[ci] publish releases with artifacts

.github/workflows/ci.yml

@@ -10,6 +10,9 @@ on:
   check_suite:
     types: [rerequested]
 
+permissions:
+  contents: read #  to fetch code (actions/checkout)
+
 jobs:
 
   rip-and-test:
@@ -29,6 +32,7 @@ jobs:
         set -x
         sudo apt-get install -y eatmydata
         eatmydata ./scripts/travis-install-build-deps.sh
+        sudo eatmydata apt --quiet --yes upgrade
         cd src
         eatmydata ./autogen.sh
         eatmydata ./configure --with-realtime=uspace --disable-check-runtime-deps
@@ -54,6 +58,7 @@ jobs:
         sudo apt-get install -y eatmydata
         eatmydata ./scripts/travis-install-build-deps.sh
         sudo eatmydata apt-get install -y clang
+        sudo eatmydata apt --quiet --yes upgrade
         cd src
         eatmydata ./autogen.sh
         CC=clang CXX=clang++ eatmydata ./configure --with-realtime=uspace --disable-check-runtime-deps
@@ -77,6 +82,7 @@ jobs:
       run: |
         ./scripts/travis-install-build-deps.sh
         sudo apt-get install -y eatmydata
+        sudo eatmydata apt --quiet --yes upgrade
         cd src
         eatmydata ./autogen.sh
         eatmydata ./configure --with-realtime=uspace --disable-check-runtime-deps --enable-build-documentation=html
@@ -108,7 +114,8 @@ jobs:
         set -e
         set -x
         apt-get --quiet update
-        apt-get --yes --quiet install eatmydata
+        apt-get --yes --quiet install eatmydata curl
+        eatmydata apt --quiet --yes upgrade
         # Install stuff needed to check out the linuxcnc repo and turn it into a debian source package.
         eatmydata apt-get --yes --quiet install --no-install-suggests git lsb-release python3 devscripts
 
@@ -192,7 +199,7 @@ jobs:
 
 
   package-indep:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     strategy:
       matrix:
         image: ["debian:bullseye", "debian:bookworm", "debian:trixie", "debian:sid"]
@@ -214,7 +221,8 @@ jobs:
         set -e
         set -x
         apt-get --quiet update
-        apt-get --yes --quiet install eatmydata
+        apt-get --yes --quiet install eatmydata curl
+        eatmydata apt --quiet --yes upgrade
         # Install stuff needed to check out the linuxcnc repo and turn it into a debian source package.
         eatmydata apt-get --yes --quiet install --no-install-suggests git lsb-release python3 devscripts
 

scripts/get-version-from-git

@@ -1,15 +1,14 @@
 #!/bin/bash
 
-if [ ! -z "$EMC2_HOME" ]; then
-    source $EMC2_HOME/scripts/githelper.sh
+if [ -n "$EMC2_HOME" ]; then
+    source "$EMC2_HOME"/scripts/githelper.sh
 else
-    source $(git rev-parse --show-toplevel)/scripts/githelper.sh
+    source "$(git rev-parse --show-toplevel)"/scripts/githelper.sh
 fi
 
-githelper $1
+githelper "$1"
 
 if [ "$DEB_COMPONENT" = "scratch" ]; then
-
     DESCRIBE=$(git describe --tags --exact-match 2>/dev/null)
     if [ -n "$DESCRIBE" ]; then
         echo "$DESCRIBE"

scripts/githelper.sh

@@ -12,6 +12,7 @@
 # Sets GIT_TAG to the most recent signed tag (this will fall back to the
 # most recent tag of any kind if no signed tag is found).
 #
+# shellcheck shell=bash
 
 
 function githelper() {
@@ -45,46 +46,53 @@ function githelper() {
             ;;
         *)
             GIT_TAG_GLOB="*"
+            # Disable unused variable warnings on DEB_COMPONENT
+            # shellcheck disable=SC2034
             DEB_COMPONENT="scratch"
             ;;
     esac
 
 
     # use the gnupg keyring from our git repo to verify signatures on the release tags
-    export GNUPGHOME=$(git rev-parse --show-toplevel)/gnupg
+    GNUPGHOME=$(git rev-parse --show-toplevel)/gnupg
+    export GNUPGHOME
 
     NEWEST_SIGNED_TAG_UTIME=-1
     NEWEST_UNSIGNED_TAG_UTIME=-1
     for TAG in $(git tag -l "$GIT_TAG_GLOB"); do
-        if ! git cat-file tag $TAG > /dev/null 2> /dev/null; then
+        if ! git cat-file tag "$TAG" > /dev/null 2> /dev/null; then
             continue
         fi
 
-        TAG_UTIME=$(git cat-file tag $TAG | grep tagger | awk '{print $(NF-1)-$NF*36}')
+        TAG_UTIME=$(git cat-file tag "$TAG" | grep tagger | awk '{print $(NF-1)-$NF*36}')
 
         if git tag -v "$TAG" > /dev/null 2> /dev/null; then
             # it's a valid signed tag
-            if [ $TAG_UTIME -gt $NEWEST_SIGNED_TAG_UTIME ]; then
+            if [ "$TAG_UTIME" -gt "$NEWEST_SIGNED_TAG_UTIME" ]; then
                 NEWEST_SIGNED_TAG=$TAG
                 NEWEST_SIGNED_TAG_UTIME=$TAG_UTIME
             fi
         else
             # unsigned tag
-            if [ $TAG_UTIME -gt $NEWEST_UNSIGNED_TAG_UTIME ]; then
+            if [ "$TAG_UTIME" -gt "$NEWEST_UNSIGNED_TAG_UTIME" ]; then
                 NEWEST_UNSIGNED_TAG=$TAG
                 NEWEST_UNSIGNED_TAG_UTIME=$TAG_UTIME
             fi
         fi
 
     done
 
-    if [ $NEWEST_SIGNED_TAG_UTIME -gt -1 ]; then
+    if [ "$NEWEST_SIGNED_TAG_UTIME" -gt -1 ]; then
+        # Disable unused variable warnings on GIT_TAG
+        # shellcheck disable=SC2034
         GIT_TAG="$NEWEST_SIGNED_TAG"
         return
     fi
 
-    if [ $NEWEST_UNSIGNED_TAG_UTIME -gt -1 ]; then
+    if [ "$NEWEST_UNSIGNED_TAG_UTIME" -gt -1 ]; then
         echo "no signed tags found, falling back to unsigned tags" > /dev/null 1>&2
+        # Disable unused variable warnings on GIT_TAG
+        # shellcheck disable=SC2034
         GIT_TAG="$NEWEST_UNSIGNED_TAG"
         return
     fi