || github.ref, 'refs/tags/') }}
     steps:
+      - uses: actions/checkout@v4
+        with:
+          path: actions
       - uses: actions/checkout@v4
         with:
           submodules: 'recursive'
           fetch-depth: 0
+          path: lotus
+          ref: ${{ inputs.ref || github.ref }}
       - uses: actions/download-artifact@v4
         with:
           name: lotus-Linux-X64
@@ -85,7 +108,9 @@ jobs:
         with:
           name: lotus-macOS-ARM64
           path: darwin_arm64
-      - uses: ./.github/actions/install-go
+      - uses: ./actions/.github/actions/install-go
+        with:
+          working-directory: lotus
       - uses: ipfs/download-ipfs-distribution-action@v1
         with:
           name: kubo
@@ -95,11 +120,21 @@ jobs:
           distribution: goreleaser-pro
           version: latest
           args: release --clean --debug ${{ env.PUBLISH == 'false' && '--snapshot' || '' }}
+          workdir: lotus
         env:
           GITHUB_TOKEN: ${{ env.PUBLISH == 'true' && github.token || '' }}
           GORELEASER_KEY: ${{ env.PUBLISH == 'true' && secrets.GORELEASER_KEY || '' }}
-      - run: ./scripts/generate-checksums.sh
+      - env:
+          INPUTS_REF: ${{ inputs.ref }}
+        run: |
+          export GITHUB_REF=${INPUTS_REF:-$GITHUB_REF}
+          ../actions/scripts/generate-checksums.sh
+        working-directory: lotus
       - if: env.PUBLISH == 'true'
         env:
           GITHUB_TOKEN: ${{ github.token }}
-        run: ./scripts/publish-checksums.sh
+          INPUTS_REF: ${{ inputs.ref }}
+        run: |
+          export GITHUB_REF=${INPUTS_REF:-$GITHUB_REF}
+          ../actions/scripts/publish-checksums.sh
+        working-directory: lotus

scripts/publish-checksums.sh

@@ -9,7 +9,7 @@ if [ -z "${GITHUB_TOKEN}" ]; then
   exit 1
 fi
 
-if [ "$GITHUB_REF" != refs/tags/* ]; then
+if [[ "$GITHUB_REF" != refs/tags/* ]]; then
   echo "$GITHUB_REF is not a tag, publish failed"
   exit 1
 fi

scripts/version-check.sh

@@ -32,7 +32,7 @@ function validate_lotus_version_matches_tag(){
 
 _lotus_path=$1
 
-if [[ "$GITHUB_REF" != refs/tags/* ]]; then
+if [[ "$GITHUB_REF" == refs/tags/* ]]; then
   validate_lotus_version_matches_tag "${_lotus_path}" "${GITHUB_REF#refs/tags/}"
 else
   echo "$GITHUB_REF is not a tag, skipping version check"