[Rust-KVM]

Requested by 4c

Summary

Before: pushing a vX.Y.Z tag built the application and published a release immediately. Nothing was signed, there was no source bundle, and no way to stage a release for review or attach firmware images.

After: Actions → Release → Run workflow with a version builds the application in the public devkit image and creates a draft release. The draft carries the binary, a GPL source tarball and SHA256SUMS with a detached GPG signature. Firmware images built locally are signed and attached with scripts/release-firmware.sh. Publishing, which creates the tag, stays a manual click.

How

• .github/workflows/release.yml: workflow_dispatch (version input) or tag push; version must equal Cargo.toml. Build job runs in ghcr.io/rust-kvm/rustkvm-devkit:nightly-2026-06-14 with scripts/build-app.sh, same as local. Draft job signs SHA256SUMS with the RELEASE_SIGNING_KEY secret (warns and stays unsigned if absent) and uses docs/release-notes/vX.Y.Z.md as the body when it exists.
• scripts/gpl-source-bundle.sh: git archive of this commit plus SOURCES.md listing every pinned SDK project and commit; LEGAL_INFO=1 adds Buildroot make legal-info.
• scripts/release-firmware.sh: signs out/firmware/*.SHA256SUMS, uploads images to the draft, refuses a published release.
• Docs: docs/quickstart.md (flash and first boot for buyers), docs/release-notes/v0.1.0.md draft, docs/firmware-release.md (release assets, checklist, signing-key setup; corrects the OTA statement, OTA is still PR OTA self-update from official releases with boot rollback #29).

No private key or passphrase is in the repository; the signing key is a repository secret the maintainer sets once.

Testing

• scripts/gpl-source-bundle.sh run locally: 2.1 MB tarball, SOURCES.md lists all 14 SDK projects.

• bash -n on the new scripts; the workflow is checked by actionlint in CI. The workflow itself only runs after merge (manual dispatch).

• No Rust changes.

• cargo +nightly fmt --all

• cargo +nightly clippy --workspace --release --all-targets -- -D warnings

• cargo +nightly test --workspace

• Frontend touched: trunk build --locked and wasm32 clippy in crates/rkvm-web. Not applicable.

• Tested on an RK3588 device (describe below), or not applicable. Not applicable.

Checklist

• No #[allow(...)] suppressions and no new unwrap() / expect() in production paths
• Hot paths stay zero-copy; periodic loops use MissedTickBehavior::Delay
• Shared protocol types live in rkvm-proto
• RPC method set changed → app/tests/rpc_methods.txt updated
• Module tree or build invariants changed → AGENTS.md updated

🤖 Generated with Claude Code