Enable release and publishing workflows. Update Redis version to 8.8.0

Author: AngelYanev

.github/.env

@@ -0,0 +1,2 @@
+BUILD_TARGETS=[{"os":"linux","arch":"amd64","runner":"ubuntu-latest"},{"os":"linux","arch":"arm64","runner":"ubuntu-24.04-arm"},{"os":"darwin","arch":"amd64","runner":"macos-14-large"},{"os":"darwin","arch":"arm64","runner":"macos-14-xlarge"}]
+SMOKE_TEST_ARCHES=[{"arch":"amd64","runner":"ubuntu-latest"},{"arch":"arm64","runner":"ubuntu-24.04-arm"}]

.github/actions/common/slack.sh

@@ -0,0 +1,35 @@
+#!/bin/bash
+# Slack message builders for release notifications: a success message with the
+# install command, or a failure message with the reason.
+
+slack_format_success_message() {
+    # $1 release_tag  $2 base_url (…/redis-cli)  $3 env  $4 footer
+    jq -n --arg tag "$1" --arg base "$2" --arg env "$3" --arg footer "$4" '
+    {
+      "icon_emoji": ":redis-circle:",
+      "text": (":redis-circle: redis-cli " + $tag + " published (" + $env + ")"),
+      "blocks": [
+        { "type": "header",
+          "text": { "type": "plain_text", "text": ("redis-cli " + $tag + " published (" + $env + ")") } },
+        { "type": "section",
+          "text": { "type": "mrkdwn",
+            "text": ("Install:\n```curl -fsSL " + $base + "/install.sh | REDIS_CLI_VERSION=" + $tag + " sh```") } },
+        { "type": "context", "elements": [ { "type": "mrkdwn", "text": $footer } ] }
+      ]
+    }'
+}
+
+slack_format_failure_message() {
+    # $1 release_tag  $2 message  $3 env  $4 footer
+    jq -n --arg tag "$1" --arg msg "$2" --arg env "$3" --arg footer "$4" '
+    {
+      "icon_emoji": ":redis-circle:",
+      "text": (":x: redis-cli " + $tag + " release failed (" + $env + ")"),
+      "blocks": [
+        { "type": "header",
+          "text": { "type": "plain_text", "text": ("redis-cli " + $tag + " release failed (" + $env + ")") } },
+        { "type": "section", "text": { "type": "mrkdwn", "text": $msg } },
+        { "type": "context", "elements": [ { "type": "mrkdwn", "text": $footer } ] }
+      ]
+    }'
+}

.github/actions/parse-env-file/action.yml

@@ -0,0 +1,28 @@
+name: "Parse env file"
+description: "Parses the .github/.env build-matrix file and exposes its keys as outputs"
+
+inputs:
+  env_file_path:
+    description: ".env file path"
+    default: '.github/.env'
+    required: false
+
+outputs:
+  BUILD_TARGETS:
+    description: "JSON array of build targets ({os,arch,runner})"
+    value: ${{ steps.parse.outputs.BUILD_TARGETS }}
+  SMOKE_TEST_ARCHES:
+    description: "JSON array of arches to smoke-test the published artifacts on"
+    value: ${{ steps.parse.outputs.SMOKE_TEST_ARCHES }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Parse env file
+      id: parse
+      shell: bash
+      run: |
+        while IFS= read -r line || [[ -n "$line" ]]; do
+          [[ -z "$line" || "$line" =~ ^# ]] && continue
+          echo "$line" >> "$GITHUB_OUTPUT"
+        done < "${{ inputs.env_file_path }}"

.github/actions/parse-release-handle/action.yml

@@ -0,0 +1,52 @@
+name: "Parse release handle"
+description: "Parses a release_handle JSON input and extracts all available fields as outputs"
+
+inputs:
+  release_handle:
+    description: "JSON string containing release handle information"
+    required: true
+
+outputs:
+  run_id:
+    description: "The extracted run_id from the release_handle"
+    value: ${{ steps.parse.outputs.run_id }}
+  release_tag:
+    description: "The extracted release_tag from the release_handle"
+    value: ${{ steps.parse.outputs.release_tag }}
+  workflow_uuid:
+    description: "The extracted workflow_uuid from the release_handle"
+    value: ${{ steps.parse.outputs.workflow_uuid }}
+  release_type:
+    description: "The extracted release_type from the release_handle"
+    value: ${{ steps.parse.outputs.release_type }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Parse release handle
+      id: parse
+      shell: bash
+      run: |
+        release_handle='${{ inputs.release_handle }}'
+
+        if ! echo "$release_handle" | jq . >/dev/null 2>&1; then
+          echo "Error: release_handle is not valid JSON"
+          echo "Release handle content: $release_handle"
+          exit 1
+        fi
+
+        run_id=$(echo "$release_handle" | jq -r '.run_id // empty')
+        release_tag=$(echo "$release_handle" | jq -r '.release_tag // empty')
+        workflow_uuid=$(echo "$release_handle" | jq -r '.workflow_uuid // empty')
+        release_type=$(echo "$release_handle" | jq -r '.release_type // empty')
+
+        if [ -z "$run_id" ] || ! [[ "$run_id" =~ ^[0-9]+$ ]]; then
+          echo "Error: run_id missing/invalid in release_handle: '$run_id'"
+          exit 1
+        fi
+
+        echo "run_id=$run_id" >> "$GITHUB_OUTPUT"
+        [ -n "$release_tag" ]    && echo "release_tag=$release_tag" >> "$GITHUB_OUTPUT"
+        [ -n "$workflow_uuid" ]  && echo "workflow_uuid=$workflow_uuid" >> "$GITHUB_OUTPUT"
+        [ -n "$release_type" ]   && echo "release_type=$release_type" >> "$GITHUB_OUTPUT"
+        echo "Parsed handle: run_id=$run_id release_tag=$release_tag release_type=$release_type"

.github/actions/run-smoke-tests/action.yml

@@ -0,0 +1,22 @@
+name: "Run smoke tests"
+description: "Install the published redis-cli across many distros and verify it runs (via test-distros.sh)"
+
+inputs:
+  arch:
+    description: "Architecture to smoke-test (amd64 | arch of the runner)"
+    required: true
+  version:
+    description: "Version to install and verify"
+    required: true
+  base_url:
+    description: "Base URL the installer downloads from (…/redis-cli)"
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Smoke test published artifacts across distros
+      shell: bash
+      env:
+        REDIS_CLI_BASE_URL: ${{ inputs.base_url }}
+      run: ./test-distros.sh --arch ${{ inputs.arch }} --version "${{ inputs.version }}"

.github/actions/slack-notification/action.yml

@@ -0,0 +1,45 @@
+name: "Slack notification"
+description: "Send a redis-cli release Slack notification (no-op if the webhook secret is unset)"
+
+inputs:
+  slack_func:
+    description: "slack_format_success_message | slack_format_failure_message"
+    required: true
+  release_tag:
+    description: "Release tag"
+    required: true
+  env:
+    description: "Target environment (production | staging)"
+    required: true
+  base_url:
+    description: "Base URL (…/redis-cli), for the success message install line"
+    required: false
+    default: ""
+  message:
+    description: "Failure message"
+    required: false
+    default: ""
+  SLACK_WEB_HOOK_URL:
+    description: "Slack webhook URL (if empty, this action does nothing)"
+    required: false
+    default: ""
+
+runs:
+  using: "composite"
+  steps:
+    - name: Send Slack notification
+      if: inputs.SLACK_WEB_HOOK_URL != ''
+      shell: bash
+      run: |
+        . "${{ github.action_path }}/../common/slack.sh"
+        workflow_url="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+        footer="Repo: ${{ github.repository }} | Commit: \`${{ github.sha }}\` | <$workflow_url|workflow run>"
+
+        if [ "${{ inputs.slack_func }}" = "slack_format_success_message" ]; then
+          payload="$(slack_format_success_message "${{ inputs.release_tag }}" "${{ inputs.base_url }}" "${{ inputs.env }}" "$footer")"
+        else
+          msg="${{ inputs.message }}"
+          [ -n "$msg" ] || msg=":x: redis-cli release failed"
+          payload="$(slack_format_failure_message "${{ inputs.release_tag }}" "$msg" "${{ inputs.env }}" "$footer")"
+        fi
+        printf '%s' "$payload" | curl -s --fail-with-body -d @- "${{ inputs.SLACK_WEB_HOOK_URL }}"

.github/actions/update-redis-version/action.yml

@@ -0,0 +1,66 @@
+name: "Update Redis version"
+description: >
+  Pin the Redis source for a release line: write .redis_version and update
+  build.sh's PINNED_REF and PINNED_SHA256 to the tag, then commit to the release
+  version branch. Keeps source verification active for the new version.
+
+inputs:
+  release_tag:
+    description: "Release tag to pin (e.g. 8.8.0); 'unstable' is skipped"
+    required: true
+  release_version_branch:
+    description: "Branch to commit the pin to"
+    required: true
+  gh_token:
+    description: "GitHub token"
+    required: true
+
+outputs:
+  changed_files:
+    description: "Newline-separated files that were modified (empty if none)"
+    value: ${{ steps.repin.outputs.changed_files }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Re-pin Redis source
+      id: repin
+      shell: bash
+      run: |
+        TAG="${{ inputs.release_tag }}"
+        if [ "$TAG" = "unstable" ] || [ -z "$TAG" ]; then
+          echo "Skipping pin for '$TAG'"
+          echo "changed_files=" >> "$GITHUB_OUTPUT"
+          exit 0
+        fi
+
+        echo "$TAG" > .redis_version
+
+        tmp="$(mktemp)"
+        curl -fsSL "https://github.com/redis/redis/archive/${TAG}.tar.gz" -o "$tmp"
+        sha="$(sha256sum "$tmp" | awk '{print $1}')"
+        rm -f "$tmp"
+        echo "Computed source SHA-256 for $TAG: $sha"
+
+        sed -i -E "s|^PINNED_REF=.*|PINNED_REF=\"${TAG}\"|"       build.sh
+        sed -i -E "s|^PINNED_SHA256=.*|PINNED_SHA256=\"${sha}\"|" build.sh
+
+        if git diff --quiet .redis_version build.sh; then
+          echo "No version/pin changes"
+          echo "changed_files=" >> "$GITHUB_OUTPUT"
+        else
+          {
+            echo "changed_files<<EOF"
+            echo ".redis_version"
+            echo "build.sh"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+        fi
+
+    - name: Create verified commit
+      if: steps.repin.outputs.changed_files != ''
+      uses: iarekylew00t/verified-bot-commit@v1
+      with:
+        message: "Pin redis-cli source to ${{ inputs.release_tag }}"
+        files: ${{ steps.repin.outputs.changed_files }}
+        ref: ${{ inputs.release_version_branch }}

.github/workflows/build-and-test.yml .github/workflows/build-n-test.yml.github/workflows/build-and-test.yml renamed to .github/workflows/build-n-test.yml

@@ -1,36 +1,42 @@
 name: Build and Test
 
-# Reusable workflow: builds statically linked redis-cli for all four targets
-# (linux/macos x amd64/arm64), smoke-tests each, and uploads them as run
-# artifacts. Called by release_build_and_test.yml and release_publish.yml.
-
 on:
   workflow_call:
     inputs:
       release_tag:
-        description: 'Redis version/tag to build (e.g. 8.4.4) or "unstable"'
+        description: 'Redis version/tag to build (e.g. 8.8.0) or "unstable"'
+        required: true
+        type: string
+      build_targets:
+        description: 'JSON array of {os,arch,runner} (from .github/.env)'
         required: true
         type: string
+      checkout_ref:
+        description: 'Ref to build (e.g. the release version branch); default = triggering ref'
+        required: false
+        type: string
+        default: ''
 
 jobs:
   build:
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - { os: linux,  arch: amd64, runner: ubuntu-latest }
-          - { os: linux,  arch: arm64, runner: ubuntu-24.04-arm }
-          - { os: darwin, arch: amd64, runner: macos-14-large }   # macOS 14 x86_64
-          - { os: darwin, arch: arm64, runner: macos-14-xlarge }  # macOS 14 arm64
+        include: ${{ fromJSON(inputs.build_targets) }}
     runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ inputs.checkout_ref }}
 
       - name: Install OpenSSL (macOS)
         if: matrix.os == 'darwin'
         run: brew install openssl@3 || brew upgrade openssl@3 || true
 
       - name: Build static redis-cli
+        # Release builds must have a verified source checksum (fail closed).
+        env:
+          REDIS_CLI_REQUIRE_VERIFIED_SOURCE: 1
         run: ./build.sh --version "${{ inputs.release_tag }}" --os ${{ matrix.os }} --arch ${{ matrix.arch }} --output dist
 
       - name: Smoke test
@@ -39,7 +45,7 @@ jobs:
           chmod +x "$bin"
           "$bin" --version
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v6
         with:
           name: redis-cli-${{ matrix.os }}-${{ matrix.arch }}
           path: |

.github/workflows/cli.yml

@@ -0,0 +1,33 @@
+name: CLI
+
+# Build and smoke-test every target on pull requests and pushes, using the Redis
+# version pinned in .redis_version.
+
+on:
+  pull_request:
+    branches: [unstable, "release/*"]
+  push:
+    branches: [unstable, "release/*"]
+  workflow_dispatch:
+  workflow_call:
+
+jobs:
+  populate-env-vars:
+    runs-on: ubuntu-latest
+    outputs:
+      BUILD_TARGETS: ${{ steps.parse.outputs.BUILD_TARGETS }}
+      release_tag: ${{ steps.v.outputs.release_tag }}
+    steps:
+      - uses: actions/checkout@v5
+      - name: Parse env file
+        id: parse
+        uses: ./.github/actions/parse-env-file
+      - id: v
+        run: echo "release_tag=$(cat .redis_version)" >> "$GITHUB_OUTPUT"
+
+  build-n-test:
+    needs: populate-env-vars
+    uses: ./.github/workflows/build-n-test.yml
+    with:
+      release_tag: ${{ needs.populate-env-vars.outputs.release_tag }}
+      build_targets: ${{ needs.populate-env-vars.outputs.BUILD_TARGETS }}