Refactor linux workflow and tune bazel caching

.github/RELEASE_TEMPLATE.md

@@ -0,0 +1,49 @@
+Module Name: baselibs
+Release Tag: $RELEASE_TAG
+Origin Release Tag: $PREVIOUS_RELEASE_TAG
+Release Commit Hash: $COMMIT_SHA
+Release Date: $RELEASE_DATE
+
+Overview
+--------
+The baselibs module provides a selection of basic C++ utility libraries for common use in the S-CORE project.
+
+
+Disclaimer
+----------
+This release is not intended for production use, as it does not include a safety argumentation or a completed safety assessment.
+The work products compiled in the safety package are created with care according to the [S-CORE process](https://eclipse-score.github.io/process_description/main/index.html). However, as a non-profit, open-source organization, the project cannot assume any liability for its content.
+
+For details on the features, see https://eclipse-score.github.io/score/main/features/baselibs/index.html
+
+Improvements
+------------
+
+
+Bug Fixes
+---------
+
+
+Compatibility
+-------------
+- `x86_64-unknown-linux-gnu`, `x86_64-unknown-nto-qnx800` and  `aarch64-unknown-nto-qnx800` using [score_toolchains_gcc](https://github.com/eclipse-score/bazel_cpp_toolchains).
+
+Performed Verification
+----------------------
+- Build for  `x86_64-unknown-linux-gnu` and `x86_64-unknown-nto-qnx800`.
+- Unit tests executed on `x86_64-unknown-linux-gnu`.
+
+Report: $ACTION_RUN_URL
+
+Known Issues
+------------
+
+
+
+Upgrade Instructions
+--------------------
+Backward compatibility with the previous release is not guaranteed.
+
+Contact Information
+-------------------
+For any questions or support, please contact the Base Libs Feature Team (https://github.com/orgs/eclipse-score/discussions/1223) or raise an issue/discussion.

.github/workflows/build_and_test_host_gcc12.yml → .github/workflows/build_linux.yml

@@ -10,9 +10,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
-# Workflow configuration for S-CORE CI - Bazel Build & Test baselibs
-# This workflow runs Bazel build and test when triggered by specific pull request events.
-name: Bazel Build & Test baselibs (with host toolchain GCC12.2)
+name: Bazel Build (Linux)
 on:
   pull_request:
     types: [opened, reopened, synchronize]
@@ -21,18 +19,24 @@ on:
       - main
   merge_group:
     types: [checks_requested]
+  workflow_call:
 jobs:
-  build_and_test_gcc_host_gcc12:
+  linux-build-and-test:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4.2.2
+      - name: Checkout Repository
+        uses: actions/checkout@v6
       - name: Setup Bazel
-        uses: bazel-contrib/[email protected]
-      - name: Bazel build baselibs targets
+        uses: bazel-contrib/[email protected]
+        with:
+          bazelisk-cache: true
+          disk-cache: ${{ github.job }}
+          repository-cache: true
+          cache-save: ${{ github.event_name == 'push' }}
+      - name: Bazel Build
         run: |
           bazel build --config bl-x86_64-linux -- //score/...
-      - name: Bazel test baselibs targets
+      - name: Bazel Test
         run: |
           bazel test --config bl-x86_64-linux -- //score/... \
           -//score/language/safecpp/aborts_upon_exception:abortsuponexception_toolchain_test \

.github/workflows/build_qnx.yml

@@ -12,27 +12,29 @@
 # *******************************************************************************
 name: Bazel Build (QNX)
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, reopened, synchronize]
   push:
     branches:
       - main
   merge_group:
     types: [checks_requested]
+  workflow_call:
 jobs:
   qnx-build:
     strategy:
       fail-fast: false
       matrix:
         bazel-config: [bl-x86_64-qnx, bl-aarch64-qnx]
-    uses: eclipse-score/cicd-workflows/.github/workflows/qnx-build.yml@main
+    uses: eclipse-score/cicd-workflows/.github/workflows/qnx-build.yml@fail_qnx_on_empty_secret
     permissions:
       contents: read
       pull-requests: read
     with:
       bazel-target: "//score/..."
       bazel-config: ${{ matrix.bazel-config }}
       credential-helper: ".github/tools/qnx_credential_helper.py"
+      bazel-disk-cache: ${{ matrix.bazel-config }}
     secrets:
       score-qnx-license: ${{ secrets.SCORE_QNX_LICENSE }}
       score-qnx-user: ${{ secrets.SCORE_QNX_USER }}

.github/workflows/coverage_report.yml

@@ -19,6 +19,7 @@ on:
       - main
   merge_group:
     types: [checks_requested]
+  workflow_call:
 jobs:
   coverage-report:
     runs-on: ubuntu-22.04
@@ -35,12 +36,12 @@ jobs:
         uses: bazel-contrib/[email protected]
         with:
           bazelisk-cache: true
-          disk-cache: ${{ github.workflow }}
+          disk-cache: ${{ github.job }}
           repository-cache: true
-          cache-save: ${{ github.event_name != 'pull_request' }}
+          cache-save: ${{ github.event_name == 'push' }}
       - name: Run Bazel Coverage
         run: |
-          bazel coverage --config=bl-x86_64-linux -- //score/... \
+          bazel coverage --config=bl-x86_64-linux -- //score/result/... \
           -//score/language/safecpp/aborts_upon_exception:abortsuponexception_toolchain_test
       - name: Generate HTML Coverage Report
         run: |

.github/workflows/release.yml

@@ -0,0 +1,103 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+name: Release
+run-name: Release ${{ inputs.tag }}
+on:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag (e.g., v1.0.0)'
+        required: true
+        type: string
+concurrency:
+  group: release
+jobs:
+  validate-preconditions:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v6
+      - name: Setup Bazel
+        uses: bazel-contrib/[email protected]
+        with:
+          bazelisk-cache: true
+          disk-cache: false
+          repository-cache: false
+          cache-save: false
+      - name: Validate Module Version Matches Tag
+        env:
+          EXPECTED_VERSION: ${{ inputs.tag }}
+        run: |
+          MODULE_VERSION=$(bazel mod graph --depth 1 --output json | jq -r '.version')
+          if [ "v$MODULE_VERSION" != "$EXPECTED_VERSION" ]; then
+            echo "::error::Module version ($MODULE_VERSION) does not match release tag ($EXPECTED_VERSION)"
+            exit 1
+          fi
+          echo "✓ Module version matches release tag"
+  build-linux:
+    needs: validate-preconditions
+    uses: ./.github/workflows/build_linux.yml
+  build-qnx:
+    needs: validate-preconditions
+    uses: ./.github/workflows/build_qnx.yml
+    permissions:
+      contents: read
+      pull-requests: read
+    secrets: inherit
+  coverage-report:
+    needs: validate-preconditions
+    uses: ./.github/workflows/coverage_report.yml
+  create-release:
+    needs: [validate-preconditions, build-linux, build-qnx, coverage-report]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    env:
+      COVERAGE_ARCHIVE: ${{ github.event.repository.name }}-v0.0.0-coverage
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v6
+      - name: Get Current Date and Previous Release Tag
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          PREVIOUS_TAG=$(gh release view --json tagName --jq '.tagName' 2>/dev/null || echo "N/A")
+          echo "RELEASE_DATE=$(date --rfc-3339=date)" >> $GITHUB_ENV
+          echo "PREVIOUS_RELEASE_TAG=$PREVIOUS_TAG" >> $GITHUB_ENV
+      - name: Generate Release Body
+        env:
+          RELEASE_TAG: ${{ inputs.tag }}
+          COMMIT_SHA: ${{ github.sha }}
+          ACTION_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          envsubst '$RELEASE_TAG $PREVIOUS_RELEASE_TAG $COMMIT_SHA $RELEASE_DATE $ACTION_RUN_URL' < .github/RELEASE_TEMPLATE.md > release_body.md
+      - name: Download Coverage Report Artifact
+        uses: actions/download-artifact@v7
+        with:
+          name: ${{ github.event.repository.name }}_coverage_report
+          path: ${{ env.COVERAGE_ARCHIVE }}
+      - name: Create Coverage Report Archive
+        run: |
+          tar --sort=name --owner=0 --group=0 --numeric-owner \
+            -cJf "$COVERAGE_ARCHIVE.tar.xz" --directory="$COVERAGE_ARCHIVE" .
+      - name: Create Draft Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: "v0.0.0" # ${{ inputs.tag }}
+          body_path: release_body.md
+          draft: true
+          generate_release_notes: true
+          target_commitish: ${{ github.sha }}
+          files: |
+            ${{ env.COVERAGE_ARCHIVE }}.tar.xz