ci: preserve verified artifacts and recover network operations

.github/scripts/ci_network.sh

@@ -0,0 +1,116 @@
+# shellcheck shell=bash
+# CI network operations have bounded retries; build and test commands are not retried.
+ci_retry() {
+  local attempt status stdout_file stderr_file
+  stdout_file=$(mktemp)
+  stderr_file=$(mktemp)
+  for attempt in 1 2 3; do
+    if "$@" >"$stdout_file" 2>"$stderr_file"; then
+      cat "$stdout_file"
+      cat "$stderr_file" >&2
+      rm -f "$stdout_file" "$stderr_file"
+      return 0
+    else
+      status=$?
+    fi
+    if [[ "$attempt" == 3 ]] || ! grep -Eiq 'HTTP[^0-9]*(408|429|500|502|503|504)|timed? out|timeout|connection (reset|refused|closed)|temporary failure|TLS handshake|unexpected EOF|could not resolve host|failed to connect|remote end hung up' "$stdout_file" "$stderr_file"; then
+      cat "$stdout_file"
+      cat "$stderr_file" >&2
+      rm -f "$stdout_file" "$stderr_file"
+      return "$status"
+    fi
+    sleep "$((attempt * 2))"
+  done
+}
+gh() { ci_retry command gh "$@"; }
+git() {
+  if [[ "${1:-}" != clone ]]; then
+    command git "$@"
+    return
+  fi
+  local destination temporary status
+  local clone_args=("$@")
+  destination="${clone_args[${#clone_args[@]}-1]}"
+  # Calls without an explicit destination keep git's native behavior.
+  if [[ "$destination" == *://* || "$destination" == *.git ]]; then
+    ci_retry command git "$@"
+    return
+  fi
+  if [[ -e "$destination" || -L "$destination" ]]; then
+    printf 'Clone destination already exists.\n' >&2
+    return 1
+  fi
+  mkdir -p "$(dirname "$destination")"
+  temporary=$(mktemp -d "${destination}.ci-XXXXXX")
+  clone_args[${#clone_args[@]}-1]="$temporary"
+  # A failed clone may leave a partial checkout; clear only our owned temp directory.
+  if ci_retry ci_clone_attempt "$temporary" "${clone_args[@]}"; then
+    if [[ -e "$destination" || -L "$destination" ]]; then
+      rm -rf "$temporary"
+      return 1
+    fi
+    mv "$temporary" "$destination"
+  else
+    status=$?
+    rm -rf "$temporary"
+    return "$status"
+  fi
+}
+ci_clone_attempt() {
+  local temporary="$1"
+  shift
+  rm -rf "$temporary"
+  command git "$@"
+}
+curl() {
+  local argument mutating=false status stdout_file stderr_file source_index=-1 backup='' i
+  local curl_args=("$@")
+  for ((i=0; i<${#curl_args[@]}; i++)); do
+    argument="${curl_args[i]}"
+    case "$argument" in
+      --data*|-d*|--form*|-F*|--upload-file*|-T*) mutating=true ;;
+      POST|PATCH|PUT|DELETE|-XPOST|-XPATCH|-XPUT|-XDELETE|--request=POST|--request=PATCH|--request=PUT|--request=DELETE) mutating=true ;;
+      https://*) source_index=$i ;;
+    esac
+  done
+  if $mutating; then
+    # A timed-out mutation may already have reached the server.
+    command curl --fail-with-body --connect-timeout 15 --max-time 600 "${curl_args[@]}"
+    return
+  fi
+  if [[ "$source_index" -ge 0 ]]; then
+    case "${curl_args[source_index]}" in
+      https://cdn.spiritlhl.net/https://*|https://cdn.spiritlhl.top/https://*)
+        backup="${curl_args[source_index]#*/https://}"
+        backup="https://$backup" ;;
+      https://ftp.gnu.org/gnu/*)
+        backup="https://ftpmirror.gnu.org/${curl_args[source_index]#https://ftp.gnu.org/gnu/}" ;;
+    esac
+  fi
+  stdout_file=$(mktemp)
+  stderr_file=$(mktemp)
+  if command curl --fail-with-body --connect-timeout 15 --max-time 1200 --retry 3 --retry-max-time 180 --retry-connrefused "${curl_args[@]}" >"$stdout_file" 2>"$stderr_file"; then
+    cat "$stdout_file"
+    cat "$stderr_file" >&2
+    rm -f "$stdout_file" "$stderr_file"
+    return 0
+  else
+    status=$?
+  fi
+  if [[ -n "$backup" ]]; then
+    curl_args[source_index]="$backup"
+    if command curl --fail-with-body --connect-timeout 15 --max-time 1200 --retry 3 --retry-max-time 180 --retry-connrefused "${curl_args[@]}" >"$stdout_file" 2>"$stderr_file"; then
+      cat "$stdout_file"
+      cat "$stderr_file" >&2
+      rm -f "$stdout_file" "$stderr_file"
+      return 0
+    else
+      status=$?
+    fi
+  fi
+  cat "$stdout_file"
+  cat "$stderr_file" >&2
+  rm -f "$stdout_file" "$stderr_file"
+  return "$status"
+}
+wget() { command wget --tries=3 --timeout=45 --waitretry=2 --retry-connrefused "$@"; }

.github/workflows/action-policy.yml

@@ -26,3 +26,5 @@ jobs:
     - name: Verify private output isolation
       run: |
         if [[ -d .github/tests ]]; then python3 -m unittest discover -s .github/tests -p "test_*.py"; fi
+    env:
+      GOPROXY: https://proxy.golang.org|direct

.github/workflows/build.yml

@@ -1,43 +1,38 @@
 name: 创建IPv6检测的前缀
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 0 * * *'
-
 concurrency:
   group: backtrace-ipv6-prefix-sync
   cancel-in-progress: false
-
 permissions:
   contents: write
-
 jobs:
   fetch-ipv6-prefixes:
     runs-on: ubuntu-latest
     steps:
-      - name: 检出代码
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: 设置 Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version-file: go.mod
-
-      - name: 获取并处理多个ASN的IPv6前缀
-        run: |
-          go run ./cmd/update-prefixes -output-dir bk/prefix
-
-      - name: 提交更新到仓库
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add bk/prefix/*.txt bk/prefix/*.txt.manifest.json
-          if git diff --cached --quiet; then
-            echo "无变更，跳过提交。"
-          else
-            git commit -m "chore: 更新多个 ASN 的 IPv6 前缀"
-            git push
-          fi
+    - name: 检出代码
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+    - name: 设置 Go
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      with:
+        go-version-file: go.mod
+    - name: 获取并处理多个ASN的IPv6前缀
+      run: |
+        go run ./cmd/update-prefixes -output-dir bk/prefix
+    - name: 提交更新到仓库
+      run: |
+        git config user.name "github-actions[bot]"
+        git config user.email "github-actions[bot]@users.noreply.github.com"
+        git add bk/prefix/*.txt bk/prefix/*.txt.manifest.json
+        if git diff --cached --quiet; then
+          echo "无变更，跳过提交。"
+        else
+          git commit -m "chore: 更新多个 ASN 的 IPv6 前缀"
+          git push
+        fi
+    env:
+      GOPROXY: https://proxy.golang.org|direct
+'on':
+  workflow_dispatch: null
+  schedule:
+  - cron: 0 0 * * *

.github/workflows/ci.yaml

@@ -1,34 +1,34 @@
 name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
 permissions:
   contents: read
-
 concurrency:
   group: backtrace-ci-${{ github.ref }}
   cancel-in-progress: true
-
 jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version-file: go.mod
-          check-latest: true
-      - name: Verify module and test source
-        shell: bash
-        run: |
-          set -euo pipefail
-          go mod verify
-          go test -race -count=1 ./...
-          go vet ./...
-          go build -o "$RUNNER_TEMP/backtrace" ./cmd
-          git diff --check
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      with:
+        go-version-file: go.mod
+        check-latest: true
+    - name: Verify module and test source
+      shell: bash
+      run: |
+        set -euo pipefail
+        go mod verify
+        go test -race -count=1 ./...
+        go vet ./...
+        go build -o "$RUNNER_TEMP/backtrace" ./cmd
+        git diff --check
+    env:
+      GOPROXY: https://proxy.golang.org|direct
+'on':
+  push:
+    branches:
+    - main
+  pull_request:
+    branches:
+    - main
+  workflow_dispatch: null

.github/workflows/main.yaml

@@ -1,128 +1,171 @@
 name: Build and Release
-
-on:
-  push:
-    tags: ["v*"]
-  workflow_dispatch:
-    inputs:
-      release_tag:
-        description: Existing semantic version tag to build and release
-        required: true
-        type: string
-
 permissions:
   contents: write
-
 jobs:
   verify:
     runs-on: ubuntu-latest
     outputs:
       tag: ${{ steps.release.outputs.tag }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.ref }}
-          fetch-depth: 0
-          fetch-tags: true
-      - id: release
-        name: Verify release tag and source version
-        shell: bash
-        run: |
-          set -euo pipefail
-          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
-            tag="${{ inputs.release_tag }}"
-          else
-            tag="${GITHUB_REF#refs/tags/}"
-          fi
-          [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
-          git fetch --force --tags origin
-          [[ "$(git rev-list -n 1 "$tag")" == "$(git rev-parse HEAD)" ]]
-          version="$(sed -n 's/^const BackTraceVersion = "\(v[0-9.]*\)"$/\1/p' model/model.go)"
-          [[ "$version" == "$tag" ]]
-          echo "tag=$tag" >> "$GITHUB_OUTPUT"
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version-file: go.mod
-          check-latest: true
-      - name: Validate release source
-        shell: bash
-        run: |
-          set -euo pipefail
-          go mod verify
-          go test -race -count=1 ./...
-          go vet ./...
-          go build -o "$RUNNER_TEMP/backtrace" ./cmd
-
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.ref }}
+        fetch-depth: 0
+        fetch-tags: true
+    - id: release
+      name: Verify release tag and source version
+      shell: bash
+      run: |
+        set -euo pipefail
+        if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
+          tag="${{ inputs.release_tag }}"
+        else
+          tag="${GITHUB_REF#refs/tags/}"
+        fi
+        [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
+        git fetch --force --tags origin
+        [[ "$(git rev-list -n 1 "$tag")" == "$(git rev-parse HEAD)" ]]
+        version="$(sed -n 's/^const BackTraceVersion = "\(v[0-9.]*\)"$/\1/p' model/model.go)"
+        [[ "$version" == "$tag" ]]
+        echo "tag=$tag" >> "$GITHUB_OUTPUT"
+    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      with:
+        go-version-file: go.mod
+        check-latest: true
+    - name: Validate release source
+      shell: bash
+      run: |
+        set -euo pipefail
+        go mod verify
+        go test -race -count=1 ./...
+        go vet ./...
+        go build -o "$RUNNER_TEMP/backtrace" ./cmd
+    env:
+      GOPROXY: https://proxy.golang.org|direct
   release:
     needs: verify
     runs-on: ubuntu-latest
     steps:
-      - name: Create GitHub release
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ needs.verify.outputs.tag }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1 || \
-            gh release create "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --verify-tag \
-              --title "$RELEASE_TAG" --generate-notes
-
+    - name: Load trusted network recovery helpers
+      shell: bash
+      run: |
+        set -euo pipefail
+        curl --fail --silent --show-error --location --connect-timeout 15 --max-time 90 --retry 3 --retry-max-time 180 --retry-connrefused "https://raw.githubusercontent.com/oneclickvirt/backtrace/main/.github/scripts/ci_network.sh" -o "$RUNNER_TEMP/ci-network.sh"
+    - name: Create GitHub release
+      env:
+        GH_TOKEN: ${{ github.token }}
+        RELEASE_TAG: ${{ needs.verify.outputs.tag }}
+      shell: bash
+      run: |
+        source "$RUNNER_TEMP/ci-network.sh"
+        set -euo pipefail
+        gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1 || \
+          gh release create "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --verify-tag \
+            --title "$RELEASE_TAG" --generate-notes
   build:
-    needs: [verify, release]
+    needs:
+    - verify
+    - release
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         include:
-          - {goos: linux, goarch: amd64}
-          - {goos: linux, goarch: "386"}
-          - {goos: linux, goarch: arm, goarm: "7"}
-          - {goos: linux, goarch: arm64}
-          - {goos: linux, goarch: riscv64}
-          - {goos: linux, goarch: mips}
-          - {goos: linux, goarch: mipsle}
-          - {goos: linux, goarch: mips64}
-          - {goos: linux, goarch: mips64le}
-          - {goos: linux, goarch: ppc64}
-          - {goos: linux, goarch: ppc64le}
-          - {goos: freebsd, goarch: amd64}
-          - {goos: freebsd, goarch: "386"}
-          - {goos: freebsd, goarch: arm, goarm: "7"}
-          - {goos: freebsd, goarch: arm64}
-          - {goos: openbsd, goarch: amd64}
-          - {goos: openbsd, goarch: "386"}
-          - {goos: openbsd, goarch: arm, goarm: "7"}
-          - {goos: openbsd, goarch: arm64}
-          - {goos: darwin, goarch: amd64}
-          - {goos: darwin, goarch: arm64}
-          - {goos: windows, goarch: "386"}
-          - {goos: windows, goarch: amd64}
-          - {goos: windows, goarch: arm64}
+        - goos: linux
+          goarch: amd64
+        - goos: linux
+          goarch: '386'
+        - goos: linux
+          goarch: arm
+          goarm: '7'
+        - goos: linux
+          goarch: arm64
+        - goos: linux
+          goarch: riscv64
+        - goos: linux
+          goarch: mips
+        - goos: linux
+          goarch: mipsle
+        - goos: linux
+          goarch: mips64
+        - goos: linux
+          goarch: mips64le
+        - goos: linux
+          goarch: ppc64
+        - goos: linux
+          goarch: ppc64le
+        - goos: freebsd
+          goarch: amd64
+        - goos: freebsd
+          goarch: '386'
+        - goos: freebsd
+          goarch: arm
+          goarm: '7'
+        - goos: freebsd
+          goarch: arm64
+        - goos: openbsd
+          goarch: amd64
+        - goos: openbsd
+          goarch: '386'
+        - goos: openbsd
+          goarch: arm
+          goarm: '7'
+        - goos: openbsd
+          goarch: arm64
+        - goos: darwin
+          goarch: amd64
+        - goos: darwin
+          goarch: arm64
+        - goos: windows
+          goarch: '386'
+        - goos: windows
+          goarch: amd64
+        - goos: windows
+          goarch: arm64
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.ref }}
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version-file: go.mod
-          check-latest: true
-      - name: Build binary
-        env:
-          GOOS: ${{ matrix.goos }}
-          GOARCH: ${{ matrix.goarch }}
-          GOARM: ${{ matrix.goarm }}
-          CGO_ENABLED: "0"
-        shell: bash
-        run: |
-          set -euo pipefail
-          suffix=""
-          [[ "$GOOS" == "windows" ]] && suffix=".exe"
-          artifact="backtrace-${GOOS}-${GOARCH}${suffix}"
-          go build -trimpath -buildvcs=false -ldflags="-s -w" -o "$artifact" ./cmd
-          echo "ARTIFACT=$artifact" >> "$GITHUB_ENV"
-      - name: Upload release asset
-        env:
-          GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ needs.verify.outputs.tag }}
-        run: gh release upload "$RELEASE_TAG" "$ARTIFACT" --repo "$GITHUB_REPOSITORY" --clobber
+    - name: Load trusted network recovery helpers
+      shell: bash
+      run: |
+        set -euo pipefail
+        curl --fail --silent --show-error --location --connect-timeout 15 --max-time 90 --retry 3 --retry-max-time 180 --retry-connrefused "https://raw.githubusercontent.com/oneclickvirt/backtrace/main/.github/scripts/ci_network.sh" -o "$RUNNER_TEMP/ci-network.sh"
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.ref }}
+    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      with:
+        go-version-file: go.mod
+        check-latest: true
+    - name: Build binary
+      env:
+        GOOS: ${{ matrix.goos }}
+        GOARCH: ${{ matrix.goarch }}
+        GOARM: ${{ matrix.goarm }}
+        CGO_ENABLED: '0'
+      shell: bash
+      run: |
+        set -euo pipefail
+        suffix=""
+        [[ "$GOOS" == "windows" ]] && suffix=".exe"
+        artifact="backtrace-${GOOS}-${GOARCH}${suffix}"
+        go build -trimpath -buildvcs=false -ldflags="-s -w" -o "$artifact" ./cmd
+        echo "ARTIFACT=$artifact" >> "$GITHUB_ENV"
+    - name: Upload release asset
+      env:
+        GH_TOKEN: ${{ github.token }}
+        RELEASE_TAG: ${{ needs.verify.outputs.tag }}
+      run: |-
+        source "$RUNNER_TEMP/ci-network.sh"
+        gh release upload "$RELEASE_TAG" "$ARTIFACT" --repo "$GITHUB_REPOSITORY" --clobber
+      shell: bash
+    env:
+      GOPROXY: https://proxy.golang.org|direct
+'on':
+  push:
+    tags:
+    - v*
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: Existing semantic version tag to build and release
+        required: true
+        type: string

.github/workflows/release.yaml

@@ -1,78 +1,76 @@
 name: Prepare and Tag Release
-
-on:
+permissions:
+  contents: write
+concurrency:
+  group: backtrace-release-data
+  cancel-in-progress: false
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        ref: main
+        fetch-depth: 0
+        fetch-tags: true
+    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      with:
+        go-version-file: go.mod
+        check-latest: true
+    - id: release
+      name: Resolve release tag
+      shell: bash
+      run: |
+        set -euo pipefail
+        version="$(sed -n 's/^const BackTraceVersion = "\(v[0-9.]*\)"$/\1/p' model/model.go)"
+        tag="${{ inputs.release_tag }}"
+        [[ -n "$tag" ]] || tag="$version"
+        [[ "$tag" == "$version" ]]
+        [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
+        git fetch --force --tags origin
+        ! git rev-parse --verify --quiet "refs/tags/$tag"
+        echo "tag=$tag" >> "$GITHUB_OUTPUT"
+    - name: Refresh embedded routing datasets
+      shell: bash
+      run: |
+        set -euo pipefail
+        go run ./cmd/update-prefixes -output-dir bk/prefix
+        go run ./cmd/update-asn-metadata
+    - name: Validate release source
+      shell: bash
+      run: |
+        set -euo pipefail
+        go mod verify
+        go test -race -count=1 ./...
+        go vet ./...
+        go build -o "$RUNNER_TEMP/backtrace" ./cmd
+        git diff --check
+    - name: Commit refreshed routing datasets
+      shell: bash
+      run: |
+        set -euo pipefail
+        if [[ -z "$(git status --porcelain -- bk/prefix bgptools/data)" ]]; then
+          exit 0
+        fi
+        git config user.name "github-actions[bot]"
+        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+        git add bk/prefix bgptools/data
+        git commit -m "chore(data): refresh routing datasets"
+        git push origin HEAD:main
+    - name: Create immutable release tag
+      env:
+        RELEASE_TAG: ${{ steps.release.outputs.tag }}
+      shell: bash
+      run: |
+        set -euo pipefail
+        git tag -a "$RELEASE_TAG" -m "Release $RELEASE_TAG"
+        git push origin "refs/tags/$RELEASE_TAG"
+    env:
+      GOPROXY: https://proxy.golang.org|direct
+'on':
   workflow_dispatch:
     inputs:
       release_tag:
         description: Semantic version tag; leave empty to use BackTraceVersion
         required: false
         type: string
-
-permissions:
-  contents: write
-
-concurrency:
-  group: backtrace-release-data
-  cancel-in-progress: false
-
-jobs:
-  prepare:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: main
-          fetch-depth: 0
-          fetch-tags: true
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version-file: go.mod
-          check-latest: true
-      - id: release
-        name: Resolve release tag
-        shell: bash
-        run: |
-          set -euo pipefail
-          version="$(sed -n 's/^const BackTraceVersion = "\(v[0-9.]*\)"$/\1/p' model/model.go)"
-          tag="${{ inputs.release_tag }}"
-          [[ -n "$tag" ]] || tag="$version"
-          [[ "$tag" == "$version" ]]
-          [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
-          git fetch --force --tags origin
-          ! git rev-parse --verify --quiet "refs/tags/$tag"
-          echo "tag=$tag" >> "$GITHUB_OUTPUT"
-      - name: Refresh embedded routing datasets
-        shell: bash
-        run: |
-          set -euo pipefail
-          go run ./cmd/update-prefixes -output-dir bk/prefix
-          go run ./cmd/update-asn-metadata
-      - name: Validate release source
-        shell: bash
-        run: |
-          set -euo pipefail
-          go mod verify
-          go test -race -count=1 ./...
-          go vet ./...
-          go build -o "$RUNNER_TEMP/backtrace" ./cmd
-          git diff --check
-      - name: Commit refreshed routing datasets
-        shell: bash
-        run: |
-          set -euo pipefail
-          if [[ -z "$(git status --porcelain -- bk/prefix bgptools/data)" ]]; then
-            exit 0
-          fi
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add bk/prefix bgptools/data
-          git commit -m "chore(data): refresh routing datasets"
-          git push origin HEAD:main
-      - name: Create immutable release tag
-        env:
-          RELEASE_TAG: ${{ steps.release.outputs.tag }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          git tag -a "$RELEASE_TAG" -m "Release $RELEASE_TAG"
-          git push origin "refs/tags/$RELEASE_TAG"

.github/workflows/sync-asn-metadata.yml

@@ -1,51 +1,49 @@
 name: Sync ASN metadata
-
-on:
-  schedule:
-    - cron: "29 3 * * *"
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-    paths:
-      - ".github/workflows/sync-asn-metadata.yml"
-      - "cmd/update-asn-metadata/**"
-      - "bgptools/data/**"
-      - "bgptools/asn_metadata.go"
-      - "bgptools/asn_metadata_test.go"
-      - "model/model.go"
-      - "go.mod"
-      - "go.sum"
-
 concurrency:
   group: backtrace-asn-metadata-sync
   cancel-in-progress: false
-
 permissions:
   contents: write
-
 jobs:
   sync:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version-file: go.mod
-          cache: true
-      - name: Update snapshot
-        run: go run ./cmd/update-asn-metadata
-      - name: Validate updater and runtime loader
-        run: go test -race ./cmd/update-asn-metadata ./bgptools
-      - name: Vet updater and runtime loader
-        run: go vet ./cmd/update-asn-metadata ./bgptools
-      - name: Commit semantic changes
-        run: |
-          if git diff --quiet -- bgptools/data/bgp-asn-map.json bgptools/data/bgp-asn-map.manifest.json; then
-            exit 0
-          fi
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add bgptools/data/bgp-asn-map.json bgptools/data/bgp-asn-map.manifest.json
-          git commit -m "chore(data): update ASN metadata"
-          git push
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      with:
+        go-version-file: go.mod
+        cache: true
+    - name: Update snapshot
+      run: go run ./cmd/update-asn-metadata
+    - name: Validate updater and runtime loader
+      run: go test -race ./cmd/update-asn-metadata ./bgptools
+    - name: Vet updater and runtime loader
+      run: go vet ./cmd/update-asn-metadata ./bgptools
+    - name: Commit semantic changes
+      run: |
+        if git diff --quiet -- bgptools/data/bgp-asn-map.json bgptools/data/bgp-asn-map.manifest.json; then
+          exit 0
+        fi
+        git config user.name "github-actions[bot]"
+        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+        git add bgptools/data/bgp-asn-map.json bgptools/data/bgp-asn-map.manifest.json
+        git commit -m "chore(data): update ASN metadata"
+        git push
+    env:
+      GOPROXY: https://proxy.golang.org|direct
+'on':
+  schedule:
+  - cron: 29 3 * * *
+  workflow_dispatch: null
+  push:
+    branches:
+    - main
+    paths:
+    - .github/workflows/sync-asn-metadata.yml
+    - cmd/update-asn-metadata/**
+    - bgptools/data/**
+    - bgptools/asn_metadata.go
+    - bgptools/asn_metadata_test.go
+    - model/model.go
+    - go.mod
+    - go.sum