Unify the CLI, PBS, and Signer Binaries into One (#425)

Co-authored-by: Jason Vranek <jasonvranek@gmail.com>

Closes #430, #431, #432

Author: jclapis

.github/workflows/release.yml

@@ -1,3 +1,4 @@
+
 name: Draft Release
 
 on:
@@ -83,20 +84,14 @@ jobs:
           - amd64
           - arm64
         name:
-          - commit-boost-cli
-          - commit-boost-pbs
-          - commit-boost-signer
+          - commit-boost
         include:
           - target: amd64
             package-suffix: x86-64
           - target: arm64
             package-suffix: arm64
-          - name: commit-boost-cli
-            target-crate: cli
-          - name: commit-boost-pbs
-            target-crate: pbs
-          - name: commit-boost-signer
-            target-crate: signer
+          - name: commit-boost
+            target-crate: commit-boost
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -150,7 +145,7 @@ jobs:
           path: |
             ${{ matrix.name }}-${{ inputs.tag }}-linux_${{ matrix.package-suffix }}.tar.gz
 
-  # Builds the arm64 binaries for Darwin, for all 3 crates, natively
+  # Builds the arm64 binary for Darwin natively
   build-binaries-darwin:
     needs: [resolve-tag]
     timeout-minutes: 60
@@ -162,9 +157,7 @@ jobs:
           # - x86_64-apple-darwin
           - aarch64-apple-darwin
         name:
-          - commit-boost-cli
-          - commit-boost-pbs
-          - commit-boost-signer
+          - commit-boost
         include:
           # - target: x86_64-apple-darwin
           #   os: macos-latest-large
@@ -252,7 +245,7 @@ jobs:
         uses: actions/download-artifact@v4
         with:
           path: ./artifacts
-          pattern: "commit-boost-*"
+          pattern: "commit-boost*"
 
       - name: Extract binaries
         run: |
@@ -305,7 +298,7 @@ jobs:
         uses: actions/download-artifact@v4
         with:
           path: ./artifacts
-          pattern: "commit-boost-*"
+          pattern: "commit-boost*"
 
       - name: Sign all binaries with Sigstore
         uses: sigstore/gh-action-sigstore-python@v3.0.0
@@ -318,7 +311,7 @@ jobs:
           name: signed-${{ inputs.tag }}
           path: ./artifacts/**/*.sigstore*
 
-  # Creates a draft release on GitHub with the binaries
+  # Creates a release on GitHub with the binaries
   finalize-release:
     needs:
       - build-binaries-linux
@@ -335,7 +328,13 @@ jobs:
         uses: actions/download-artifact@v4
         with:
           path: ./artifacts
-          pattern: "commit-boost-*"
+          pattern: "commit-boost*"
+
+      - name: Download signatures
+        uses: actions/download-artifact@v4
+        with:
+          path: ./artifacts
+          pattern: "signatures-${{ github.ref_name }}*"
 
       - name: Download signed artifacts
         uses: actions/download-artifact@v4
@@ -352,4 +351,75 @@ jobs:
           tag_name: ${{ inputs.tag }}
           name: ${{ inputs.tag }}
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+
+  # Fast-forwards stable (full release) or beta (RC) to the new tag.
+  # Runs after all artifacts are built and the draft release is created,
+  # so stable/beta are never touched if any part of the pipeline fails.
+  fast-forward-branch:
+    needs:
+      - finalize-release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token }}
+
+      - name: Configure git
+        run: |
+          git config user.name  "commit-boost-release-bot[bot]"
+          git config user.email "commit-boost-release-bot[bot]@users.noreply.github.com"
+
+      - name: Fast-forward beta branch (RC releases)
+        if: contains(github.ref_name, '-rc')
+        run: |
+          git checkout beta
+          git merge --ff-only "${{ github.ref_name }}"
+          git push origin beta
+
+      - name: Fast-forward stable branch (full releases)
+        if: "!contains(github.ref_name, '-rc')"
+        run: |
+          git checkout stable
+          git merge --ff-only "${{ github.ref_name }}"
+          git push origin stable
+
+  # Deletes the tag if any job in the release pipeline fails.
+  # This keeps the tag and release artifacts in sync — a tag should only
+  # exist if the full pipeline completed successfully.
+  # stable/beta are never touched on failure since fast-forward-branch
+  # only runs after finalize-release succeeds.
+  #
+  # Note: if finalize-release specifically fails, a draft release may already
+  # exist on GitHub pointing at the now-deleted tag and will need manual cleanup.
+  cleanup-on-failure:
+    needs:
+      - build-binaries-linux
+      - build-binaries-darwin
+      - sign-binaries
+      - build-and-push-pbs-docker
+      - build-and-push-signer-docker
+      - finalize-release
+      - fast-forward-branch
+    runs-on: ubuntu-latest
+    if: failure()
+    steps:
+      - uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+
+      - name: Delete tag
+        run: git push origin --delete ${{ github.ref_name }}

.gitignore

@@ -28,3 +28,6 @@ devenv.*
 devenv.lock
 .devenv.flake.nix
 .envrc
+
+# Generated from testnet
+kurtosis-dump