ci: skip reverted commits in release notes, publish tagged snaps to stable (#39657)

Release notes: revert commits and the commits they revert are now left
out of the git-cliff changelog. A step before git-cliff finds commits
whose subject starts with "revert", reads the PR numbers on their revert
lines, and writes both SHAs to `.cliffignore`.

Snap: since the move from Launchpad to GitHub Actions, every build was
uploaded to `latest/edge`, including the stable-grade build that
`part-gitea-pull.sh` makes for an unreleased tag. Launchpad used to
release those builds to candidate and stable automatically. Without
that, v28.0.0 had to be promoted by hand and v28.1.0 stayed in edge.
Stable-grade snaps now go to `latest/stable` and `latest/candidate`;
main builds still go to edge. Candidate has to be updated too because
the pull script compares against it.

---------

Signed-off-by: bircni <bircni@icloud.com>

.github/workflows/release-nightly-snapcraft.yml

@@ -37,8 +37,15 @@ jobs:
       # retry snapcraft uploads which can be flaky
       - name: Publish snap
         run: |
+          # part-gitea-pull.sh decides what is built, see the comments there:
+          # * grade devel (main or a prerelease tag) goes to latest/edge
+          # * grade stable (a new release tag) goes to latest/stable, and to latest/candidate which marks it as released
+          channel=latest/edge
+          if unsquashfs -cat "$SNAP" meta/snap.yaml | grep -qx 'grade: stable'; then
+            channel=latest/stable,latest/candidate
+          fi
           for attempt in 1 2 3 4 5; do
-            snapcraft upload "$SNAP" --release latest/edge && exit 0
+            snapcraft upload "$SNAP" --release "$channel" && exit 0
             echo "::warning::snap upload attempt $attempt failed, retrying in 15s"
             sleep 15
           done

.github/workflows/release-tag-version.yml

@@ -76,6 +76,10 @@ jobs:
         run: |
           previous=$(git tag --list --sort=-v:refname | grep -xE 'v[0-9]+\.[0-9]+\.[0-9]+' | grep -A1 -xF "$GITHUB_REF_NAME" | tail -1) # highest stable version below this one
           echo "range=$previous..$GITHUB_SHA" >> "$GITHUB_OUTPUT"
+      - name: skip reverts and reverted commits in changelog
+        env:
+          RANGE: ${{ steps.range.outputs.range }}
+        run: ./tools/generate-cliffignore.sh "$RANGE" | sort -u > .cliffignore
       - uses: orhun/git-cliff-action@a9a95522b26fe6403f7bb24031f21fb573d0f5ff # v4.9.1
         with:
           args: --tag ${{ github.ref_name }} ${{ steps.range.outputs.range }}

snap/part-gitea-pull.sh

@@ -16,13 +16,14 @@ else
 fi
 
 # How it works:
-# * snapcraft.io checks out the default branch (e.g.: main during 1.27 dev period)
+# * release-nightly-snapcraft.yml builds the snap on every push to the default branch (e.g.: main during 1.27 dev period)
 # * "override-pull" step gets the latest tag by date (e.g.: v1.26.1)
-# * use "snap info gitea" to get the latest released tag
-#   * if the latest tag is not released to stable, checkout that tag and build it for "stable"
-#   * otherwise, build the main branch for "devel"
+# * use "snap info gitea" to get the latest released tag, which is the version in the "latest/candidate" channel
+#   * if the latest tag is not released yet, checkout that tag and build it with grade "stable",
+#     the workflow publishes it to "latest/stable" and "latest/candidate"
+#   * otherwise, build the main branch with grade "devel", the workflow publishes it to "latest/edge"
 # * "override-build" step uses build script from the checked out commit to build
-# This approach highly depends on the "main" branch's push.
+# This approach highly depends on the "main" branch's push: a new tag is only published by the next push after it.
 
 # To debug the logic:
 # * last_committed_tag=v1.26.1 last_released_tag=v1.26.0 ./snap/part-gitea-pull.sh

tools/generate-cliffignore.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+set -euo pipefail
+
+# Prints the revert commits in the given range and the commits they revert, for git-cliff's .cliffignore
+range="${1:?usage: $0 <revision-range>}"
+commits=$(git log --format='%H %s' "$range")
+
+shopt -s nocasematch
+while read -r sha subject; do
+  [[ "$subject" == revert* ]] || continue
+  echo "$sha"
+  for pr in $(git show -s --format=%B "$sha" | grep -i revert | grep -oE '(#|/pull/)[0-9]+' | grep -oE '[0-9]+' || true); do
+    grep -F "(#$pr)" <<< "$commits" | cut -d' ' -f1 || true
+  done
+done <<< "$commits"