[stable2506] Backport #10379 (#10545)

paritytech-release-backport-bot[bot] · EgorPopelyaev · web-flow · commit 5021c6e96b08 · 2025-12-05T07:14:32.000+01:00
Backport #10379 into `stable2506` from EgorPopelyaev. See the [documentation](https://github.com/paritytech/polkadot-sdk/blob/master/docs/BACKPORT.md) on how to use this bot.  --------- Co-authored-by: Egor_P <egor@parity.io>
diff --git a/.github/workflows/release-22_combined-rc-runtime-builds-release-draft.yml b/.github/workflows/release-22_combined-rc-runtime-builds-release-draft.yml
@@ -0,0 +1,127 @@
+name: Release - Combined Builds Flow
+
+on:
+  workflow_dispatch:
+    inputs:
+      chain:
+        description: The chain to use for runtime builds
+        default: all
+        required: true
+        type: choice
+        options:
+          - all
+          - westend
+          - asset-hub-westend
+          - bridge-hub-westend
+          - collectives-westend
+          - coretime-westend
+          - glutton-westend
+          - people-westend
+      runtime_dir:
+        description: The runtime dir to be used (⚠️ this parameter is optional and needed only in case of the single runtime build, set it accordingly to the runtime you want to build)
+        default: polkadot/runtime/westend
+        type: choice
+        options:
+          - polkadot/runtime/westend
+          - cumulus/parachains/runtimes/assets/asset-hub-westend
+          - cumulus/parachains/runtimes/bridge-hubs/bridge-hub-westend
+          - cumulus/parachains/runtimes/collectives/collectives-westend
+          - cumulus/parachains/runtimes/coretime/coretime-westend
+          - cumulus/parachains/runtimes/people/people-westend
+          - cumulus/parachains/runtimes/glutton/glutton-westend
+      binary:
+        description: Binary to be built for the release candidate
+        default: all
+        type: choice
+        options:
+          - polkadot
+          - polkadot-parachain
+          - polkadot-omni-node
+          - frame-omni-bencher
+          - chain-spec-builder
+          - substrate-node
+          - eth-rpc
+          - subkey
+          - all
+      release_tag:
+        description: Tag matching the actual release candidate with the format polkadot-stableYYMM(-X)-rcY or polkadot-stableYYMM(-X)
+        type: string
+        required: true
+      no_runtimes:
+        description: If true, no runtime build will be triggered and release draft will be published without runtimes (⚠️ use it for the patch releases of the latest stable)
+        required: true
+        type: boolean
+        default: false
+
+jobs:
+  check-synchronization:
+    uses: paritytech-release/sync-workflows/.github/workflows/check-synchronization.yml@main
+    secrets:
+      fork_writer_app_key: ${{ secrets.UPSTREAM_CONTENT_SYNC_APP_KEY }}
+
+  validate-inputs:
+    needs: [check-synchronization]
+    if: ${{ needs.check-synchronization.outputs.checks_passed }} == 'true'
+    runs-on: ubuntu-latest
+    outputs:
+      release_tag: ${{ steps.validate_inputs.outputs.release_tag }}
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Validate inputs
+        id: validate_inputs
+        run: |
+          . ./.github/scripts/common/lib.sh
+
+          RELEASE_TAG=$(validate_stable_tag ${{ inputs.release_tag }})
+          echo "release_tag=${RELEASE_TAG}" >> $GITHUB_OUTPUT
+
+  build-runtimes-flow:
+    if: ${{ inputs.no_runtimes == false }}
+    needs: [validate-inputs]
+    uses: "./.github/workflows/release-21_build-runtimes.yml"
+    with:
+      chain: ${{ inputs.chain }}
+      runtime_dir: ${{ inputs.runtime_dir }}
+      release_tag: ${{ needs.validate-inputs.outputs.release_tag }}
+    secrets: inherit
+    permissions:
+      id-token: write
+      attestations: write
+      contents: read
+
+  build-rc-flow:
+    needs: [validate-inputs]
+    uses: "./.github/workflows/release-20_build-rc.yml"
+    with:
+      binary: ${{ inputs.binary }}
+      release_tag: ${{ needs.validate-inputs.outputs.release_tag }}
+    secrets: inherit
+    permissions:
+      id-token: write
+      attestations: write
+      contents: read
+
+  trigger-release-draft-with-runtimes:
+    if: ${{ inputs.no_runtimes == false }}
+    needs: [build-runtimes-flow, build-rc-flow, validate-inputs]
+    uses: "./.github/workflows/release-30_publish_release_draft.yml"
+    with:
+      release_tag: ${{ needs.validate-inputs.outputs.release_tag }}
+      build_run_id: ${{ github.run_id }}
+      runtimes: '${{ needs.build-runtimes-flow.outputs.published_runtimes }}'
+      no_runtimes: ${{ inputs.no_runtimes }}
+      crates_only: false
+    secrets: inherit
+
+  trigger-release-draft-without-runtimes:
+    if: ${{ inputs.no_runtimes == true }}
+    needs: [build-rc-flow, validate-inputs]
+    uses: "./.github/workflows/release-30_publish_release_draft.yml"
+    with:
+      release_tag: ${{ needs.validate-inputs.outputs.release_tag }}
+      build_run_id: ${{ github.run_id }}
+      no_runtimes: ${{ inputs.no_runtimes }}
+      crates_only: false
+    secrets: inherit
diff --git a/.github/workflows/release-30_publish_release_draft.yml b/.github/workflows/release-30_publish_release_draft.yml
@@ -15,6 +15,45 @@ on:
         description: Tag matching the actual release candidate with the format polkadot-stableYYMM(-X)-rcX or polkadot-stableYYMM(-X)
         required: true
         type: string
+      build_run_id:
+        description: Run ID of the current release workflow run to be used to download the artifacts
+        required: true
+        type: string
+      runtimes:
+        description: Runtimes to be published (⚠️ this needs to be provided in case of the complete release, for the crates only release or a patch release without runtimes it is not needed)
+      no_runtimes:
+        description: If true, release draft will be published without runtimes
+        required: true
+        type: boolean
+        default: false
+      crates_only:
+        description: If true, release draft will contain only release notes and no artifacts will be published (needed for stable releases that are crates only)
+        required: true
+        type: boolean
+        default: false
+  workflow_call:
+    inputs:
+      release_tag:
+        description: Tag matching the actual release candidate with the format polkadot-stableYYMM(-X)-rcY or polkadot-stableYYMM(-X)
+        required: true
+        type: string
+      build_run_id:
+        description: Run ID of the current release workflow run to be used to download the artifacts
+        required: true
+        type: string
+      runtimes:
+        description: Runtimes to be published
+        type: string
+      no_runtimes:
+        description: If true, release draft will be published without runtimes
+        required: true
+        type: boolean
+        default: false
+      crates_only:
+        description: If true, release draft will contain only release notes and no artifacts will be published (needed for stable releases that are crates only)
+        required: true
+        type: boolean
+        default: false
 
 jobs:
   check-synchronization:
@@ -63,10 +102,25 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
-      - name: Download artifacts
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+      - name: Generate content write token for the release automation
+        id: generate_write_token
+        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+        with:
+            app-id: ${{ vars.POLKADOT_SDK_RELEASE_RW_APP_ID }}
+            private-key: ${{ secrets.POLKADOT_SDK_RELEASE_RW_APP_KEY }}
+            owner: paritytech
+            repositories: polkadot-sdk
+
+      - name: Download runtimes artifacts
+        if: ${{ inputs.no_runtimes == false && inputs.crates_only == false }}
+        env:
+          GITHUB_TOKEN: ${{ steps.generate_write_token.outputs.token }}
+        run: |
+          mkdir -p ${{ github.workspace}}/runtimes/
+          gh run download ${{ inputs.build_run_id }} --dir ${{ github.workspace}}/runtimes
+          ls -la ${{ github.workspace}}/runtimes
 
       - name: Prepare tooling
         run: |
@@ -86,6 +140,8 @@ jobs:
           PEOPLE_WESTEND_DIGEST: ${{ github.workspace}}/people-westend-runtime/people-westend-srtool-digest.json
           WESTEND_DIGEST: ${{ github.workspace}}/westend-runtime/westend-srtool-digest.json
           RELEASE_TAG: ${{ needs.validate-inputs.outputs.release_tag }}
+          NO_RUNTIMES: ${{ inputs.no_runtimes }}
+          CRATES_ONLY: ${{ inputs.crates_only }}
         shell: bash
         run: |
           . ./.github/scripts/common/lib.sh
@@ -140,7 +196,8 @@ jobs:
             --notes-file ${{ github.workspace}}/scripts/release/RELEASE_DRAFT.md
 
   publish-runtimes:
-    needs: [ validate-inputs, build-runtimes, publish-release-draft ]
+    if: ${{ inputs.crates_only == false && inputs.no_runtimes == false }}
+    needs: [ validate-inputs, publish-release-draft ]
     environment: release
     continue-on-error: true
     runs-on: ubuntu-latest
@@ -181,6 +238,7 @@ jobs:
             --repo paritytech/polkadot-sdk "$VERSIONED_ASSET"
 
   publish-release-artifacts:
+    if: ${{ inputs.crates_only == false }}
     needs: [ validate-inputs, publish-release-draft ]
     environment: release
     continue-on-error: true
diff --git a/scripts/release/build-changelogs.sh b/scripts/release/build-changelogs.sh
@@ -6,6 +6,8 @@ export ENGINE=${ENGINE:-podman}
 export REF1=${REF1:-'HEAD'}
 export REF2=${REF2}
 export RUSTC_STABLE=${RUSTC_STABLE:-'1.0'}
+export NO_RUNTIMES=${NO_RUNTIMES:-'false'}
+export CRATES_ONLY=${CRATES_ONLY:-'false'}
 
 PROJECT_ROOT=`git rev-parse --show-toplevel`
 echo $PROJECT_ROOT
@@ -66,32 +68,36 @@ echo "Changelog ready in $OUTPUT/relnote_commits.md"
 # Show the files
 tree -s -h -c $OUTPUT/
 
-ASSET_HUB_WESTEND_DIGEST=${ASSET_HUB_WESTEND_DIGEST:-"$PROJECT_ROOT/scripts/release/digests/asset-hub-westend-srtool-digest.json"}
-BRIDGE_HUB_WESTEND_DIGEST=${BRIDGE_HUB_WESTEND_DIGEST:-"$PROJECT_ROOT/scripts/release/digests/bridge-hub-westend-srtool-digest.json"}
-COLLECTIVES_WESTEND_DIGEST=${COLLECTIVES_WESTEND_DIGEST:-"$PROJECT_ROOT/scripts/release/digests/collectives-westend-srtool-digest.json"}
-CORETIME_WESTEND_DIGEST=${CORETIME_WESTEND_DIGEST:-"$PROJECT_ROOT/scripts/release/digests/coretime-westend-srtool-digest.json"}
-GLUTTON_WESTEND_DIGEST=${GLUTTON_WESTEND_DIGEST:-"$PROJECT_ROOT/scripts/release/digests/glutton-westend-srtool-digest.json"}
-PEOPLE_WESTEND_DIGEST=${PEOPLE_WESTEND_DIGEST:-"$PROJECT_ROOT/scripts/release/digests/people-westend-srtool-digest.json"}
-WESTEND_DIGEST=${WESTEND_DIGEST:-"$PROJECT_ROOT/scripts/release/digests/westend-srtool-digest.json"}
-
-jq \
-      --slurpfile srtool_asset_hub_westend $ASSET_HUB_WESTEND_DIGEST \
-      --slurpfile srtool_bridge_hub_westend $BRIDGE_HUB_WESTEND_DIGEST \
-      --slurpfile srtool_collectives_westend $COLLECTIVES_WESTEND_DIGEST \
-      --slurpfile srtool_coretime_westend $CORETIME_WESTEND_DIGEST \
-      --slurpfile srtool_glutton_westend $GLUTTON_WESTEND_DIGEST \
-      --slurpfile srtool_people_westend $PEOPLE_WESTEND_DIGEST \
-      --slurpfile srtool_westend $WESTEND_DIGEST \
-      -n '{
-          srtool: [
-            { order: 10, name: "Westend", data: $srtool_westend[0] },
-            { order: 11, name: "Westend AssetHub", data: $srtool_asset_hub_westend[0] },
-            { order: 12, name: "Westend BridgeHub", data: $srtool_bridge_hub_westend[0] },
-            { order: 13, name: "Westend Collectives", data: $srtool_collectives_westend[0] },
-            { order: 14, name: "Westend Coretime", data: $srtool_coretime_westend[0] },
-            { order: 15, name: "Westend Glutton", data: $srtool_glutton_westend[0] },
-            { order: 16, name: "Westend People", data: $srtool_people_westend[0] }
-      ] }' > "$PROJECT_ROOT/scripts/release/context.json"
+if [[ "$NO_RUNTIMES" == "false" && "$CRATES_ONLY" == "false" ]]; then
+  ASSET_HUB_WESTEND_DIGEST=${ASSET_HUB_WESTEND_DIGEST:-"$PROJECT_ROOT/scripts/release/digests/asset-hub-westend-srtool-digest.json"}
+  BRIDGE_HUB_WESTEND_DIGEST=${BRIDGE_HUB_WESTEND_DIGEST:-"$PROJECT_ROOT/scripts/release/digests/bridge-hub-westend-srtool-digest.json"}
+  COLLECTIVES_WESTEND_DIGEST=${COLLECTIVES_WESTEND_DIGEST:-"$PROJECT_ROOT/scripts/release/digests/collectives-westend-srtool-digest.json"}
+  CORETIME_WESTEND_DIGEST=${CORETIME_WESTEND_DIGEST:-"$PROJECT_ROOT/scripts/release/digests/coretime-westend-srtool-digest.json"}
+  GLUTTON_WESTEND_DIGEST=${GLUTTON_WESTEND_DIGEST:-"$PROJECT_ROOT/scripts/release/digests/glutton-westend-srtool-digest.json"}
+  PEOPLE_WESTEND_DIGEST=${PEOPLE_WESTEND_DIGEST:-"$PROJECT_ROOT/scripts/release/digests/people-westend-srtool-digest.json"}
+  WESTEND_DIGEST=${WESTEND_DIGEST:-"$PROJECT_ROOT/scripts/release/digests/westend-srtool-digest.json"}
+
+  jq \
+        --slurpfile srtool_asset_hub_westend $ASSET_HUB_WESTEND_DIGEST \
+        --slurpfile srtool_bridge_hub_westend $BRIDGE_HUB_WESTEND_DIGEST \
+        --slurpfile srtool_collectives_westend $COLLECTIVES_WESTEND_DIGEST \
+        --slurpfile srtool_coretime_westend $CORETIME_WESTEND_DIGEST \
+        --slurpfile srtool_glutton_westend $GLUTTON_WESTEND_DIGEST \
+        --slurpfile srtool_people_westend $PEOPLE_WESTEND_DIGEST \
+        --slurpfile srtool_westend $WESTEND_DIGEST \
+        -n '{
+            srtool: [
+              { order: 10, name: "Westend", data: $srtool_westend[0] },
+              { order: 11, name: "Westend AssetHub", data: $srtool_asset_hub_westend[0] },
+              { order: 12, name: "Westend BridgeHub", data: $srtool_bridge_hub_westend[0] },
+              { order: 13, name: "Westend Collectives", data: $srtool_collectives_westend[0] },
+              { order: 14, name: "Westend Coretime", data: $srtool_coretime_westend[0] },
+              { order: 15, name: "Westend Glutton", data: $srtool_glutton_westend[0] },
+              { order: 16, name: "Westend People", data: $srtool_people_westend[0] }
+        ] }' > "$PROJECT_ROOT/scripts/release/context.json"
+else
+  echo '{}' > "$PROJECT_ROOT/scripts/release/context.json"
+fi
 
 RELEASE_DIR="$PROJECT_ROOT/scripts/release/"
 pushd $RELEASE_DIR >/dev/null
diff --git a/scripts/release/templates/docker_image.md.tera b/scripts/release/templates/docker_image.md.tera
@@ -9,11 +9,11 @@ The docker images for the `polkadot` node binary and the `polkadot-parachain` bi
 You may also pull it with:
 
 ```
-docker pull parity/polkadot:latest
+docker pull parity/polkadot:{{ env.VERSION }}
 ```
 
 or
 
 ```
-docker pull parity/polkadot-parachain:latest
+docker pull parity/polkadot-parachain:{{ env.VERSION }}
 ```
diff --git a/scripts/release/templates/template.md.tera b/scripts/release/templates/template.md.tera
@@ -15,6 +15,10 @@ This release contains the changes from `{{ env.REF1 | replace(from="refs/tags/",
 
 {% include "compiler.md.tera" -%}
 
+{% if env.NO_RUNTIMES == "false" and env.CRATES_ONLY == "false" -%}
 {% include "runtimes.md.tera" -%}
+{% endif -%}
 
+{% if env.CRATES_ONLY == "false" -%}
 {% include "docker_image.md.tera" -%}
+{% endif -%}
