Tag releases with Brussels (#2270)

The first phase of the SP and RoT release process is to determine the
version number, tag the latest commit with that version number, and push
it to kick off the build. To start fully automating the SP release
process, this PR replaces this phase with a single GitHub Actions
workflow that can be started through the UI:

<img width="933" height="477" alt="image"
src="https://github.com/user-attachments/assets/2fb0b680-b4ac-41d7-a37a-6455bafd4735"
/>
<br/><br/>

This uses [Brussels](https://github.com/oxidecomputer/brussels), the new
SP and RoT release tooling I'm working on, and in particular the changes
I introduced in oxidecomputer/brussels#3. Brussels is fetched as a
pre-built binary from its GitHub Release to ensure it doesn't delay the
release process by trying to compile it.

The `brussels init` command will be executed in its own job as the first
build step. It will look at all the existing tags to determine what is
the next version number, calculate the tag name, and expose all of that
information into `GITHUB_OUTPUT` to let the rest of the workflow know
the version to use. It will also write all the metadata it gathered in a
`brussels-manifest.json` file, so that future Brussels steps can
reference that metadata.

The tag will not be created and pushed by `brussels init`. Instead, we
will let the "create GitHub Release" step at the end of the workflow
create the tag on its own, as GitHub will do so when creating a release
without an underlying tag.

While I was there, I also changed the build process to inject the
version number directly during the build, instead of waiting for
permslip to add it as part of the signature process.

This is just the first improvement to the SP release process that I'm
going to do. The end goal is for SP releases to be fully automated
(either by requiring a single button click or by putting the whole
release process in a cronjob).

Note that by default the workflow will use the latest release of
Brussels. An optional field when starting the workflow run lets you
download Brussels from a CI job in the Brussels repository. This mostly
exists to help me test changes without publishing endless releases.

Author: emilyalbini

.github/workflows/build-boards.yml

@@ -21,6 +21,11 @@ on:
         required: false
         default: false
         type: boolean
+      caboose-version:
+        description: Version number to insert in the caboose
+        required: false
+        default: ""
+        type: string
 
 # Force permissions to be defined at the job level.
 permissions: {}
@@ -43,7 +48,7 @@ jobs:
         run: build/gha-build-boards-matrix.py ${filter_directories} --write-github-output
         id: matrix
         env:
-          filter_directories: ${{ inputs.filter_directories }}
+          filter_directories: ${{ inputs.filter-directories }}
 
   build:
     needs:
@@ -88,9 +93,17 @@ jobs:
             ${{ runner.os }}-vcpkg-download-
 
       - name: cargo xtask dist
+        run: |
+          # GitHub Actions defaults the environment variable to an empty string when missing.
+          if [[ "${HUBRIS_CABOOSE_VERS}" == "" ]]; then
+            unset HUBRIS_CABOOSE_VERS
+          fi
+          cargo xtask dist "${app_toml}"
+        shell: bash
         env:
+          app_toml: ${{ matrix.app_toml }}
+          HUBRIS_CABOOSE_VERS: ${{ inputs.caboose-version }}
           RUST_BACKTRACE: 1
-        run: cargo xtask dist ${{ matrix.app_toml }}
 
       - name: Fetch Humility
         uses: dsaltares/fetch-gh-release-asset@master

.github/workflows/release-builds.yml

@@ -1,48 +1,92 @@
-name: release
+name: Release
 on:
-  workflow_call:
+  workflow_dispatch:
     inputs:
-      board-set:
-        description: "Which set to build"
-        required: true
-        type: string
-      filter-directories:
-        description: Space-separated list of directories to build.
+      group:
+        description: Boards group
         required: true
+        type: choice
+        options:
+          - all-sp
+          - rot
+      brussels-run-id:
+        description: Download Brussels from a Run ID
         type: string
 
+# Prevent multiple releases for the same group from happening concurrently.
+concurrency:
+  group: release-${{ github.event.inputs.group }}
+
 jobs:
-  do-build:
+  init:
+    name: Initialize the release
+    runs-on: ubuntu-24.04
+    outputs:
+      version: ${{ steps.init.outputs.version }}
+      tag_name: ${{ steps.init.outputs.tag_name }}
+      hubris_app_dirs: ${{ steps.init.outputs.hubris_app_dirs }}
+    steps:
+      - &download-brussels
+        name: Download Brussels
+        run: |
+          if [[ "${BRUSSELS_RUN_ID}" == "" ]]; then
+            gh release download -R oxidecomputer/brussels -p brussels
+          else
+            gh run download "${BRUSSELS_RUN_ID}" -R oxidecomputer/brussels -n prebuilt-binary
+          fi
+          sudo mv brussels /usr/local/bin
+          sudo chmod +x /usr/local/bin/brussels
+        env:
+          GH_TOKEN: ${{ secrets.BRUSSELS_TEMPORARY_TOKEN }}
+          BRUSSELS_RUN_ID: ${{ github.event.inputs.brussels-run-id }}
+
+      - id: init
+        name: Initialize the release
+        run: brussels init $group >> brussels-manifest.json
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          group: ${{ github.event.inputs.group }}
+
+      - name: Upload the release manifest
+        uses: actions/upload-artifact@v4
+        with:
+          name: brussels-manifest
+          path: brussels-manifest.json
+          if-no-files-found: error
+
+  build:
+    name: Build boards
+    needs:
+      - init
     uses: ./.github/workflows/build-boards.yml
     with:
       os: oxide-colo-builder-hubris
-      filter-directories: ${{ inputs.filter-directories }}
+      filter-directories: ${{ needs.init.outputs.hubris_app_dirs }}
       upload-artifacts: true
+      caboose-version: ${{ needs.init.outputs.version }}
       attest: true
 
-  release-build:
-    needs: do-build
+  release:
+    name: Publish the release
+    needs:
+      - init
+      - build
     runs-on: oxide-colo-builder-hubris
     steps:
-    - name: grab binary
+    - name: Download all artifacts to release
       id: grab
       uses: actions/download-artifact@v4
       with:
         path: out
-    - name: prep
-      run: |
-        OUT=${{ steps.grab.outputs.download-path }}
-        for build in `ls $OUT`; do
-           for f in `ls $OUT/$build`; do
-              mv $OUT/$build/$f $OUT/$f
-           done
-        done
+        merge-multiple: true
 
-    - name: cut release
+    - name: Publish the release
       uses: softprops/action-gh-release@v1
       with:
-        name: "${{ inputs.board-set }} release"
+        tag_name: ${{ needs.init.outputs.tag_name }}
+        name: "${{ github.event.inputs.group }} release"
         fail_on_unmatched_files: true
-        body: "These are UNVERSIONED hubris artifacts"
+        body: "These are versioned but UNSIGNED hubris ${{ github.event.inputs.group }} artifacts"
         files: |
           ${{ steps.grab.outputs.download-path }}/*.zip
+          ${{ steps.grab.outputs.download-path }}/brussels-manifest.json