Stop publishing linux/android binaries via ORAS

.github/workflows/ci.yml

@@ -155,46 +155,6 @@ jobs:
           if-no-files-found: error
           retention-days: 90
 
-  publish-oci:
-    name: Publish OCI artifact to GHCR (ORAS)
-    needs: build
-    if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main')
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Download arm64 binaries
-        uses: actions/download-artifact@v4
-        with:
-          name: binaries-arm64
-          path: dist/
-
-      - name: Set up ORAS
-        uses: oras-project/setup-oras@v1
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Publish microinit-linux-arm64
-        run: ./scripts/publish-oci-microinit.sh dist/microinit-linux-arm64 dist/early-boot.sh dist/unmount.sh dist/shutdown-linux-arm64
-
-      - name: Job summary
-        run: |
-          {
-            echo "### OCI publish (ORAS)"
-            echo ""
-            echo "- Image: \`ghcr.io/dcc-bigfred/microinit-linux-arm64\`"
-            echo "- Tags: \`main\`, \`sha-${GITHUB_SHA::7}\`"
-          } >> "$GITHUB_STEP_SUMMARY"
-
   build-android:
     name: Build Android (${{ matrix.name }})
     needs: test
@@ -261,52 +221,6 @@ jobs:
           if-no-files-found: error
           retention-days: 90
 
-  publish-oci-android:
-    name: Publish Android OCI artifact to GHCR (ORAS)
-    needs: build-android
-    if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main')
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Download Android arm64 binaries
-        uses: actions/download-artifact@v4
-        with:
-          name: binaries-android-arm64
-          path: dist/
-
-      - name: Set up ORAS
-        uses: oras-project/setup-oras@v1
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Publish microinit-android-arm64
-        run: |
-          set -euo pipefail
-          microinit=dist/libmicroinit.so
-          shutdown=dist/libshutdown.so
-          [[ -f "${microinit}" ]] || microinit=dist/microinit-android-arm64
-          [[ -f "${shutdown}" ]] || shutdown=dist/shutdown-android-arm64
-          ./scripts/publish-oci-microinit-android.sh "${microinit}" "${shutdown}"
-
-      - name: Job summary
-        run: |
-          {
-            echo "### Android OCI publish (ORAS)"
-            echo ""
-            echo "- Image: \`ghcr.io/dcc-bigfred/microinit-android-arm64\`"
-            echo "- Tags: \`main\`, \`sha-${GITHUB_SHA::7}\`"
-          } >> "$GITHUB_STEP_SUMMARY"
-
   publish-image:
     name: Publish distroless container image
     needs: build

.github/workflows/release.yml

@@ -81,6 +81,66 @@ jobs:
             rm -rf "release-assets/android-${arch}"
           done
 
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.22"
+
+      - name: Install cross objcopy for ELF rewrite
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          # aarch64 (linux + android arm64) and arm (android armv7) on amd64 runner;
+          # native objcopy covers x86_64. inject-elf-version prefers llvm-objcopy when present.
+          sudo apt-get install -y --no-install-recommends \
+            binutils-aarch64-linux-gnu \
+            binutils-arm-linux-gnueabihf
+
+      - name: Inject release version into ELF binaries
+        env:
+          GOPROXY: direct
+        run: |
+          set -euo pipefail
+          TAG="${GITHUB_REF_NAME}"
+          COMMIT="${GITHUB_SHA::7}"
+          INJECT="github.com/dcc-bigfred/common/cmd/inject-elf-version@latest"
+          find release-assets -type f -print0 | while IFS= read -r -d '' f; do
+            if file -b "$f" | grep -qi 'ELF'; then
+              go run "${INJECT}" "$f" "$TAG" "$COMMIT" .microinit.version
+            else
+              echo "skip (not ELF): $f"
+            fi
+          done
+
+      - name: Refresh SHA256SUMS after ELF inject
+        run: |
+          set -euo pipefail
+          # CI ships SHA256SUMS for the arm64 linux artifact. ELF inject changes
+          # those binaries, so the published checksums must be recomputed.
+          sums=release-assets/SHA256SUMS
+          if [ ! -f "${sums}" ]; then
+            echo "no SHA256SUMS in release-assets; skipping refresh"
+            exit 0
+          fi
+          (
+            cd release-assets
+            mapfile -t names < <(awk '{print $2}' SHA256SUMS)
+            if [ "${#names[@]}" -eq 0 ]; then
+              echo "error: SHA256SUMS is empty" >&2
+              exit 1
+            fi
+            for n in "${names[@]}"; do
+              if [ ! -f "${n}" ]; then
+                echo "error: SHA256SUMS lists missing file: ${n}" >&2
+                exit 1
+              fi
+            done
+            sha256sum -- "${names[@]}" > SHA256SUMS.new
+            mv -f SHA256SUMS.new SHA256SUMS
+            echo "refreshed SHA256SUMS (${#names[@]} entries)"
+            cat SHA256SUMS
+          )
+
       - name: Create release if missing
         env:
           GH_TOKEN: ${{ github.token }}
@@ -108,9 +168,6 @@ jobs:
           fi
           gh release upload "$TAG" "${FILES[@]}" --clobber
 
-      - name: Set up ORAS
-        uses: oras-project/setup-oras@v1
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -121,12 +178,6 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Retag microinit ORAS artifact from main
-        run: ./scripts/retag-oci-microinit.sh "${GITHUB_REF_NAME}"
-
-      - name: Retag microinit Android ORAS artifact from main
-        run: ./scripts/retag-oci-microinit-android.sh "${GITHUB_REF_NAME}"
-
       - name: Retag distroless container image from main
         run: ./scripts/retag-oci-microinit-image.sh "${GITHUB_REF_NAME}"
 
@@ -136,8 +187,6 @@ jobs:
             echo "### Release ${GITHUB_REF_NAME}"
             echo ""
             echo "- GitHub Release assets uploaded (linux + android)"
-            echo "- ORAS: \`ghcr.io/dcc-bigfred/microinit-linux-arm64:${GITHUB_REF_NAME}\`"
-            echo "- ORAS: \`ghcr.io/dcc-bigfred/microinit-android-arm64:${GITHUB_REF_NAME}\`"
             echo "- Image: \`ghcr.io/dcc-bigfred/microinit:${GITHUB_REF_NAME}\`"
             echo "- Image: \`ghcr.io/dcc-bigfred/microinit:latest-release\`"
           } >> "$GITHUB_STEP_SUMMARY"