From 8a553332f78b02df411aced16f11b8972965bd1a Mon Sep 17 00:00:00 2001
From: bircni <bircni@icloud.com>
Date: Thu, 8 Oct 2026 11:35:03 +0200
Subject: [PATCH] ci: skip reverted commits in release notes, publish tagged
 snaps to stable (#39657)

Release notes: revert commits and the commits they revert are now left
out of the git-cliff changelog. A step before git-cliff finds commits
whose subject starts with "revert", reads the PR numbers on their revert
lines, and writes both SHAs to `.cliffignore`.

Snap: since the move from Launchpad to GitHub Actions, every build was
uploaded to `latest/edge`, including the stable-grade build that
`part-gitea-pull.sh` makes for an unreleased tag. Launchpad used to
release those builds to candidate and stable automatically. Without
that, v28.0.0 had to be promoted by hand and v28.1.0 stayed in edge.
Stable-grade snaps now go to `latest/stable` and `latest/candidate`;
main builds still go to edge. Candidate has to be updated too because
the pull script compares against it.

---------

Signed-off-by: bircni <bircni@icloud.com>
---
 .github/workflows/release-nightly-snapcraft.yml |  9 ++++++++-
 .github/workflows/release-tag-version.yml       |  4 ++++
 snap/part-gitea-pull.sh                         | 11 ++++++-----
 tools/generate-cliffignore.sh                   | 15 +++++++++++++++
 4 files changed, 33 insertions(+), 6 deletions(-)
 create mode 100755 tools/generate-cliffignore.sh

diff --git a/.github/workflows/release-nightly-snapcraft.yml b/.github/workflows/release-nightly-snapcraft.yml
index eaee386e442..988378d8d1c 100644
--- a/.github/workflows/release-nightly-snapcraft.yml
+++ b/.github/workflows/release-nightly-snapcraft.yml
@@ -37,8 +37,15 @@ jobs:
       # retry snapcraft uploads which can be flaky
       - name: Publish snap
         run: |
+          # part-gitea-pull.sh decides what is built, see the comments there:
+          # * grade devel (main or a prerelease tag) goes to latest/edge
+          # * grade stable (a new release tag) goes to latest/stable, and to latest/candidate which marks it as released
+          channel=latest/edge
+          if unsquashfs -cat "$SNAP" meta/snap.yaml | grep -qx 'grade: stable'; then
+            channel=latest/stable,latest/candidate
+          fi
           for attempt in 1 2 3 4 5; do
-            snapcraft upload "$SNAP" --release latest/edge && exit 0
+            snapcraft upload "$SNAP" --release "$channel" && exit 0
             echo "::warning::snap upload attempt $attempt failed, retrying in 15s"
             sleep 15
           done
diff --git a/.github/workflows/release-tag-version.yml b/.github/workflows/release-tag-version.yml
index 57cc2e03953..211946013bf 100644
--- a/.github/workflows/release-tag-version.yml
+++ b/.github/workflows/release-tag-version.yml
@@ -76,6 +76,10 @@ jobs:
         run: |
           previous=$(git tag --list --sort=-v:refname | grep -xE 'v[0-9]+\.[0-9]+\.[0-9]+' | grep -A1 -xF "$GITHUB_REF_NAME" | tail -1) # highest stable version below this one
           echo "range=$previous..$GITHUB_SHA" >> "$GITHUB_OUTPUT"
+      - name: skip reverts and reverted commits in changelog
+        env:
+          RANGE: ${{ steps.range.outputs.range }}
+        run: ./tools/generate-cliffignore.sh "$RANGE" | sort -u > .cliffignore
       - uses: orhun/git-cliff-action@a9a95522b26fe6403f7bb24031f21fb573d0f5ff # v4.9.1
         with:
           args: --tag ${{ github.ref_name }} ${{ steps.range.outputs.range }}
diff --git a/snap/part-gitea-pull.sh b/snap/part-gitea-pull.sh
index 83fde11a129..3f4a8f0d857 100755
--- a/snap/part-gitea-pull.sh
+++ b/snap/part-gitea-pull.sh
@@ -16,13 +16,14 @@ else
 fi
 
 # How it works:
-# * snapcraft.io checks out the default branch (e.g.: main during 1.27 dev period)
+# * release-nightly-snapcraft.yml builds the snap on every push to the default branch (e.g.: main during 1.27 dev period)
 # * "override-pull" step gets the latest tag by date (e.g.: v1.26.1)
-# * use "snap info gitea" to get the latest released tag
-#   * if the latest tag is not released to stable, checkout that tag and build it for "stable"
-#   * otherwise, build the main branch for "devel"
+# * use "snap info gitea" to get the latest released tag, which is the version in the "latest/candidate" channel
+#   * if the latest tag is not released yet, checkout that tag and build it with grade "stable",
+#     the workflow publishes it to "latest/stable" and "latest/candidate"
+#   * otherwise, build the main branch with grade "devel", the workflow publishes it to "latest/edge"
 # * "override-build" step uses build script from the checked out commit to build
-# This approach highly depends on the "main" branch's push.
+# This approach highly depends on the "main" branch's push: a new tag is only published by the next push after it.
 
 # To debug the logic:
 # * last_committed_tag=v1.26.1 last_released_tag=v1.26.0 ./snap/part-gitea-pull.sh
diff --git a/tools/generate-cliffignore.sh b/tools/generate-cliffignore.sh
new file mode 100755
index 00000000000..534fa862a74
--- /dev/null
+++ b/tools/generate-cliffignore.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+set -euo pipefail
+
+# Prints the revert commits in the given range and the commits they revert, for git-cliff's .cliffignore
+range="${1:?usage: $0 <revision-range>}"
+commits=$(git log --format='%H %s' "$range")
+
+shopt -s nocasematch
+while read -r sha subject; do
+  [[ "$subject" == revert* ]] || continue
+  echo "$sha"
+  for pr in $(git show -s --format=%B "$sha" | grep -i revert | grep -oE '(#|/pull/)[0-9]+' | grep -oE '[0-9]+' || true); do
+    grep -F "(#$pr)" <<< "$commits" | cut -d' ' -f1 || true
+  done
+done <<< "$commits"