[full-ci] Release 8.1.0 (#12498)

* chore: release 8.1.0-rc.2

* fix: skip docker jobs

* chore: update changelog

* chore: bump version to 12.4.2

* fix: changelog titles too long

* feat: ci, changelog lint

* fix: fixed the empty mount ID for storage-users (#12492)

* fix: fixed the empty mount ID for storage-users

* bump deps

* Release 8.1.0

* feat: translations

* chore: backport trivy scan

---------

Co-authored-by: Michal Klos <michal.klos@kiteworks.com>
Co-authored-by: Matteo <matteo.sonnenholzner@kiteworks.com>

Author: 3 people

.github/workflows/acceptance-tests.yml

@@ -41,6 +41,7 @@ jobs:
           make govulncheck                                                                                                     > /tmp/govulncheck.log 2>&1 & PIDS+=($!)
           make ci-node-generate                                                                                                > /tmp/node-gen.log    2>&1 & PIDS+=($!)
           make ci-go-generate                                                                                                  > /tmp/go-gen.log      2>&1 & PIDS+=($!)
+          make changelog-lint                                                                                                   > /tmp/changelog-lint.log 2>&1 & PIDS+=($!)
 
           FAILED=0
           for PID in "${PIDS[@]}"; do wait "$PID" || FAILED=1; done
@@ -63,9 +64,19 @@ jobs:
           echo "=== govulncheck ==="      && cat /tmp/govulncheck.log
           echo "=== ci-node-generate ===" && cat /tmp/node-gen.log
           echo "=== ci-go-generate ==="   && cat /tmp/go-gen.log
+          echo "=== changelog-lint ===" && cat /tmp/changelog-lint.log
 
           exit $FAILED
 
+      - name: Trivy scan
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
+        with:
+          scan-type: fs
+          format: table
+          exit-code: 1
+          severity: CRITICAL,HIGH
+          trivy-config: .trivy.yaml
+
       - name: Build, lint and test
         run: |
           # Phase 2 — all three are CPU-bound Go compilation on 2 vCPU.

.github/workflows/release.yml

@@ -4,14 +4,12 @@ on:
   push:
     tags:
       - 'v*'
-    branches:
-      - 'feat/release-pipeline**'
   workflow_dispatch:
     inputs:
       version_override:
-        description: 'Version override (leave empty to auto-detect from latest tag)'
+        description: 'Version (required, e.g. 8.1.0-rc.3)'
         type: string
-        default: ''
+        required: true
 
 env:
   PRODUCTION_RELEASE_TAGS: '5.0,7,8'
@@ -29,33 +27,10 @@ jobs:
       is_prerelease: ${{ steps.info.outputs.is_prerelease }}
       docker_repos:  ${{ steps.info.outputs.docker_repos }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        if: ${{ github.ref_type == 'branch' || (github.event_name == 'workflow_dispatch' && inputs.version_override == '') }}
-        with:
-          fetch-depth: 0
-          fetch-tags: true
-
       - id: info
         run: |
-          next_dev() {
-            # If latest tag is already a pre-release (e.g. v8.0.2-dev.1), reuse its base
-            # version (8.0.2-dev.1) so repeated branch runs don't bump the patch counter.
-            # If latest tag is a production release (e.g. v8.0.1), increment patch (8.0.2-dev.1).
-            local tag=$(git tag --sort=-version:refname | grep -m1 '^v' || echo "v0.0.0")
-            local ver="${tag#v}"
-            if [[ "$ver" == *"-"* ]]; then
-              echo "${ver%%-*}-dev.1"
-            else
-              IFS='.' read -r M m p <<< "$ver"
-              echo "${M}.${m}.$((p + 1))-dev.1"
-            fi
-          }
-
           if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
             VERSION="${{ inputs.version_override }}"
-            [[ -z "$VERSION" ]] && VERSION=$(next_dev)
-          elif [[ "${{ github.ref_type }}" == "branch" ]]; then
-            VERSION=$(next_dev)
           else
             VERSION="${GITHUB_REF#refs/tags/v}"
           fi
@@ -112,6 +87,7 @@ jobs:
           retention-days: 1
 
   docker-build:
+    if: false
     name: docker-build (${{ matrix.arch }}, ${{ matrix.repo }})
     runs-on: ${{ matrix.arch == 'amd64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }}
     needs: [determine-release-type, generate-code, security-scan-trivy]
@@ -217,6 +193,7 @@ jobs:
           exit 1
 
   docker-manifest:
+    if: false
     name: docker-manifest (${{ matrix.repo }})
     runs-on: ubuntu-latest
     needs: [determine-release-type, docker-build, docker-scan]
@@ -242,6 +219,7 @@ jobs:
             "${{ matrix.repo }}:${{ needs.determine-release-type.outputs.version }}-linux-arm64"
 
   docker-readme:
+    if: false
     name: docker-readme (${{ matrix.repo }})
     runs-on: ubuntu-latest
     needs: [determine-release-type, docker-manifest]
@@ -333,7 +311,15 @@ jobs:
         with:
           go-version-file: go.mod
       - run: |
-          make changelog CHANGELOG_VERSION=$(echo "${{ needs.determine-release-type.outputs.version }}" | cut -d'-' -f1)
+          VERSION="${{ needs.determine-release-type.outputs.version }}"
+          # For prereleases (e.g. 8.1.0-rc.2), pass the full version so calens finds
+          # changelog/8.1.0-rc.2_*/ rather than falling through to the missing 8.1.0_*/ dir.
+          if [[ "$VERSION" == *-* ]]; then
+            CHANGELOG_VERSION="$VERSION"
+          else
+            CHANGELOG_VERSION=$(echo "$VERSION" | cut -d'-' -f1)
+          fi
+          make changelog CHANGELOG_VERSION="$CHANGELOG_VERSION"
           # calens produces empty output when no versioned changelog directory exists (e.g. dev builds).
           # Fall back to a pointer to the unreleased entries.
           if [[ $(wc -l < ocis/dist/CHANGELOG.md) -lt 5 ]]; then
@@ -347,7 +333,7 @@ jobs:
 
   create-github-release:
     runs-on: ubuntu-latest
-    needs: [determine-release-type, build-binaries, license-check, generate-changelog, security-scan-trivy, docker-readme]
+    needs: [determine-release-type, build-binaries, license-check, generate-changelog, security-scan-trivy]
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -378,10 +364,6 @@ jobs:
     needs:
       - determine-release-type
       - generate-code
-      - docker-build
-      - docker-scan
-      - docker-manifest
-      - docker-readme
       - build-binaries
       - security-scan-trivy
       - license-check
@@ -405,7 +387,7 @@ jobs:
           python3 scripts/audit-release.py \
             --version "${{ needs.determine-release-type.outputs.version }}" \
             --dir release-assets/ \
-            --github-release --docker
+            --github-release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

Makefile

@@ -328,6 +328,17 @@ endif
 	mkdir -p ocis/dist
 	$(CALENS) --version $(CHANGELOG_VERSION) -o ocis/dist/CHANGELOG.md
 
+.PHONY: changelog-lint
+changelog-lint:
+	@FAILED=0; \
+	while IFS= read -r -d '' f; do \
+	  title=$$(head -1 "$$f"); \
+	  if [ $${#title} -gt 80 ]; then \
+	    echo "$$f: title too long ($${#title}/80)"; FAILED=1; \
+	  fi; \
+	done < <(find changelog -mindepth 2 -name "*.md" -print0); \
+	exit $$FAILED
+
 .PHONY: changelog-csv
 changelog-csv: $(CALENS)
 	mkdir -p ocis/dist