From cfe42076fb12d9cb015e2dc4dc9e21c9d7f5f1ea Mon Sep 17 00:00:00 2001 From: Ant Somers Date: Sun, 1 Nov 2026 15:12:05 +0300 Subject: [PATCH] docs: decdn's sign-release.sh, not publish-crates.sh, runs open-decdn-bump.sh decdn/decdn#2816 deleted publish-crates.sh; sign-release.sh now opens the bump PR once the release is out of draft. The invocation is unchanged. Closes #198 Co-Authored-By: Claude Opus 5.5 --- AGENTS.md | 2 +- ansible/roles/decdn_node/README.md | 2 +- scripts/open-decdn-bump.sh | 5 +++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 4ae31c59..bd837be2 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -126,7 +126,7 @@ paragraph, and that the vendored KEYS (four byte copies of decdn's) hold the key SECURITY.md publishes; the weekly `upstream-drift` job checks the exact copies and the mirrors against the line's newest release and flags a newer upstream line. Bump with the checklist in `roles/decdn_node/README.md`; `scripts/open-decdn-bump.sh` opens the -bump's PR (decdn's `publish-crates.sh` runs it after each release). Upstream is public +bump's PR (decdn's `sign-release.sh` runs it after each release). Upstream is public and also publishes the binaries as crates (`decdn-node`, `decdn-cli`, `sponsord`, `sponsord-onramp`); the roles do not install from crates.io (no maintainer signature). diff --git a/ansible/roles/decdn_node/README.md b/ansible/roles/decdn_node/README.md index c061bd39..64ba7b6a 100644 --- a/ansible/roles/decdn_node/README.md +++ b/ansible/roles/decdn_node/README.md @@ -739,7 +739,7 @@ chart's `appVersion` name a release line, so a decdn/decdn release in that line deployments on its own. What cannot resolve a line names one release, and moves on every upstream release: Compose's three image digests and onramp installer pin, the chart's example digest, the commented exact-pin examples, and the generated mirrors. `scripts/open-decdn-bump.sh -[vX.Y.Z]` opens that PR: decdn's `publish-crates.sh` runs it at the end of each decdn +[vX.Y.Z]` opens that PR: decdn's `sign-release.sh` runs it at the end of each decdn release, and a maintainer runs it by hand from a decdn/devops clone (with no tag, it takes decdn's latest release). It works in a worktree at `origin/main`, takes the digests from the release's assets once their signatures verify against diff --git a/scripts/open-decdn-bump.sh b/scripts/open-decdn-bump.sh index 883a6945..ecf3b0d8 100755 --- a/scripts/open-decdn-bump.sh +++ b/scripts/open-decdn-bump.sh @@ -5,8 +5,9 @@ # Usage: scripts/open-decdn-bump.sh [--dry-run] [vX.Y.Z] # # With no tag it takes decdn's latest published release. decdn's -# publish-crates.sh runs it with the tag it just published; a maintainer runs it -# by hand from a clone whose `origin` is decdn/devops, with push access. +# sign-release.sh runs it with the tag it just signed, once the release is out +# of draft; a maintainer runs it by hand from a clone whose `origin` is +# decdn/devops, with push access. # # It works in a detached worktree at origin/main, so the working copy and its # branch stay as they are. It commits as your git identity, pushes with your