feat: hash-based manual release workflow

[ValentaTomas]

Mirrors the manual release pipeline from e2b-dev/fc-versions, but because the kernel inputs (configs + patches) live in this repo, each build is identified by a content hash of those inputs:

vmlinux-<kernel_version>_<sha256[:7]>

Changing a flag in configs/x86_64/<v>.config or dropping a patch in patches/<v>/ produces a new, traceable artifact and release; unchanged kernels reuse their existing artifact.

What's in here

• .github/workflows/release.yml — workflow_dispatch pipeline: validate → build (matrix per missing arch) → publish (GH release with vmlinux-{amd64,arm64}.bin + legacy vmlinux.bin) → deploy (uploads to gs://$GCP_BUCKET_NAME/kernels/<version_name>/). Existing artifacts/objects are skipped.
• scripts/validate.py — resolves version names, computes hashes, generates the build matrix, and queries the GitHub release to skip arches that are already published.
• build.sh — now takes <kernel_version> [arch], computes the same version_name (or honors VERSION_NAME), and applies any patches/<version>/*.patch. make build / make build-arm64 still work.
• Drops the old build-on-every-push workflow; releases are now explicit and manual.

Workflow inputs

• kernel_versions (optional, comma-separated) — defaults to kernel_versions.txt.
• build_amd64 / build_arm64 (default true) — arch toggles.

Notes

• Required repo config is unchanged: GCP_WORKLOAD_IDENTITY_PROVIDER, GCP_SERVICE_ACCOUNT_EMAIL, vars.GCP_BUCKET_NAME.
• Bash and Python hash implementations are kept in sync; verified locally that they produce the same hash for the existing 6.1.102 and 6.1.158 configs.

[cursor]

PR Summary

Medium Risk
Medium risk because it rewires the CI/release workflow (triggers, tagging, and GCS upload) and changes build script behavior, which can break publishing or produce wrong artifacts if assumptions are off.

Overview
The old push-triggered fc-kernels.yml workflow is removed and replaced with release.yml, which builds all (kernel version × arch) pairs on pull requests and only publishes (GitHub release + GCS upload) on workflow_dispatch using a calver tag.

build.sh is changed to accept an optional single version and arch, apply optional patches/<version>/*.patch, and write outputs under builds/vmlinux-<version>/{amd64,arm64}/vmlinux.bin with a legacy vmlinux.bin copy for x86_64; it also force-checks out the matching upstream tag and installs deps based on target arch.

The PR title/description mention hash-based versioning and skipping already-published artifacts, but the included workflow/script changes shown here don’t implement that (no content-hash naming or reuse/skip logic), so releases will always rebuild and tag by date.

^{Reviewed by Cursor Bugbot for commit fd2430a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Autofix Details

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: Artifact path loses version_name directory on download
  • Changed artifact upload path from ./builds/$version_name to ./builds to preserve the version_name directory structure in artifacts.
• ✅ Fixed: Multi-version local builds break when patches are applied
  • Added -f flag to git checkout to force-overwrite uncommitted patch changes between multi-version build iterations.

Or push these changes by commenting:

@cursor push a85f2957d0

Preview (a85f2957d0)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -67,7 +67,7 @@
       - uses: actions/upload-artifact@v4
         with:
           name: ${{ matrix.version_name }}-${{ matrix.arch }}
-          path: ./builds/${{ matrix.version_name }}
+          path: ./builds
           retention-days: 7
 
   publish:

diff --git a/build.sh b/build.sh
--- a/build.sh
+++ b/build.sh
@@ -102,7 +102,7 @@
   cp "$SCRIPT_DIR/configs/${target_arch}/${version}.config" .config
 
   echo "Checking out repo for kernel at version: $version"
-  git checkout "$(get_tag "$version")"
+  git checkout -f "$(get_tag "$version")"
 
   apply_patches "$version"

_{You can send follow-ups to the cloud agent here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Hash includes nested patches that apply_patches never applies
  • Modified hash computation in both build.sh and validate.py to only include top-level *.patch files, matching the behavior of apply_patches.

Or push these changes by commenting:

@cursor push 3e7936a79e

Preview (3e7936a79e)

diff --git a/build.sh b/build.sh
--- a/build.sh
+++ b/build.sh
@@ -37,7 +37,7 @@
   if [ -d "$SCRIPT_DIR/patches/$version" ]; then
     while IFS= read -r -d '' f; do
       files+=("$f")
-    done < <(find "$SCRIPT_DIR/patches/$version" -type f -print0 | sort -z)
+    done < <(find "$SCRIPT_DIR/patches/$version" -maxdepth 1 -type f -name '*.patch' -print0 | sort -z)
   fi
   if [ "${#files[@]}" -eq 0 ]; then
     echo "Error: no configs found for kernel version $version" >&2

diff --git a/scripts/validate.py b/scripts/validate.py
--- a/scripts/validate.py
+++ b/scripts/validate.py
@@ -51,7 +51,7 @@
             paths.append(cfg)
     patches_dir = REPO_ROOT / "patches" / version
     if patches_dir.is_dir():
-        paths.extend(sorted(p for p in patches_dir.rglob("*") if p.is_file()))
+        paths.extend(sorted(p for p in patches_dir.glob("*.patch") if p.is_file()))
 
     if not paths:
         raise SystemExit(f"::error::No configs found for kernel version {version}")

_{You can send follow-ups to the cloud agent here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Inconsistent kernel_versions.txt parsing between Python and Bash
  • Updated build.sh to strip inline comments and trim whitespace, matching the Python parser's behavior to ensure consistent version hashing.

Or push these changes by commenting:

@cursor push c23d53f5a8

Preview (c23d53f5a8)

diff --git a/build.sh b/build.sh
--- a/build.sh
+++ b/build.sh
@@ -161,7 +161,9 @@
     local version_name="${VERSION_NAME:-$(compute_version_name "$single_version")}"
     build_version "$single_version" "$target_arch" "$version_name"
   else
-    grep -v '^ *#' <"$SCRIPT_DIR/kernel_versions.txt" | while IFS= read -r version; do
+    grep -v '^ *#' <"$SCRIPT_DIR/kernel_versions.txt" | while IFS= read -r raw; do
+      version="${raw%%#*}"
+      version="$(echo "$version" | xargs)"
       [ -z "$version" ] && continue
       local version_name
       version_name="$(compute_version_name "$version")"

_{You can send follow-ups to the cloud agent here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Calver tag suffix skips .1 due to off-by-one
  • Changed counter initialization from n=1 to n=0 so the first suffixed tag is .1 instead of .2, matching the documented behavior.

Or push these changes by commenting:

@cursor push 73766c5030

Preview (73766c5030)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -67,7 +67,7 @@
           set -euo pipefail
           base="$(date -u +%Y.%m.%d)"
           tag="$base"
-          n=1
+          n=0
           while gh release view "$tag" >/dev/null 2>&1; do
             n=$((n + 1))
             tag="${base}.${n}"

_{You can send follow-ups to the cloud agent here.}

[cursor]

Stale comment

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Calver tag check ignores existing git tags causing retry failures
  • Changed tag uniqueness check from 'gh release view' to 'git rev-parse' to detect existing git tags, making the workflow idempotent on partial failures.

Or push these changes by commenting:

@cursor push 4a50f9f36e

Preview (4a50f9f36e)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -86,7 +86,7 @@
           base="$(date -u +%Y.%m.%d)"
           tag="$base"
           n=0
-          while gh release view "$tag" >/dev/null 2>&1; do
+          while git rev-parse "$tag" >/dev/null 2>&1; do
             n=$((n + 1))
             tag="${base}.${n}"
           done

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit c167397. Configure here.}