A release tag was created before the release built, so a failed build left a
tag on GitHub with nothing behind it. release-20260824.0 is an example: the
build failed, but users still see a release that they cannot install.
Before
```
make tag RELEASE_COMMIT=<sha> RELEASE_NAME=20260831.0 RELEASE_NOTES=<file>
│
tag_release.sh └─ pushes the annotated tag as release-20260831.0 ← published immediately
│
┌────────────┴────────────┐
│ │
Buildkite GitHub Actions
(triggered by the tag) release_mirror.yml
├─ make artifacts ├─ poll GCS for artifacts (240 min timeout)
├─ make release ├─ verify sha512
└─ gcloud storage cp └─ create the GitHub Release
→ gs://gvisor/releases/
```
After
```
make tag RELEASE_COMMIT=<sha> RELEASE_NAME=20260831.0 RELEASE_NOTES=<file>
│
tag_release.sh └─ pushes the annotated tag as staging-release-20260831.0
│
Buildkite ├─ tag.sh stage restore release-20260831.0 locally (version stamping)
(triggered by ├─ make artifacts x86_64 + aarch64
the staging tag) ├─ make release sign, lay out repo/
├─ gcloud storage cp → gs://gvisor/releases/
└─ tag.sh publish push release-20260831.0, delete staging tag
│
GitHub Actions └─ release_mirror.yml verify sha512, create the GitHub Release
```
This is 25% smaller and extracts ~32x faster than the bz2 version.
gVisor extraction appears to be a bottleneck for some node setup workflows.
This helps with that.
STABLE_VERSION depends on the most recent tag, so let's set the same tag
for all tests changes to better utilize the bazel cache.
With this change, the syscall tests will not be re-executed if no code changes
are introduced.
PiperOrigin-RevId: 607398034
This change fixes the apt repository structure to avoid emiting warnings on
Ubuntu 18.04 (and potentially other versions). This requires a slight refactor
of the repository generation scripts, since we can no longer copy the same
release files for different "suites".
This should avoid the warning by setting the suite to the distribution:
https://github.com/Debian/apt/blob/master/apt-pkg/metaindex.cc#L75
This change also moves over to the standardized Makefile entrypoint, which
makes settings clearer and enables local testing.
PiperOrigin-RevId: 313817017
Jing Chen