feat(workflow): Add support to release for prod-preview|stable

.github/actions/package/action.yml

@@ -31,6 +31,9 @@ outputs:
   pkg_feed:
     description: "Proget feed"
     value: ${{ steps.package.outputs.PKG_FEED }}
+  pkg_name:
+    description: "Package name"
+    value: ${{ steps.package.outputs.PKG_NAME }}
 
 runs:
   using: "composite"
@@ -40,10 +43,12 @@ runs:
       id: package
       run: |
         set -xe
+        EPOCH=6
         VERSION="$(support/scripts/genver.sh "${UKP_PACKAGE}" "${{ inputs.commits }}" "${{ inputs.version_short }}")"
         PKG_COMPONENT=
         PKG_VERSION_PREFIX=
         PKG_FEED=
+        RELEASE_VERSION=
         DISTRO="${{ inputs.distro }}"
         ARCH="${{ inputs.arch }}"
 
@@ -73,40 +78,135 @@ runs:
           printf "%s\n" "${VER_BRANCH}"
         }
 
-        if [[ "$GITHUB_REF" == 'refs/heads/prod-stable' ]]; then
+        if [[ "$GITHUB_REF" == 'refs/heads/prod-staging' ]]; then
+          # prod-staging is release 0: it publishes ukp0-* only, no meta package
+          RELEASE_VERSION="0"
+          PKG_COMPONENT="staging"
+          PKG_VERSION_PREFIX="${EPOCH}:${VERSION}-2staging"
+          PKG_FEED="cloud-staging"
+        elif [[ "$GITHUB_REF" =~ ^refs/heads/prod-stable([0-9]*)$ ]]; then
+          RELEASE_VERSION="${BASH_REMATCH[1]}"
           PKG_COMPONENT="stable"
-          PKG_VERSION_PREFIX="5:${VERSION}-9stable"
+          PKG_VERSION_PREFIX="${EPOCH}:${VERSION}-9stable"
           PKG_FEED="cloud"
-        elif [[ "$GITHUB_REF" == "refs/heads/prod-preview" ]]; then
+        elif [[ "$GITHUB_REF" =~ ^refs/heads/prod-preview([0-9]*)$ ]]; then
+          RELEASE_VERSION="${BASH_REMATCH[1]}"
           PKG_COMPONENT="preview"
-          PKG_VERSION_PREFIX="5:${VERSION}-7preview"
+          PKG_VERSION_PREFIX="${EPOCH}:${VERSION}-7preview"
           PKG_FEED="cloud"
-        elif [[ "$GITHUB_REF" == 'refs/heads/prod-staging' ]]; then
-          PKG_COMPONENT="staging"
-          PKG_VERSION_PREFIX="5:${VERSION}-2staging"
-          PKG_FEED="cloud-staging"
         else
           mapfile -t BRCUSTOM < <( branch2version "$( printf '%s' "$GITHUB_REF" | cut -f1,2 --complement -d'/' )")
           if [ -n "${BRCUSTOM[0]}" ]; then
             PKG_COMPONENT="${BRCUSTOM[0]}"
-            PKG_VERSION_PREFIX="5:${VERSION}-0dev+${BRCUSTOM[0]}+${BRCUSTOM[1]}"
+            PKG_VERSION_PREFIX="${EPOCH}:${VERSION}-0dev+${BRCUSTOM[0]}+${BRCUSTOM[1]}"
           else
             # branch does not have a user name
             PKG_COMPONENT="devel"
-            PKG_VERSION_PREFIX="5:${VERSION}-0dev+${BRCUSTOM[1]}"
+            PKG_VERSION_PREFIX="${EPOCH}:${VERSION}-0dev+${BRCUSTOM[1]}"
           fi
           PKG_FEED="cloud-internal"
         fi
 
         export SEMVER="${PKG_VERSION_PREFIX}+${DISTRO}"
+        export RELEASE_VERSION="${RELEASE_VERSION}"
         export ARCH
+
         mkdir -p /dist;
-        envsubst < "${{ inputs.nfpm_file }}" > nfpm-processed.yaml
-        nfpm package --config nfpm-processed.yaml --packager deb --target /dist;
+
+        # Generate nfpm config with dynamic release conflicts
+        NFPM_CONFIG="/tmp/nfpm-generated.yaml"
+        cp "${{ inputs.nfpm_file }}" "${NFPM_CONFIG}"
+        if [ -n "${RELEASE_VERSION}" ]; then
+          CONFLICT_LINES=""
+          for ((i=RELEASE_VERSION-1; i>=1; i--)); do
+            CONFLICT_LINES+="  - ukp${i}-tailscale\n"
+          done
+          sed -i "s|  # __DYNAMIC_RELEASE_CONFLICTS__|${CONFLICT_LINES}  # __DYNAMIC_RELEASE_CONFLICTS__|" "${NFPM_CONFIG}"
+        fi
+
+        if [ "${RELEASE_VERSION}" = "0" ]; then
+          # Release 0 is the staging build. Let it stand in for the newest numbered
+          # release, so a release node can run individual components from staging.
+          # Provides must be versioned: an unversioned one does not satisfy a
+          # versioned dependency. Only the newest release is named, because a
+          # numbered release conflicts with ukp1-*..ukpN-1-* and an unversioned
+          # Conflicts also catches whatever provides that name -- naming an older
+          # release here would make ukp0-* collide with the release it is meant to
+          # sit alongside. Numbered releases never name ukp0-*, so none of this is
+          # visible to customers.
+          git config --global --add safe.directory "$(pwd)"
+          git fetch --no-tags --prune origin 'refs/heads/prod-stable*:refs/remotes/origin/prod-stable*' 'refs/heads/prod-preview*:refs/remotes/origin/prod-preview*'
+          MAX_RELEASE=0
+          while IFS= read -r ref; do
+            ref="${ref## }"
+            if [[ "${ref}" =~ origin/prod-(stable|preview)([0-9]+)$ ]]; then
+              if (( BASH_REMATCH[2] > MAX_RELEASE )); then
+                MAX_RELEASE="${BASH_REMATCH[2]}"
+              fi
+            fi
+          done < <(git branch -r --list 'origin/prod-stable*' 'origin/prod-preview*')
+
+          PROVIDES_LINES=""
+          if (( MAX_RELEASE >= 1 )); then
+            PROVIDES_LINES="  - ukp${MAX_RELEASE}-tailscale (= ${SEMVER})\n"
+          fi
+          sed -i "s|  # __DYNAMIC_RELEASE_PROVIDES__|${PROVIDES_LINES}  # __DYNAMIC_RELEASE_PROVIDES__|" "${NFPM_CONFIG}"
+        fi
+
+        envsubst < "${NFPM_CONFIG}" > nfpm-processed.yaml
+        nfpm package --config "nfpm-processed.yaml" --packager deb --target /dist;
         rename 's/:/_/g' /dist/*.deb
 
+        PKG_NAME="ukp${RELEASE_VERSION}-tailscale"
         # Save VARS for later steps
         echo "PKG_VERSION_PREFIX=${PKG_VERSION_PREFIX}" >> "$GITHUB_OUTPUT"
         echo "PKG_VERSION=${SEMVER}" >> "$GITHUB_OUTPUT"
         echo "PKG_COMPONENT=${PKG_COMPONENT}" >> $GITHUB_OUTPUT
         echo "PKG_FEED=${PKG_FEED}" >> $GITHUB_OUTPUT
+        echo "RELEASE_VERSION=${RELEASE_VERSION}" >> "$GITHUB_OUTPUT"
+        echo "PKG_NAME=${PKG_NAME}" >> $GITHUB_OUTPUT
+
+    - name: Prepare meta package
+      id: prepare_meta
+      if: ${{ steps.package.outputs.RELEASE_VERSION != '' && steps.package.outputs.RELEASE_VERSION != '0' }}
+      shell: bash
+      run: |
+        # Build meta package only if this is the highest numbered release branch.
+        # For hotfix pushes to older branches (e.g. prod-stable13 when prod-stable14
+        # exists), we skip the meta package so it keeps pointing to the latest.
+
+        git fetch --no-tags --prune origin 'refs/heads/prod-stable*:refs/remotes/origin/prod-stable*' 'refs/heads/prod-preview*:refs/remotes/origin/prod-preview*'
+        RELEASE_VERSION="${{ steps.package.outputs.RELEASE_VERSION }}"
+        PKG_VERSION_PREFIX="${{ steps.package.outputs.PKG_VERSION_PREFIX }}"
+        DISTRO="${{ inputs.distro }}"
+        BUILD_META=true
+
+        # Export for nfpm
+        export SEMVER="${PKG_VERSION_PREFIX}+${DISTRO}"
+        export RELEASE_VERSION
+
+        # Determine branch kind (stable or preview)
+        if [[ "$GITHUB_REF" =~ ^refs/heads/prod-stable ]]; then
+          BRANCH_KIND="prod-stable"
+        else
+          BRANCH_KIND="prod-preview"
+        fi
+
+        # Query all remote branches matching the same kind with a numeric suffix
+        while IFS= read -r ref; do
+          # git branch -r output has leading whitespace and short form: "  origin/prod-stableN"
+          ref="${ref## }"
+          if [[ "${ref}" =~ origin/${BRANCH_KIND}([0-9]+)$ ]]; then
+            V="${BASH_REMATCH[1]}"
+            if (( V > ${RELEASE_VERSION} )); then
+              BUILD_META=false
+              echo "::notice::Skipping meta package: ${BRANCH_KIND}${V} exists (current: ${RELEASE_VERSION}). This is a hotfix build."
+              break;
+            fi
+          fi
+        done < <(git branch -r --list "origin/${BRANCH_KIND}*")
+
+        if [ "${BUILD_META}" = true ]; then
+          nfpm package --config "nfpm-meta.yaml" --packager deb --target /dist;
+          rename 's/:/_/g' /dist/*.deb;
+        fi

.github/workflows/release.yaml

@@ -2,7 +2,7 @@ name: release
 
 on:
   push:
-    branches: [prod-staging, prod-stable, prod-preview]
+    branches: [prod-staging, prod-stable, prod-preview, 'prod-preview[0-9]+', 'prod-stable[0-9]+']
   workflow_dispatch:
     inputs:
       publish_distro:
@@ -100,7 +100,7 @@ jobs:
         version_short: "${{ steps.build.outputs.version_short }}"
 
     - name: Upload build artifacts to GitHub
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: platform-tailscaled-${{ matrix.name }}-${{ matrix.arch }}-latest
         path: /dist

nfpm-meta.yaml

@@ -0,0 +1,14 @@
+name: ukp-tailscale
+arch: all
+platform: linux
+version: ${SEMVER}
+maintainer: Unikraft GmbH <support@unikraft.com>
+description: "Unikraft Platform - Meta package (installs latest ukp${RELEASE_VERSION}-tailscale)"
+homepage: https://unikraft.cloud
+vendor: Unikraft GmbH
+license: UNLICENSED
+depends:
+  - ukp${RELEASE_VERSION}-tailscale (= ${SEMVER})
+  - iptables
+recommends:
+  - iproute2

nfpm.yaml

@@ -1,8 +1,8 @@
-name: ukp-tailscale
+name: ukp${RELEASE_VERSION}-tailscale
 arch: ${ARCH}
 platform: linux
 version: ${SEMVER}
-maintainer: Unikraft GmbH <monkey@unikraft.io>
+maintainer: Unikraft GmbH <support@unikraft.com>
 description: The easiest, most secure, cross platform way to use WireGuard + oauth2 + 2FA/SSO. Patched version, compatible with Unikraft Cloud.
 homepage: https://www.tailscale.com
 vendor: Unikraft GmbH
@@ -12,14 +12,18 @@ depends:
   - iptables
 provides:
   - tailscale
+  # __DYNAMIC_RELEASE_PROVIDES__
 recommends:
   - iproute2
 conflicts:
   - tailscale
   - tailscale-relay
+  - ukp-tailscale (<< 6:0.0.0)
+  # __DYNAMIC_RELEASE_CONFLICTS__
 replaces:
   - tailscale
   - tailscale-relay
+  - ukp-tailscale (<< ${SEMVER})
 deb:
   breaks:
     - tailscale