ci: Update release workflow

.github/ISSUE_TEMPLATE/tag_release.md

@@ -0,0 +1,27 @@
+---
+title: "chore: Update to upstream release `{{ env.RELEASE_TAG }}`"
+labels: automated-issue
+---
+
+A new Aptos PFN release `{{ env.RELEASE_TAG }}` is available at {{ env.UPSTREAM_URL }}.
+
+A new branch associated with these changes was pushed locally at `upstream/{{ env.RELEASE_TAG }}`.
+
+Steps to release an upgraded patched version:
+- Rebase `dev` onto the changes from `upstream/{{ env.RELEASE_TAG }}` as follows:
+```
+git remote add upstream https://github.com/aptos-labs/aptos-core.git
+git reset --hard refs/tags/{{ env.RELEASE_TAG }}
+# TODO: Merge into one commit for simplicity
+git cherry-pick 7c9a8bcd79376cf1479a3432b48127a56945cabb
+git cherry-pick d14dc0c286e704883ca453a40ab4531702c86f71
+git cherry-pick 15f91a32989ea63224064862167136b17baf1128
+git cherry-pick <CI-commits>
+git push origin dev -f
+```
+- Then, run the [release workflow]({{ env.RELEASE_PR_WORKFLOW }}) and set the version input to `{{ env.RELEASE_TAG }}`. This will bump the version number in `PATCH_RELEASE.md` (since there is no Cargo version for the Aptos node) and open a PR from `release/{{ env.RELEASE_TAG }}-patched` to `dev`. The PR will run CI checks and provide an artifact for downstream companion PRs to test on.
+- When the PR is merged, it will automatically publish a GitHub release for `{{ env.RELEASE_TAG }}-patched` using the [merge workflow]({{ env.RELEASE_MERGE_WORKFLOW }}).
+
+This issue was created by the workflow at {{ env.WORKFLOW_URL }}
+
+TODO: Move these instructions to separate patch-notes.md file and link to it here

.github/workflows/aptos-light-client-patch-release-pr.yml

@@ -0,0 +1,86 @@
+name: Aptos LC - Create Patched Release PR
+
+on:
+  workflow_dispatch:
+    inputs:
+      type:
+        description: 'release or hotfix'
+        type: choice
+        options:
+          - release
+          - hotfix
+        required: true
+      # Tag version to patch, e.g. `aptos-node-v1.13.3`
+      version:
+        description: 'Release tag patched'
+        required: true
+
+jobs:
+  release-pr:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Git config
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+
+          git config --global url."https://${{ secrets.REPO_TOKEN }}@github.com/".insteadOf ssh://[email protected]
+          git config --global url."https://${{ secrets.REPO_TOKEN }}@github.com".insteadOf https://github.com
+
+      - uses: actions/checkout@v4
+
+      - name: Set base branch
+        run: |
+          if [[ "${{ inputs.type == 'hotfix' }}" == "true" ]]; then
+            BASE_BRANCH="release/${{ inputs.version }}-patched"
+          else
+            BASE_BRANCH="main"
+          fi
+          echo "BASE_BRANCH=$BASE_BRANCH" | tee -a $GITHUB_ENV
+          echo "PR_BRANCH=${{ inputs.type }}/${{ inputs.version }}-patched" | tee -a $GITHUB_ENV
+          echo "PR_DESCRIPTION=chore: Release ${{ inputs.version }}-patched" | tee -a $GITHUB_ENV
+
+      # TODO: Need some change for the PR to be possible, so recording the version change in `PATCH_RELEASE.md` since we're not using `Cargo.toml`
+      - name: Edit tag version in PATCH_RELEASE.md
+        run: |
+          git fetch origin
+          # NOTE: Release branch must not exist already. If it does, use the `hotfix` input type to change it as any `release/*` branch is load-bearing
+          if [[ "${{ inputs.type }}" == "release" ]]; then
+            git checkout -b ${{ env.PR_BRANCH }}
+          else
+            git checkout ${{ env.PR_BRANCH }}
+          fi
+
+          if [[ ! -s "PATCH_RELEASE.md" ]]; then
+            counter=1
+          else
+            counter=$(awk '{print $NF}' "$PATCH_RELEASE.md")
+            if [[ "$counter" =~ ^[0-9]+$ ]]; then
+              # Increment the variable
+              ((counter++))
+            else
+              counter=1
+            fi
+          fi
+          echo "Version ${{ inputs.version }} - release $counter" | tee PATCH_RELEASE.md
+          git add .
+          git commit -m "${{ env.PR_DESCRIPTION }}"
+          git push origin $PR_BRANCH
+
+      # Note: Can't use `peter-evans/create-pull-request` because for hotfixes we need to make the PR with an existing branch
+      # The above action always creates a new one for single-commit PRs, thus overwriting the actual hotfix
+      - name: Create PR
+        run: |
+          cat << 'EOF' > body.md
+          This is an automated release PR for the patched version of `${{ inputs.version }}`.
+
+          Upstream changelog: https://github.com/aptos-labs/aptos-core/releases/tag/${{ inputs.version }}
+
+          On merge, this will trigger the [release publish workflow](${{ github.server_url }}/${{ github.repository }}/actions/workflows/aptos-light-client-patch-release-publish.yml), which will upload a new GitHub release with tag `{{ inputs.version }}-patched`.
+
+          [Workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
+          EOF
+
+          gh pr create --title "${{ env.PR_DESCRIPTION }}" --body-file ./body.md --head ${{ env.PR_BRANCH }} --base ${{ env. BASE_BRANCH }}
+        env:
+          GH_TOKEN: ${{ github.token }}

.github/workflows/aptos-light-client-patch-release-publish.yml

@@ -0,0 +1,48 @@
+name: Aptos LC - Publish Patched Release
+
+on:
+  pull_request:
+    types: [ closed ]
+    branches:
+      - release/*
+      - dev
+
+jobs:
+  release-pr:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.merged == true
+    steps:
+      - name: Set up SSH
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+
+          git config --global url."https://${{ secrets.REPO_TOKEN }}@github.com/".insteadOf ssh://[email protected]
+          git config --global url."https://${{ secrets.REPO_TOKEN }}@github.com".insteadOf https://github.com
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Get version
+        id: get-version
+        run: |
+          VERSION=$(echo "${{ github.event.pull_request.head.ref }}" | cut -d'/' -f 2)
+          git tag -a $VERSION -m "$VERSION" ${{ github.event.pull_request.head.ref }}
+          git push origin $VERSION -f
+          echo "version=$VERSION" | tee -a "$GITHUB_OUTPUT"
+
+      - name: Build Changelog
+        id: github_release
+        uses: mikepenz/release-changelog-builder-action@v4
+        with:
+          toTag: ${{ steps.get-version.outputs.version }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create Release
+        uses: ncipollo/release-action@v1
+        with:
+          body: ${{ steps.github_release.outputs.changelog }}
+          tag: ${{ steps.get-version.outputs.version }}
+          commit: ${{ github.event.pull_request.head.ref }}
+          allowUpdates: true

.github/workflows/aptos-light-client-tag-comparison.yml

@@ -7,36 +7,36 @@ on:
 jobs:
   check-tags:
     runs-on: ubuntu-latest
-
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
-        with:
-          fetch-depth: 0 # Fetch all history so we can perform a rebase
-          ref: "dev"
-
-      - name: Check branch name
-        run: |
-          if [[ "${GITHUB_REF#refs/heads/}" != "dev" ]]; then
-            echo "Workflow run cancelled because it's not on 'dev' branch."
-            exit 1
-          fi
 
       - name: Fetch latest tag
         id: latest-tag
         run: |
           LATEST_TAG=$(curl --silent "https://api.github.com/repos/aptos-labs/aptos-core/releases" | jq -r '.[] | select(.name | ascii_downcase | contains("mainnet")) | .tag_name' | grep '^aptos-node-v' | sort -V | tail -n 1)
-          CURRENT_TAG=$(git describe --tags `git rev-list --tags --max-count=1`)
-          if [[ $(echo -e "$CURRENT_TAG\n$LATEST_TAG" | sort -V | tail -n 1) != $CURRENT_TAG ]]; then
-            echo "name=tag::${LATEST_TAG}" | tee -a $GITHUB_OUTPUT
-          else
+          CURRENT_TAG=$(curl --silent "https://api.github.com/repos/samuelburnham/aptos-core/releases" | jq -r '.[] | .tag_name' | grep '^aptos-node-v' | sort -V | tail -n 1)
+          LATEST_VERSION=$(echo $LATEST_TAG | awk -F'-' '{ print $3 }')
+          CURRENT_VERSION=$(echo $CURRENT_TAG | awk -F'-' '{ print $3 }')
+          # Check if there are any tags
+          if [[ $(echo -e "$CURRENT_VERSION\n$LATEST_VERSION" | sort -V | tail -n 1) == $CURRENT_TAG ]]; then
             echo "The current tag is up to date."
             exit 0
           fi
+          # If the current tag is not up to date, proceed to open an issue
+          echo "Current tag $CURRENT_TAG is out of date with upstream tag $LATEST_TAG, opening an issue"
+          echo "tag=${LATEST_TAG}" | tee -a $GITHUB_OUTPUT
 
-      - name: Create Issue
+      - name: Create issue for release
         uses: JasonEtco/create-an-issue@v2
+        with:
+          filename: .github/ISSUE_TEMPLATE/tag_release.md
+          update_existing: true
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          BRANCH: "dev"
-          TAG: ${{ steps.latest-tag.outputs.tag }}
+          GITHUB_TOKEN: ${{ secrets.REPO_TOKEN }}
+          RELEASE_TAG: ${{ steps.latest-tag.outputs.tag }}
+          UPSTREAM_URL: https://github.com/aptos-labs/aptos-core/releases/tag/${{ steps.latest-tag.outputs.tag }}
+          RELEASE_PR_WORKFLOW: ${{ github.server_url }}/${{ github.repository }}/actions/workflows/aptos-light-client-patch-release-pr.yml
+          RELEASE_MERGE_WORKFLOW: ${{ github.server_url }}/${{ github.repository }}/actions/workflows/aptos-light-client-patch-release-publish.yml
+          WORKFLOW_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+