CI: restructure release workflows

.github/workflows/check-release-tag.yml

@@ -0,0 +1,56 @@
+name: Check release tag
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        type: string
+        required: false
+      skip_validation:
+        type: boolean
+        default: false
+    outputs:
+      version:
+        description: "Resolved release version"
+        value: ${{ jobs.check.outputs.version }}
+
+jobs:
+  check:
+    name: Validate tag against .version file and release content
+    runs-on: ubuntu-24.04
+    outputs:
+      version: ${{ steps.resolve.outputs.version }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Validate tag matches .version file
+        id: resolve
+        run: |
+          if [[ "${{ github.ref_type }}" != "tag" ]]; then
+            echo "::notice::Not triggered by a tag push (ref_type=${{ github.ref_type }}); skipping .version check."
+            echo "version=${{ inputs.version }}" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [[ ! -f .version ]]; then
+            echo "::error::.version file not found in repository root."
+            exit 1
+          fi
+
+          FILE_VERSION="$(tr -d '[:space:]' < .version)"
+          TAG_VERSION="${{ github.ref_name }}"
+
+          if [[ "$TAG_VERSION" != "$FILE_VERSION" ]]; then
+            echo "::error::Tag '$TAG_VERSION' does not match version in .version file ('$FILE_VERSION'). Refusing to release."
+            exit 1
+          fi
+
+          echo "Tag '$TAG_VERSION' matches .version file."
+          echo "version=$TAG_VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Validate release
+        if: ${{ !inputs.skip_validation }}
+        run: tools/check-release.sh --version=${{ steps.resolve.outputs.version }}

.github/workflows/docker-build.yml

@@ -0,0 +1,86 @@
+name: Docker build
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        type: string
+        required: true
+      dh-repository-owner:
+        type: string
+        required: true
+      platforms-to-build:
+        type: string
+        required: true
+
+jobs:
+  # Turn the comma-separated platforms-to-build input into a JSON matrix array,
+  # so we can fan out per-platform without hardcoding the list twice.
+  plan:
+    name: Plan platform matrix
+    runs-on: ubuntu-24.04
+    outputs:
+      platforms: ${{ steps.plan.outputs.platforms }}
+    steps:
+      - id: plan
+        run: |
+          IFS=',' read -ra ARR <<< "${{ inputs.platforms-to-build }}"
+          JSON=$(printf '%s\n' "${ARR[@]}" | jq -R . | jq -sc .)
+          echo "platforms=$JSON" >> "$GITHUB_OUTPUT"
+
+  build:
+    name: Build ${{ matrix.target == 'lightningd-vls-signer' && 'vls' || 'normal' }} / ${{ matrix.platform }}
+    needs: plan
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - lightningd
+          - lightningd-vls-signer
+        platform: ${{ fromJson(needs.plan.outputs.platforms) }}
+    runs-on: ${{ matrix.platform == 'linux/arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04' }}
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6
+      with:
+        fetch-depth: 0
+
+    - name: Set up QEMU
+      if: matrix.platform == 'linux/arm/v7'
+      uses: docker/setup-qemu-action@v4
+
+    - name: Setup Docker Buildx
+      uses: docker/setup-buildx-action@v4
+
+    - name: Log in to Docker Hub
+      uses: docker/login-action@v4
+      with:
+        username: ${{ secrets.DOCKER_USERNAME }}
+        password: ${{ secrets.DOCKER_PASSWORD }}
+
+    - name: Build single-platform image, push by digest
+      id: build
+      uses: docker/build-push-action@v7
+      with:
+        context: .
+        file: ./Dockerfile
+        target: ${{ matrix.target }}
+        platforms: ${{ matrix.platform }}
+        build-args: |
+          VERSION=${{ inputs.version }}
+        outputs: type=image,name=${{ inputs.dh-repository-owner }}/lightningd,push-by-digest=true,name-canonical=true,push=true
+        cache-from: type=gha,scope=${{ matrix.target }}-${{ matrix.platform }}
+        cache-to: type=gha,mode=max,scope=${{ matrix.target }}-${{ matrix.platform }}
+
+    - name: Save digest
+      run: |
+        mkdir -p /tmp/digests
+        echo "${{ steps.build.outputs.digest }}" > /tmp/digests/digest.txt
+
+    - name: Upload digest
+      uses: actions/upload-artifact@v7
+      with:
+        name: digest_${{ matrix.target }}_${{ strategy.job-index }}
+        path: /tmp/digests/digest.txt
+        if-no-files-found: error
+        retention-days: 1

.github/workflows/docker-publish.yml

@@ -0,0 +1,67 @@
+name: Docker publish
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        type: string
+        required: true
+      dh-repository-owner:
+        type: string
+        required: true
+      push-latest:
+        type: string
+        required: true
+
+jobs:
+  publish:
+    name: Tag and publish ${{ matrix.target }}
+    runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: lightningd
+            tag_suffix: ''
+          - target: lightningd-vls-signer
+            tag_suffix: '-vls'
+    steps:
+    - name: Setup Docker Buildx
+      uses: docker/setup-buildx-action@v4
+
+    - name: Log in to Docker Hub
+      uses: docker/login-action@v4
+      with:
+        username: ${{ secrets.DOCKER_USERNAME }}
+        password: ${{ secrets.DOCKER_PASSWORD }}
+
+    - name: Download platform digests for this target
+      uses: actions/download-artifact@v8
+      with:
+        pattern: digest_${{ matrix.target }}_*
+        path: /tmp/digests
+        merge-multiple: false
+
+    - name: Set up values
+      run: |
+        DIGEST_REFS=""
+        for f in /tmp/digests/*/digest.txt; do
+          D=$(cat "$f")
+          DIGEST_REFS="$DIGEST_REFS ${{ inputs.dh-repository-owner }}/lightningd@${D}"
+        done
+        echo "DIGEST_REFS=$DIGEST_REFS" >> $GITHUB_ENV
+
+        if [[ "${{ inputs.push-latest }}" == "true" ]] ||
+          ([[ "${{ github.ref_type }}" == "tag" ]] && [[ ! "${{ inputs.version }}" =~ rc ]]); then
+          echo "PUSHLATEST=true" >> $GITHUB_ENV
+        else
+          echo "PUSHLATEST=false" >> $GITHUB_ENV
+        fi
+
+    - name: Create and push real tag(s)
+      run: |
+        TAG_ARGS=(-t "${{ inputs.dh-repository-owner }}/lightningd:${{ inputs.version }}${{ matrix.tag_suffix }}")
+        if [[ "$PUSHLATEST" == "true" ]]; then
+          TAG_ARGS+=(-t "${{ inputs.dh-repository-owner }}/lightningd:latest${{ matrix.tag_suffix }}")
+        fi
+        docker buildx imagetools create "${TAG_ARGS[@]}" $DIGEST_REFS

.github/workflows/pypi-build.yml

@@ -0,0 +1,48 @@
+name: PyPI build
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        type: string
+        required: true
+
+jobs:
+  build:
+    name: Build ${{ matrix.PACKAGE }} 🐍
+    runs-on: ubuntu-22.04
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - PACKAGE: pyln-client
+          - PACKAGE: pyln-testing
+          - PACKAGE: pyln-proto
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6
+      with:
+        fetch-depth: 0
+
+    - name: Set up Python
+      uses: actions/setup-python@v6
+      with:
+        python-version: '3.10'
+
+    - name: Install uv
+      uses: astral-sh/setup-uv@v8.1.0
+
+    - name: Update pyln versions
+      run: |
+        make update-pyln-versions NEW_VERSION=${{ inputs.version }}
+
+    - name: Build distribution 📦
+      run: uv build --package ${{ matrix.PACKAGE }}
+
+    - name: Upload distribution artifact
+      uses: actions/upload-artifact@v7
+      with:
+        name: dist-${{ matrix.PACKAGE }}
+        path: dist/
+        if-no-files-found: error