[stable2506] Backport #11116

.github/workflows/release-10_branchoff-stable.yml

@@ -37,15 +37,18 @@ jobs:
 
       - name: Validate inputs
         id: validate_inputs
+        env:
+          INPUT_NODE_VERSION: ${{ inputs.node_version }}
+          INPUT_STABLE_VERSION: ${{ inputs.stable_version }}
         run: |
           . ./.github/scripts/common/lib.sh
 
-          if [ -n "${{ inputs.node_version }}" ]; then
-            node_version=$(filter_version_from_input "${{ inputs.node_version }}")
+          if [ -n "$INPUT_NODE_VERSION" ]; then
+            node_version=$(filter_version_from_input "$INPUT_NODE_VERSION")
             echo "node_version=${node_version}" >> $GITHUB_OUTPUT
           fi
 
-          stable_version=$(validate_stable_tag ${{ inputs.stable_version }})
+          stable_version=$(validate_stable_tag "$INPUT_STABLE_VERSION")
           echo "stable_version=${stable_version}" >> $GITHUB_OUTPUT
 
   create-stable-branch:
@@ -103,10 +106,10 @@ jobs:
       - name: Bump versions, reorder prdocs and push stable branch
         env:
           GH_TOKEN: ${{ steps.generate_write_token.outputs.token }}
+          NODE_VERSION: ${{ needs.validate-inputs.outputs.node_version }}
         run: |
           . ./.github/scripts/release/release_lib.sh
 
-          NODE_VERSION="${{ needs.validate-inputs.outputs.node_version }}"
           NODE_VERSION_PATTERN="\(NODE_VERSION[^=]*= \)\".*\""
           set_version "$NODE_VERSION_PATTERN" $NODE_VERSION "polkadot/node/primitives/src/lib.rs"
           commit_with_message "Bump node version to $NODE_VERSION in polkadot-cli"
@@ -127,12 +130,14 @@ jobs:
         if: ${{ inputs.tag_rc }}
         env:
           GH_TOKEN: ${{ steps.generate_write_token.outputs.token }} # or use a PAT with workflow scope
+          STABLE_VERSION: ${{ needs.validate-inputs.outputs.stable_version }}
+          GH_REPOSITORY: ${{ github.repository }}
         run: |
-          stable_tag_base=polkadot-${{ needs.validate-inputs.outputs.stable_version }}
+          stable_tag_base="polkadot-${STABLE_VERSION}"
           gh workflow run release-11_rc-automation.yml \
-            --repo ${{ github.repository }} \
-            --ref ${{ needs.validate-inputs.outputs.stable_version }} \
-            --field version=${stable_tag_base}
+            --repo "$GH_REPOSITORY" \
+            --ref "$STABLE_VERSION" \
+            --field version="${stable_tag_base}"
 
   tag-rc-without-branchoff:
     if: ${{ !inputs.is_new_stable && inputs.tag_rc }}

.github/workflows/release-11_rc-automation.yml

@@ -64,14 +64,16 @@ jobs:
         # if: ${{ steps.get_rel_product.outputs.product == 'polkadot' }}
         id: compute_tag
         shell: bash
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
         run: |
           . ./.github/scripts/common/lib.sh
 
           # Get last rc tag if exists, else set it to {version}-rc1
-          if [[ -z "${{ inputs.version }}" ]]; then
+          if [[ -z "$INPUT_VERSION" ]]; then
             version=v$(get_polkadot_node_version_from_code)
           else
-            version=$(validate_stable_tag ${{ inputs.version }})
+            version=$(validate_stable_tag "$INPUT_VERSION")
           fi
           echo "$version"
           echo "version=$version" >> $GITHUB_OUTPUT

.github/workflows/release-20_build-rc.yml

@@ -38,10 +38,12 @@ jobs:
 
       - name: Validate inputs
         id: validate_inputs
+        env:
+          INPUT_RELEASE_TAG: ${{ inputs.release_tag }}
         run: |
           . ./.github/scripts/common/lib.sh
 
-          RELEASE_TAG=$(validate_stable_tag ${{ inputs.release_tag }})
+          RELEASE_TAG=$(validate_stable_tag "$INPUT_RELEASE_TAG")
           echo "release_tag=${RELEASE_TAG}" >> $GITHUB_OUTPUT
 
   build-polkadot-binary:

.github/workflows/release-21_build-runtimes.yml

@@ -70,10 +70,12 @@ jobs:
 
       - name: Validate inputs
         id: validate_inputs
+        env:
+          INPUT_RELEASE_TAG: ${{ inputs.release_tag }}
         run: |
           . ./.github/scripts/common/lib.sh
 
-          RELEASE_TAG=$(validate_stable_tag ${{ inputs.release_tag }})
+          RELEASE_TAG=$(validate_stable_tag "$INPUT_RELEASE_TAG")
           echo "release_tag=${RELEASE_TAG}" >> $GITHUB_OUTPUT
 
   build-runtimes:
@@ -83,8 +85,6 @@ jobs:
        excluded_runtimes: "rococo asset-hub-rococo bridge-hub-rococo rococo substrate-test bp cumulus-test kitchensink minimal-template parachain-template penpal polkadot-test seedling shell frame-try sp solochain-template polkadot-sdk-docs-first pallet-staking-async-parachain pallet-staking-async-rc frame-storage-access-test yet-another-parachain revive-dev"
        build_opts: "--features on-chain-release-build"
        profile: production
-       chain: ${{ inputs.chain }}
-       runtime_dir: ${{ inputs.runtime_dir }}
     permissions:
       id-token: write
       attestations: write

.github/workflows/release-22_combined-rc-runtime-builds-release-draft.yml

@@ -71,10 +71,12 @@ jobs:
 
       - name: Validate inputs
         id: validate_inputs
+        env:
+          INPUT_RELEASE_TAG: ${{ inputs.release_tag }}
         run: |
           . ./.github/scripts/common/lib.sh
 
-          RELEASE_TAG=$(validate_stable_tag ${{ inputs.release_tag }})
+          RELEASE_TAG=$(validate_stable_tag "$INPUT_RELEASE_TAG")
           echo "release_tag=${RELEASE_TAG}" >> $GITHUB_OUTPUT
 
   build-runtimes-flow:

.github/workflows/release-30_publish_release_draft.yml

@@ -74,10 +74,12 @@ jobs:
 
       - name: Validate inputs
         id: validate_inputs
+        env:
+          INPUT_RELEASE_TAG: ${{ inputs.release_tag }}
         run: |
           . ./.github/scripts/common/lib.sh
 
-          RELEASE_TAG=$(validate_stable_tag ${{ inputs.release_tag }})
+          RELEASE_TAG=$(validate_stable_tag "$INPUT_RELEASE_TAG")
           echo "release_tag=${RELEASE_TAG}" >> $GITHUB_OUTPUT
 
 
@@ -106,10 +108,11 @@ jobs:
         if: ${{ inputs.no_runtimes == false && inputs.crates_only == false }}
         env:
           GITHUB_TOKEN: ${{ steps.generate_write_token.outputs.token }}
+          BUILD_RUN_ID: ${{ inputs.build_run_id }}
         run: |
-          mkdir -p ${{ github.workspace}}/runtimes/
-          gh run download ${{ inputs.build_run_id }} --dir ${{ github.workspace}}/runtimes
-          ls -la ${{ github.workspace}}/runtimes
+          mkdir -p "${GITHUB_WORKSPACE}/runtimes/"
+          gh run download "$BUILD_RUN_ID" --dir "${GITHUB_WORKSPACE}/runtimes"
+          ls -la "${GITHUB_WORKSPACE}/runtimes"
 
       - name: Prepare tooling
         run: |
@@ -131,6 +134,7 @@ jobs:
           RELEASE_TAG: ${{ needs.validate-inputs.outputs.release_tag }}
           NO_RUNTIMES: ${{ inputs.no_runtimes }}
           CRATES_ONLY: ${{ inputs.crates_only }}
+          GH_REF_NAME: ${{ github.ref_name }}
         shell: bash
         run: |
           . ./.github/scripts/common/lib.sh
@@ -139,7 +143,7 @@ jobs:
 
           export REF1=$(get_latest_release_tag)
           if [[ -z "$RELEASE_TAG" ]]; then
-            export REF2="${{ github.ref_name }}"
+            export REF2="${GH_REF_NAME}"
             echo "REF2: ${REF2}"
           else
             export REF2="$RELEASE_TAG"
@@ -203,28 +207,32 @@ jobs:
       - name: Download runtimes
         env:
           GITHUB_TOKEN: ${{ steps.generate_write_token.outputs.token }}
+          BUILD_RUN_ID: ${{ inputs.build_run_id }}
         run: |
-          mkdir -p ${{ github.workspace}}/runtimes/
-          gh run download ${{ inputs.build_run_id }} --dir ${{ github.workspace}}/runtimes
-          ls -la ${{ github.workspace}}/runtimes
+          mkdir -p "${GITHUB_WORKSPACE}/runtimes/"
+          gh run download "$BUILD_RUN_ID" --dir "${GITHUB_WORKSPACE}/runtimes"
+          ls -la "${GITHUB_WORKSPACE}/runtimes"
 
       - name: Get runtime info
         env:
+          CHAIN: ${{ matrix.chain }}
           JSON: ${{ github.workspace}}/release-notes-context/runtimes/${{ matrix.chain }}-runtime/${{ matrix.chain }}-srtool-digest.json
         run: |
-          cd ${{ github.workspace}}/runtimes
-          >>$GITHUB_ENV echo ASSET=$(find ${{ matrix.chain }}-runtime -name '*.compact.compressed.wasm')
+          cd "${GITHUB_WORKSPACE}/runtimes"
+          >>$GITHUB_ENV echo ASSET=$(find "${CHAIN}-runtime" -name '*.compact.compressed.wasm')
           >>$GITHUB_ENV echo SPEC=$(<${JSON} jq -r .runtimes.compact.subwasm.core_version.specVersion)
 
       - name: Upload compressed ${{ matrix.chain }} v${{ env.SPEC }} wasm
         working-directory: ${{ github.workspace}}/runtimes
         env:
           GITHUB_TOKEN: ${{ steps.generate_write_token.outputs.token }}
+          CHAIN: ${{ matrix.chain }}
+          VALIDATED_RELEASE_TAG: ${{ needs.validate-inputs.outputs.release_tag }}
         run: |
-          VERSIONED_ASSET="${{ matrix.chain }}_runtime-v${{ env.SPEC }}.compact.compressed.wasm"
+          VERSIONED_ASSET="${CHAIN}_runtime-v${{ env.SPEC }}.compact.compressed.wasm"
           mv "${{ env.ASSET }}" "$VERSIONED_ASSET"
 
-          gh release upload ${{ needs.validate-inputs.outputs.release_tag }} \
+          gh release upload "$VALIDATED_RELEASE_TAG" \
             --repo paritytech/polkadot-sdk "$VERSIONED_ASSET"
 
   publish-release-artifacts:
@@ -243,23 +251,28 @@ jobs:
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Fetch binaries from s3 based on version
+        env:
+          VERSION: ${{ needs.validate-inputs.outputs.release_tag }}
+          BINARY: ${{ matrix.binary }}
+          TARGET: ${{ matrix.target }}
         run: |
           . ./.github/scripts/common/lib.sh
 
-          VERSION="${{ needs.validate-inputs.outputs.release_tag }}"
-          fetch_release_artifacts_from_s3 ${{ matrix.binary }} ${{ matrix.target }}
+          fetch_release_artifacts_from_s3 "$BINARY" "$TARGET"
 
       - name: Rename aarch64-apple-darwin binaries
         if: ${{ matrix.target == 'aarch64-apple-darwin' }}
         working-directory: ${{ github.workspace}}/release-artifacts/${{ matrix.target }}/${{ matrix.binary }}
+        env:
+          BINARY: ${{ matrix.binary }}
         run: |
           . ../../../.github/scripts/common/lib.sh
 
-          mv ${{ matrix.binary }} ${{ matrix.binary }}-aarch64-apple-darwin
-          mv ${{ matrix.binary }}.asc ${{ matrix.binary }}-aarch64-apple-darwin.asc
+          mv "$BINARY" "${BINARY}-aarch64-apple-darwin"
+          mv "${BINARY}.asc" "${BINARY}-aarch64-apple-darwin.asc"
 
-          sha256sum "${{ matrix.binary }}-aarch64-apple-darwin" | tee "${{ matrix.binary }}-aarch64-apple-darwin.sha256"
-          check_sha256 "${{ matrix.binary }}-aarch64-apple-darwin" && echo "OK" || echo "ERR"
+          sha256sum "${BINARY}-aarch64-apple-darwin" | tee "${BINARY}-aarch64-apple-darwin.sha256"
+          check_sha256 "${BINARY}-aarch64-apple-darwin" && echo "OK" || echo "ERR"
 
       - name: Generate content write token for the release automation
         id: generate_write_token
@@ -273,20 +286,23 @@ jobs:
       - name: Upload ${{ matrix.binary }} binary to release draft
         env:
           GITHUB_TOKEN: ${{ steps.generate_write_token.outputs.token }}
+          BINARY: ${{ matrix.binary }}
+          TARGET: ${{ matrix.target }}
+          VALIDATED_RELEASE_TAG: ${{ needs.validate-inputs.outputs.release_tag }}
         working-directory: ${{ github.workspace}}/release-artifacts/${{ matrix.target }}/${{ matrix.binary }}
         run: |
-          if [[ ${{ matrix.target }} == "aarch64-apple-darwin" ]]; then
-            gh release upload ${{ needs.validate-inputs.outputs.release_tag }} \
+          if [[ "$TARGET" == "aarch64-apple-darwin" ]]; then
+            gh release upload "$VALIDATED_RELEASE_TAG" \
               --repo paritytech/polkadot-sdk \
-              ${{ matrix.binary }}-aarch64-apple-darwin \
-              ${{ matrix.binary }}-aarch64-apple-darwin.asc \
-              ${{ matrix.binary }}-aarch64-apple-darwin.sha256
+              "${BINARY}-aarch64-apple-darwin" \
+              "${BINARY}-aarch64-apple-darwin.asc" \
+              "${BINARY}-aarch64-apple-darwin.sha256"
           else
-            gh release upload ${{ needs.validate-inputs.outputs.release_tag }} \
+            gh release upload "$VALIDATED_RELEASE_TAG" \
               --repo paritytech/polkadot-sdk \
-              ${{ matrix.binary }} \
-              ${{ matrix.binary }}.asc \
-              ${{ matrix.binary }}.sha256
+              "$BINARY" \
+              "${BINARY}.asc" \
+              "${BINARY}.sha256"
           fi
 
   post_to_matrix:

.github/workflows/release-31_promote-rc-to-final.yml

@@ -40,10 +40,12 @@ jobs:
 
       - name: Validate inputs
         id: validate_inputs
+        env:
+          INPUT_RELEASE_TAG: ${{ inputs.release_tag }}
         run: |
           . ./.github/scripts/common/lib.sh
 
-          RELEASE_TAG=$(validate_stable_tag ${{ inputs.release_tag }})
+          RELEASE_TAG=$(validate_stable_tag "$INPUT_RELEASE_TAG")
           echo "release_tag=${RELEASE_TAG}" >> $GITHUB_OUTPUT
 
   promote-polkadot-rc-to-final:

.github/workflows/release-50_publish-docker.yml

@@ -83,13 +83,16 @@ jobs:
 
       - name: Validate inputs
         id: validate_inputs
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
+          INPUT_STABLE_TAG: ${{ inputs.stable_tag }}
         run: |
           . ./.github/scripts/common/lib.sh
 
-          VERSION=$(filter_version_from_input "${{ inputs.version }}")
+          VERSION=$(filter_version_from_input "$INPUT_VERSION")
           echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
 
-          STABLE_TAG=$(validate_stable_tag ${{ inputs.stable_tag }})
+          STABLE_TAG=$(validate_stable_tag "$INPUT_STABLE_TAG")
           echo "stable_tag=${STABLE_TAG}" >> $GITHUB_OUTPUT
 
   fetch-artifacts: # this job will be triggered for the polkadot-parachain rc and release or polkadot rc image build
@@ -103,11 +106,12 @@ jobs:
 
       - name: Fetch rc artifacts or release artifacts from s3 based on version
         # if: ${{ env.EVENT_NAME  == 'workflow_dispatch' && inputs.binary != 'polkadot-omni-node' && inputs.binary != 'chain-spec-builder'}}
+        env:
+          VERSION: ${{ needs.validate-inputs.outputs.stable_tag }}
         run: |
           . ./.github/scripts/common/lib.sh
 
-          VERSION="${{ needs.validate-inputs.outputs.stable_tag }}"
-          if [[ ${{ inputs.binary }} == 'polkadot' ]]; then
+          if [[ "$BINARY" == 'polkadot' ]]; then
             bins=(polkadot polkadot-prepare-worker polkadot-execute-worker)
             for bin in "${bins[@]}"; do
               fetch_release_artifacts_from_s3 $bin x86_64-unknown-linux-gnu
@@ -157,25 +161,31 @@ jobs:
         if: ${{ env.IMAGE_TYPE == 'rc' }}
         id: fetch_rc_refs
         shell: bash
+        env:
+          VALIDATED_VERSION: ${{ needs.validate-inputs.outputs.version }}
+          VALIDATED_STABLE_TAG: ${{ needs.validate-inputs.outputs.stable_tag }}
         run: |
           . ../.github/scripts/common/lib.sh
 
           commit=$(git rev-parse --short HEAD) && \
           echo "commit=${commit}" >> $GITHUB_OUTPUT
-          echo "release=$(echo ${{ needs.validate-inputs.outputs.version }})" >> $GITHUB_OUTPUT
-          echo "tag=$(prepare_docker_stable_tag ${{ needs.validate-inputs.outputs.stable_tag }})" >> $GITHUB_OUTPUT
+          echo "release=${VALIDATED_VERSION}" >> $GITHUB_OUTPUT
+          echo "tag=$(prepare_docker_stable_tag "$VALIDATED_STABLE_TAG")" >> $GITHUB_OUTPUT
 
       - name: Fetch release tags
         working-directory: release-artifacts
         if: ${{ env.IMAGE_TYPE == 'release'}}
         id: fetch_release_refs
         shell: bash
+        env:
+          VALIDATED_VERSION: ${{ needs.validate-inputs.outputs.version }}
+          VALIDATED_STABLE_TAG: ${{ needs.validate-inputs.outputs.stable_tag }}
         run: |
           . ../.github/scripts/common/lib.sh
 
           echo "tag=latest" >> $GITHUB_OUTPUT
-          echo "release=$(echo ${{ needs.validate-inputs.outputs.version }})" >> $GITHUB_OUTPUT
-          echo "stable=$(prepare_docker_stable_tag ${{ needs.validate-inputs.outputs.stable_tag }})" >> $GITHUB_OUTPUT
+          echo "release=${VALIDATED_VERSION}" >> $GITHUB_OUTPUT
+          echo "stable=$(prepare_docker_stable_tag "$VALIDATED_STABLE_TAG")" >> $GITHUB_OUTPUT
 
       - name: Build Injected Container image for polkadot rc
         if: ${{ env.BINARY == 'polkadot' }}
@@ -184,10 +194,26 @@ jobs:
           IMAGE_NAME: ${{ env.BINARY }}
           OWNER: ${{ env.DOCKER_OWNER }}
           TAGS: ${{ join(steps.fetch_rc_refs.outputs.*, ',') || join(steps.fetch_release_refs.outputs.*, ',') }}
+          VALIDATED_VERSION: ${{ needs.validate-inputs.outputs.version }}
+        shell: bash
         run: |
           ls -al
           echo "Building container for $BINARY"
-          ./docker/scripts/polkadot/build-injected.sh $ARTIFACTS_FOLDER
+          echo "IMAGE_TYPE: $IMAGE_TYPE"
+
+          if [[ "$IMAGE_TYPE" == "rc" ]]; then
+            echo "Building RC container for polkadot"
+            export DOCKERFILE="docker/dockerfiles/polkadot/polkadot_injected.Dockerfile"
+            export BINARY="polkadot,polkadot-execute-worker,polkadot-prepare-worker"
+            ./docker/scripts/build-injected.sh
+          else
+            echo "Building release container for polkadot"
+            export DOCKERFILE="docker/dockerfiles/polkadot/polkadot_injected_debian.Dockerfile"
+            export BINARY="polkadot,polkadot-execute-worker,polkadot-prepare-worker"
+            export POLKADOT_DEB=true
+            export VERSION="$VALIDATED_VERSION"
+           ./docker/scripts/build-injected.sh
+          fi
 
       - name: Build Injected Container image for polkadot-omni-node/chain-spec-builder
         if: ${{ env.BINARY == 'polkadot-omni-node' || env.BINARY == 'chain-spec-builder' }}