From 675803446dd18e9f2353bbcaf50191f0fdba3c01 Mon Sep 17 00:00:00 2001
From: CMGS <ilskdw@gmail.com>
Date: Thu, 23 Jul 2026 12:57:17 +0800
Subject: [PATCH 1/2] ci: Bump pinned actions and build the dev release for
 aarch64

The pinned action versions had drifted; each now points at the
major that is current today. Publishing moves to a job that waits
on both builds, since two matrix jobs writing one rolling release
race each other, and the artifact round-trip drops the executable
bit the release job needs.

Signed-off-by: CMGS <ilskdw@gmail.com>
---
 .github/workflows/dev-release.yaml | 75 ++++++++++++++++++++----------
 1 file changed, 50 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/dev-release.yaml b/.github/workflows/dev-release.yaml
index 0cfea5c76b..2ff34d2144 100644
--- a/.github/workflows/dev-release.yaml
+++ b/.github/workflows/dev-release.yaml
@@ -13,11 +13,17 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-22.04
+            arch: x86_64
+          - runner: ubuntu-22.04-arm
+            arch: aarch64
+    runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
+      - uses: actions/checkout@v7
 
       - name: Install pinned Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -30,36 +36,58 @@ jobs:
           cargo --version --verbose
 
       - name: Build cloud-hypervisor (release)
+        run: cargo build --release
+
+      - name: Stage artifacts
         run: |
-          cargo build --release
+          set -euo pipefail
+          mkdir -p dist
+          cp -v target/release/cloud-hypervisor "dist/cloud-hypervisor-${{ matrix.arch }}"
+          "./dist/cloud-hypervisor-${{ matrix.arch }}" --version
+          rustc --version --verbose | tr '\n' ';' > "dist/rustc-${{ matrix.arch }}.txt"
 
-      - name: Generate checksum and build metadata
+      - uses: actions/upload-artifact@v7
+        with:
+          name: dist-${{ matrix.arch }}
+          path: dist/
+
+  release:
+    needs: build
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: dist-*
+          merge-multiple: true
+          path: dist
+
+      - name: Add provenance and checksums
         run: |
-          artifact=target/release/cloud-hypervisor
-          sha256sum "$artifact" > "${artifact}.sha256"
-          cat > target/release/build-info.json <<EOF
+          set -euo pipefail
+          chmod +x dist/*-x86_64 dist/*-aarch64
+          version=$(./dist/cloud-hypervisor-x86_64 --version | head -1 | awk '{print $2}')
+          cat > dist/build-info.json <<EOF
           {
+            "version": "${version}",
             "ref": "${GITHUB_REF_NAME}",
             "commit": "${GITHUB_SHA}",
             "run_id": "${GITHUB_RUN_ID}",
             "run_attempt": "${GITHUB_RUN_ATTEMPT}",
             "workflow": "${GITHUB_WORKFLOW}",
-            "rustc": "$(rustc --version --verbose | tr '\n' '; ' | sed 's/; $//')",
-            "cargo": "$(cargo --version --verbose | tr '\n' '; ' | sed 's/; $//')"
+            "rustc_x86_64": "$(cat dist/rustc-x86_64.txt)",
+            "rustc_aarch64": "$(cat dist/rustc-aarch64.txt)"
           }
           EOF
-
-      - name: Upload binary as artifact
-        uses: actions/upload-artifact@v7
-        with:
-          name: cloud-hypervisor
-          path: |
-            target/release/cloud-hypervisor
-            target/release/cloud-hypervisor.sha256
-            target/release/build-info.json
+          rm -f dist/rustc-*.txt
+          (cd dist && find . -type f -not -name SHA256SUMS | sort | xargs sha256sum > SHA256SUMS)
+          cat dist/SHA256SUMS
 
       - name: Create dev release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: dev
           target_commitish: ${{ github.sha }}
@@ -68,10 +96,7 @@ jobs:
             Branch: `${{ github.ref_name }}`
             Commit: `${{ github.sha }}`
             Workflow Run: `${{ github.run_id }}`
-          files: |
-            target/release/cloud-hypervisor
-            target/release/cloud-hypervisor.sha256
-            target/release/build-info.json
+          files: dist/*
           prerelease: true
           make_latest: false
           overwrite_files: true

From 4bec918619a99d81067167908014ddf9c06a7741 Mon Sep 17 00:00:00 2001
From: CMGS <ilskdw@gmail.com>
Date: Thu, 23 Jul 2026 13:04:04 +0800
Subject: [PATCH 2/2] ci: Build the dev release with stable rather than the
 MSRV

Cargo.toml's rust-version is a floor, not the version to build with;
upstream CI builds with stable. build-info.json already records the
exact rustc, so following stable keeps provenance intact.

Signed-off-by: CMGS <ilskdw@gmail.com>
---
 .github/workflows/dev-release.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/dev-release.yaml b/.github/workflows/dev-release.yaml
index 2ff34d2144..ec7eddfc5e 100644
--- a/.github/workflows/dev-release.yaml
+++ b/.github/workflows/dev-release.yaml
@@ -25,10 +25,10 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - name: Install pinned Rust toolchain
+      - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
-          toolchain: "1.89.0"
+          toolchain: stable
 
       - name: Show toolchain
         run: |