Add upstream integration and release workflows for toolkit updates

[opajonk]

The upstream_integration.yml workflow automates the process of updating the toolkit from an internal release archive, including authorization, downloading, extracting, creating a draft release, and attaching required assets to it. The release.yml acts upon a "non-draft-release" publication and publishes the User's Manual to GitHub Pages.

Also, the README.md is updated.

[vzeissler]

misc improvements

[Copilot]

Pull request overview

Adds automation for integrating upstream EB corbos Toolkit release archives into this repository and for publishing the User’s Manual to GitHub Pages when a release is published.

Changes:

• Introduces an upstream_integration.yml workflow plus helper scripts to download/extract an upstream delivery archive, smoke-test it (kas + QEMU), open/update an integration PR, push GHCR image tags, and create/update a draft GitHub Release with assets.
• Introduces a release.yml workflow to validate/download the User’s Manual HTML asset from a published release and deploy it to GitHub Pages.
• Updates README.md to point users to GitHub Pages for the latest User’s Manual and clarifies onboarding options.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
README.md	Updates Getting Started guidance and adds GitHub Pages User’s Manual link.
.github/workflows/upstream_integration.yml	New workflow to integrate upstream archive, test, open PR, publish draft release assets, and retag/push containers.
.github/workflows/release.yml	New workflow to deploy the User’s Manual HTML asset from a published release to GitHub Pages.
.github/scripts/qemu_smoke_test.sh	Adds QEMU/SSH smoke test script used by upstream integration workflow.
.github/scripts/package_release_assets.sh	Adds script to collect and package release assets from extracted archive output.
.github/scripts/integrate_workspace.sh	Adds script to replace repo working tree with upstream workspace while preserving repo-owned metadata.
.github/scripts/download_archive.sh	Adds script to download and validate upstream archive, exporting paths for later workflow steps.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Suppressed comments (3)

README.md:22

• Minor grammar: “e.g” should be “e.g.,” (with a period and comma) before the example link.

Clone the repository and open it in a [devcontainer](https://containers.dev/)-capable IDE, e.g [Visual Studio Code](https://code.visualstudio.com/).

.github/workflows/upstream_integration.yml:97

• workflow_dispatch inputs are persisted with the workflow run and are not treated as secrets; taking artifactory_token as an input risks accidental disclosure outside log masking. Prefer reading the token from a repository/environment secret and fail fast if it is missing.

          set -euo pipefail
          echo "::add-mask::${{ inputs.artifact_url }}"
          echo "::add-mask::${{ inputs.artifactory_token }}"
          "${SCRIPTS_DIR}/download_archive.sh" \
            --url "${{ inputs.artifact_url }}" \
            --token "${{ inputs.artifactory_token }}" \
            >> "${GITHUB_ENV}"

.github/scripts/qemu_smoke_test.sh:48

• If the workflow step that captures DEV_CONTAINER_ID fails or is cancelled, the detached devcontainer started here may be left running on the runner. Adding a local trap cleanup in this script makes the smoke test self-contained and prevents resource leaks, even when the workflow-level cleanup doesn’t run as expected.

# Run the dev container in detached mode and keep it running.
export EXTRA_DOCKER_OPTIONS="-d --log-driver local"
LOG_FILE=$(mktemp -t ebcl_run_devcontainer-XXXXXX.log 2>/dev/null) ||
  LOG_FILE="/tmp/ebcl_run_devcontainer.log"

echo "Starting devcontainer in the background" >&2
DEV_CONTAINER_ID=$("${run_script}" -d -- bash -c "sleep infinity" 2>&1 | tee "${LOG_FILE}" | grep -oE '^[0-9a-f]{64}$')
if [[ -z "${DEV_CONTAINER_ID}" ]]; then
  echo "ERROR: Failed to start devcontainer. Log output:" >&2
  cat "${LOG_FILE}" >&2
  exit 1
fi

echo "DEV_CONTAINER_ID=${DEV_CONTAINER_ID}"
sleep 10

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Suppressed comments (4)

.github/scripts/package_release_assets.sh:62

• Copying per-target sysroot/key files directly into a shared assets directory can silently overwrite files when multiple targets produce the same filenames (e.g., identical SDK tarball names or common key filenames). This can result in incomplete or incorrect release assets. Prefix (or namespace) the files by target to make collisions impossible.

  sdk_dir="${target_dir}sysroot"
  if [[ -d "${sdk_dir}" ]]; then
    find "${sdk_dir}" -maxdepth 1 -type f -exec cp {} "${assets_dir}/" \;
  fi

.github/scripts/qemu_smoke_test.sh:45

• With set -euo pipefail, this command substitution will cause the script to exit immediately if grep finds no match (exit code 1), so the subsequent if [[ -z ... ]] error handling may never run. Capture the output and parse the container ID in a way that doesn't trip set -e, while still preserving the log for diagnostics.

echo "Starting devcontainer in the background" >&2
DEV_CONTAINER_ID=$("${run_script}" -d -- bash -c "sleep infinity" 2>&1 | tee "${LOG_FILE}" | grep -oE '^[0-9a-f]{64}$')
if [[ -z "${DEV_CONTAINER_ID}" ]]; then

.github/workflows/upstream_integration.yml:190

• Parsing JSON with sed is brittle and can break if formatting changes (whitespace, additional fields, or different ordering). Since jq is already required earlier in the workflow, prefer using it to extract the tag reliably.

          rfi_tag="$(sed -n 's/.*"image":.*:\([^"]*\)".*/\1/p' "${devcontainer_json}" | head -1)"

README.md:22

• Minor grammar: “e.g” should include a period (and typically a comma) before the example.

Clone the repository and open it in a [devcontainer](https://containers.dev/)-capable IDE, e.g [Visual Studio Code](https://code.visualstudio.com/).