Harden release script gates, cover them with tests

.github/workflows/commit-status.yml

@@ -0,0 +1,57 @@
+name: Commit status
+
+# Marks a commit with a named status, so a later gate can require it.
+# Split out of dkms-build.yml because a called workflow cannot widen the
+# caller's token: asking for statuses write there would force every
+# caller to grant it or fail at startup. Callers grant it on this job
+# alone.
+
+on:
+  workflow_call:
+    inputs:
+      sha:
+        description: Full commit SHA to mark, the API rejects abbreviated forms
+        type: string
+        required: true
+      state:
+        description: success, failure, error or pending
+        type: string
+        required: true
+      context:
+        description: Status name a gate matches on
+        type: string
+        required: true
+      description:
+        description: Short text shown beside the status
+        type: string
+        required: false
+        default: ''
+
+permissions:
+  statuses: write
+
+jobs:
+  status:
+    runs-on: ubuntu-latest
+    steps:
+      # Status lands on the calling repo, the only one this token can write
+      - name: Post status
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SHA: ${{ inputs.sha }}
+          STATE: ${{ inputs.state }}
+          CONTEXT: ${{ inputs.context }}
+          DESCRIPTION: ${{ inputs.description }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          jq -n --arg state "$STATE" --arg context "$CONTEXT" \
+                --arg url "$RUN_URL" --arg description "$DESCRIPTION" \
+            '{state: $state, context: $context, target_url: $url,
+              description: $description}' \
+            | curl -sS --fail-with-body -X POST \
+                -H "Authorization: Bearer ${GH_TOKEN}" \
+                -H "Accept: application/vnd.github+json" \
+                "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/statuses/${SHA}" \
+                -d @- -o /dev/null
+          echo "Posted ${STATE} '${CONTEXT}' on ${SHA}"

.github/workflows/dkms-build.yml

@@ -42,6 +42,9 @@ on:
       artifact:
         description: Name of the uploaded build artifact
         value: ${{ jobs.build.outputs.package }}_${{ jobs.build.outputs.packaging }}
+      source-sha:
+        description: Commit the upstream-ref resolved to
+        value: ${{ jobs.build.outputs.source-sha }}
 
 permissions:
   contents: read
@@ -53,6 +56,7 @@ jobs:
     outputs:
       package: ${{ steps.version.outputs.package }}
       packaging: ${{ steps.version.outputs.packaging }}
+      source-sha: ${{ steps.source.outputs.sha }}
     steps:
       - name: Checkout packaging recipe (debian/)
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -70,6 +74,15 @@ jobs:
           ref: ${{ inputs.upstream-ref }}
           path: upstream
 
+      # A branch ref resolves at checkout, so record what this run covers
+      - name: Resolve source commit
+        id: source
+        run: |
+          set -euo pipefail
+          SHA=$(git -C upstream rev-parse HEAD)
+          echo "sha=${SHA}" >> "$GITHUB_OUTPUT"
+          echo "Source commit: ${SHA} (${{ inputs.upstream-ref }})"
+
       - name: Compute package name and versions from changelog
         id: version
         run: |

.github/workflows/selftest.yml

@@ -6,7 +6,9 @@ name: Selftest
 # selftest/*-pre pair. Sign and publish have no selftest.
 #
 # Also replays dkms-version-guard.yml over scratch repo fixtures, see
-# tests/version-guard-cases.sh.
+# tests/version-guard-cases.sh, and scripts/release-dkms.sh against a
+# scratch driver repo with curl and dch stubbed, see
+# tests/release-cases.sh
 
 on:
   push:
@@ -48,6 +50,16 @@ jobs:
       - name: Replay guard cases
         run: bash tests/version-guard-cases.sh
 
+  release-script:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Replay release cases
+        run: bash tests/release-cases.sh
+
   assert:
     needs: build
     runs-on: ubuntu-latest