ci: publish a draft release from the artifacts that CI already built

The Linux, macOS and Windows workflows build every file that a release
needs when the release branch is pushed. The new Release workflow finds
those runs for the tagged commit, waits for them, and collects their nine
files into a draft release. It builds nothing, so what ships is what was
tested.

The release notes come from the CHANGELOG.md entry for that version.

Signed-off-by: Ron Evans <ron@hybridgroup.com>

.dockerignore

@@ -1,4 +1,4 @@
 build/
 llvm-*/
-!llvm-version.txt
 .github
+

.github/workflows/build-macos.yml

@@ -46,7 +46,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-source
         with:
-          key: llvm-source-22-${{ matrix.os }}-v1-${{ hashFiles('llvm-version.txt') }}
+          key: llvm-source-22-${{ matrix.os }}-v1
           path: |
             llvm-project/clang/lib/Headers
             llvm-project/clang/include
@@ -71,7 +71,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-build
         with:
-          key: llvm-build-22-${{ matrix.os }}-v1-${{ hashFiles('llvm-version.txt') }}
+          key: llvm-build-22-${{ matrix.os }}-v1
           path: llvm-build
       - name: Build LLVM
         if: steps.cache-llvm-build.outputs.cache-hit != 'true'

.github/workflows/compat.yml

@@ -46,7 +46,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-source
         with:
-          key: llvm-source-22-linux-compat-${{ hashFiles('llvm-version.txt') }}
+          key: llvm-source-22-linux-compat
           path: llvm-project/compiler-rt
       - name: Download LLVM source
         if: steps.cache-llvm-source.outputs.cache-hit != 'true'

.github/workflows/docker.yml

@@ -64,5 +64,5 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=registry,ref=ghcr.io/${{ github.repository_owner }}/tinygo-dev:buildcache
-          cache-to: type=registry,ref=ghcr.io/${{ github.repository_owner }}/tinygo-dev:buildcache,mode=max
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/extract-changelog.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+
+# Print the CHANGELOG.md entry for one version, to use as release notes.
+# The file uses a setext heading: the bare version, then a line of dashes.
+
+set -e
+
+version="$1"
+if [ -z "$version" ]; then
+	echo "usage: $0 <version>" >&2
+	exit 1
+fi
+
+notes=$(awk -v version="$version" '
+	found {
+		if ($0 ~ /^---+$/ && previous != "") { previous = ""; exit }
+		if (previous != "") print previous
+		previous = $0
+		next
+	}
+	$0 ~ /^---+$/ && previous == version {
+		found = 1
+		previous = ""
+		next
+	}
+	{ previous = $0 }
+	END { if (found && previous != "") print previous }
+' CHANGELOG.md)
+
+if [ -z "$notes" ]; then
+	echo "no CHANGELOG.md entry for version $version" >&2
+	exit 1
+fi
+
+echo "$notes"

.github/workflows/linux.yml

@@ -66,7 +66,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-source
         with:
-          key: llvm-source-22-linux-alpine-v1-${{ hashFiles('llvm-version.txt') }}
+          key: llvm-source-22-linux-alpine-v1
           path: |
             llvm-project/clang/lib/Headers
             llvm-project/clang/include
@@ -91,7 +91,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-build
         with:
-          key: llvm-build-22-linux-alpine-v1-${{ hashFiles('llvm-version.txt') }}
+          key: llvm-build-22-linux-alpine-v1
           path: llvm-build
       - name: Build LLVM
         if: steps.cache-llvm-build.outputs.cache-hit != 'true'
@@ -268,7 +268,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-source
         with:
-          key: llvm-source-22-linux-asserts-v1-${{ hashFiles('llvm-version.txt') }}
+          key: llvm-source-22-linux-asserts-v1
           path: |
             llvm-project/clang/lib/Headers
             llvm-project/clang/include
@@ -293,7 +293,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-build
         with:
-          key: llvm-build-22-linux-asserts-v1-${{ hashFiles('llvm-version.txt') }}
+          key: llvm-build-22-linux-asserts-v1
           path: llvm-build
       - name: Build LLVM
         if: steps.cache-llvm-build.outputs.cache-hit != 'true'
@@ -377,7 +377,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-source
         with:
-          key: llvm-source-22-linux-v1-${{ hashFiles('llvm-version.txt') }}
+          key: llvm-source-22-linux-v1
           path: |
             llvm-project/clang/lib/Headers
             llvm-project/clang/include
@@ -402,7 +402,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-build
         with:
-          key: llvm-build-22-linux-${{ matrix.goarch }}-v1-${{ hashFiles('llvm-version.txt') }}
+          key: llvm-build-22-linux-${{ matrix.goarch }}-v1
           path: llvm-build
       - name: Build LLVM
         if: steps.cache-llvm-build.outputs.cache-hit != 'true'

.github/workflows/llvm.yml

@@ -35,8 +35,8 @@ jobs:
         uses: docker/metadata-action@v6
         with:
           images: |
-            tinygo/llvm-22
-            ghcr.io/${{ github.repository_owner }}/llvm-22
+            tinygo/llvm-20
+            ghcr.io/${{ github.repository_owner }}/llvm-20
           tags: |
             type=sha,format=long
             type=raw,value=latest
@@ -59,5 +59,5 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=registry,ref=ghcr.io/${{ github.repository_owner }}/llvm-22:buildcache
-          cache-to: type=registry,ref=ghcr.io/${{ github.repository_owner }}/llvm-22:buildcache,mode=max
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/nix.yml

@@ -29,7 +29,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-source
         with:
-          key: llvm-source-22-linux-nix-v1-${{ hashFiles('llvm-version.txt') }}
+          key: llvm-source-22-linux-nix-v1
           path: |
             llvm-project/compiler-rt
       - name: Download LLVM source

.github/workflows/release.yml

@@ -0,0 +1,158 @@
+# Publish a GitHub release from the artifacts that CI already built.
+#
+# The Linux, macOS and Windows workflows build every file that a release needs
+# when the release branch is pushed. This workflow collects the artifacts of
+# those runs for the tagged commit, so what ships is what was tested.
+#
+# The release is a draft, so the notes can be reviewed before publication.
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to release, for example v0.42.0'
+        required: true
+
+concurrency:
+  group: release-${{ inputs.tag || github.ref_name }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  actions: read
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ github.token }}
+      GH_REPO: ${{ github.repository }}
+      TAG: ${{ inputs.tag || github.ref_name }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.tag || github.ref_name }}
+          fetch-depth: 0
+      - name: Read the version
+        id: version
+        # The release file names come from goenv/version.go, not from the tag,
+        # so the two must agree.
+        run: |
+          version=$(./.github/workflows/tinygo-extract-version.sh | cut -d= -f2-)
+          case "$version" in
+            *-dev)
+              echo "::error::goenv/version.go has development version $version"
+              exit 1
+              ;;
+          esac
+          if [ "v$version" != "$TAG" ]; then
+            echo "::error::tag $TAG does not match version $version in goenv/version.go"
+            exit 1
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+      - name: Wait for the CI runs of this commit
+        id: runs
+        # A pull request run has the merge commit as its head, so look at push
+        # runs only.
+        run: |
+          sha=$(git rev-parse HEAD)
+          for workflow in linux.yml build-macos.yml windows.yml; do
+            id=
+            for _ in $(seq 20); do
+              id=$(gh run list --workflow "$workflow" --commit "$sha" --event push --limit 1 --json databaseId --jq '.[0].databaseId')
+              if [ -n "$id" ]; then
+                break
+              fi
+              echo "waiting for $workflow to start on $sha"
+              sleep 30
+            done
+            if [ -z "$id" ]; then
+              echo "::error::no $workflow run for commit $sha"
+              exit 1
+            fi
+            echo "$workflow: run $id"
+            gh run watch "$id" --exit-status > /dev/null || true
+            conclusion=$(gh run view "$id" --json conclusion --jq .conclusion)
+            if [ "$conclusion" != "success" ]; then
+              echo "::error::$workflow run $id concluded with $conclusion"
+              exit 1
+            fi
+            case "$workflow" in
+              linux.yml)       echo "linux=$id"   >> "$GITHUB_OUTPUT" ;;
+              build-macos.yml) echo "macos=$id"   >> "$GITHUB_OUTPUT" ;;
+              windows.yml)     echo "windows=$id" >> "$GITHUB_OUTPUT" ;;
+            esac
+          done
+      # The build jobs upload with `archive: false`, so the artifact is the
+      # release file itself. skip-decompress keeps it that way. The Windows
+      # release is a .zip, which a download would otherwise unpack.
+      - name: Download the Linux artifacts
+        uses: actions/download-artifact@v8
+        with:
+          run-id: ${{ steps.runs.outputs.linux }}
+          github-token: ${{ github.token }}
+          path: artifacts
+          skip-decompress: true
+      - name: Download the macOS artifacts
+        uses: actions/download-artifact@v8
+        with:
+          run-id: ${{ steps.runs.outputs.macos }}
+          github-token: ${{ github.token }}
+          path: artifacts
+          skip-decompress: true
+      - name: Download the Windows artifacts
+        uses: actions/download-artifact@v8
+        with:
+          run-id: ${{ steps.runs.outputs.windows }}
+          github-token: ${{ github.token }}
+          path: artifacts
+          skip-decompress: true
+      - name: Collect the release files
+        # A build that stopped uploading must not give a half complete release,
+        # so list the files that are expected. The search is by file name, not
+        # by artifact name, because the artifact names are not uniform.
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          version=$VERSION
+          mkdir -p dist
+          missing=0
+          for file in \
+              "tinygo$version.linux-amd64.tar.gz"  "tinygo_${version}_amd64.deb" \
+              "tinygo$version.linux-arm.tar.gz"    "tinygo_${version}_armhf.deb" \
+              "tinygo$version.linux-arm64.tar.gz"  "tinygo_${version}_arm64.deb" \
+              "tinygo$version.darwin-amd64.tar.gz" \
+              "tinygo$version.darwin-arm64.tar.gz" \
+              "tinygo$version.windows-amd64.zip"; do
+            found=$(find artifacts -type f -name "$file" | head -1)
+            if [ -z "$found" ]; then
+              echo "::error::missing release file $file"
+              missing=1
+            else
+              mv "$found" "dist/$file"
+            fi
+          done
+          ls -l dist
+          exit $missing
+      - name: Extract the release notes
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: ./.github/workflows/extract-changelog.sh "$VERSION" > notes.md
+      - name: Create the draft release
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          version=$VERSION
+          set --
+          case "$version" in
+            *-*) set -- --prerelease ;;
+          esac
+          gh release create "$TAG" --draft --verify-tag "$@" \
+            --title "$version" \
+            --notes-file notes.md \
+            dist/*

.github/workflows/sizediff.yml

@@ -34,7 +34,7 @@ jobs:
         uses: actions/cache@v5
         id: cache-llvm-source
         with:
-          key: llvm-source-22-sizediff-v1-${{ hashFiles('llvm-version.txt') }}
+          key: llvm-source-22-sizediff-v1
           path: |
             llvm-project/compiler-rt
       - name: Download LLVM source

.github/workflows/windows.yml

@@ -40,7 +40,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-source
         with:
-          key: llvm-source-22-windows-v3-${{ hashFiles('llvm-version.txt') }}
+          key: llvm-source-22-windows-v3
           path: |
             llvm-project/clang/lib/Headers
             llvm-project/clang/include
@@ -65,7 +65,7 @@ jobs:
         uses: actions/cache/restore@v5
         id: cache-llvm-build
         with:
-          key: llvm-build-22-windows-v1-${{ hashFiles('llvm-version.txt') }}
+          key: llvm-build-22-windows-v1
           path: llvm-build
       - name: Build LLVM
         if: steps.cache-llvm-build.outputs.cache-hit != 'true'

BUILDING.md

@@ -53,10 +53,6 @@ the git repository). Then, inside the directory, download the LLVM source:
 
     make llvm-source
 
-The LLVM commit to use is pinned in `llvm-version.txt`. A change to that file
-makes CI build LLVM again, because the file is part of the LLVM cache key. All
-other changes reuse the cached LLVM build.
-
 You can also store LLVM outside of the TinyGo root directory by setting the
 `LLVM_BUILDDIR`, `CLANG_SRC` and `LLD_SRC` make variables, but that is not
 covered by this guide.
@@ -123,3 +119,35 @@ the following command (for example in ~/lib):
 TinyGo will get extracted to a `tinygo` directory. You can then call it with:
 
     ./tinygo/bin/tinygo
+
+## Publish a release
+
+The `Release` workflow (`.github/workflows/release.yml`) publishes releases. It
+does not build anything. The Linux, macOS and Windows workflows already build
+every file that a release needs when the `release` branch is pushed, so the
+release workflow collects the artifacts of those runs for the tagged commit.
+What ships is what was tested.
+
+ 1. On the `dev` branch, set `const version` in `goenv/version.go` to the new
+    version (without a `v` prefix), and add the entry to `CHANGELOG.md`.
+ 2. Merge `dev` into the `release` branch.
+ 3. Tag that commit and push the tag:
+
+        git tag v0.42.0
+        git push origin v0.42.0
+
+    The tag must be `v` plus the version in `goenv/version.go`, because the
+    release file names come from that constant.
+ 4. The workflow waits for the Linux, macOS and Windows runs of the tagged
+    commit, collects their nine files, and creates a **draft** release. The
+    release notes come from the `CHANGELOG.md` entry for that version.
+ 5. Review the draft release and publish it.
+ 6. On the `dev` branch, set `goenv/version.go` to the next `-dev` version.
+
+To release again after a failure, delete the draft release and start the
+workflow from the Actions tab with the tag as its input.
+
+GitHub keeps a SHA-256 digest of every published file. The digest is not shown
+on the release page, but it can be printed with:
+
+    gh release view v0.42.0 --json assets --jq '.assets[] | "\(.digest)  \(.name)"'

Dockerfile

@@ -11,7 +11,6 @@ RUN apt-get update && \
 
 COPY ./GNUmakefile /tinygo/GNUmakefile
 COPY ./make /tinygo/make
-COPY ./llvm-version.txt /tinygo/llvm-version.txt
 
 RUN cd /tinygo/ && \
     make llvm-source

llvm-version.txt

@@ -1 +0,0 @@
-2be7242b6a4d59fe89fb43f7d1e7333dc9b307a2

make/llvm.mk

@@ -75,15 +75,8 @@ endif
     CGO_LDFLAGS+=-L$(abspath $(LLVM_BUILDDIR)/lib) -lclang $(CLANG_LIBS) $(LLD_LIBS) $(shell $(LLVM_CONFIG_PREFIX) $(LLVM_BUILDDIR)/bin/llvm-config --ldflags --libs --system-libs $(LLVM_COMPONENTS)) -lstdc++ $(CGO_LDFLAGS_EXTRA)
 endif
 
-# Pinned in llvm-version.txt. Branch tinygo_22.x of tinygo-org/llvm-project.
-LLVM_REVISION = $(shell cat llvm-version.txt)
-
 $(LLVM_PROJECTDIR)/llvm:
-	git init $(LLVM_PROJECTDIR)
-	cd $(LLVM_PROJECTDIR) && \
-	  git remote add origin https://github.com/tinygo-org/llvm-project && \
-	  git fetch --depth=1 origin $(LLVM_REVISION) && \
-	  git checkout FETCH_HEAD
+	git clone -b tinygo_22.x --depth=1 https://github.com/tinygo-org/llvm-project $(LLVM_PROJECTDIR)
 llvm-source: $(LLVM_PROJECTDIR)/llvm ## Get LLVM sources
 
 # Configure LLVM.