chore: complete the master to next rename and retire dev-*

[kvinwang]

Problem

The default branch was renamed master -> next. GitHub redirects more than expected, but not everything, and the gap is where the breakage is.

Measured after the rename:

layer	old ref name	result
github.com/.../blob|tree/master/...	redirects	302 to the next path
raw.githubusercontent.com/.../master/...	redirects	200, byte-identical to raw/next
REST repos/.../branches/master	redirects	resolves to next
git ls-remote refs/heads/master	gone	0 refs
git fetch origin master	fails	couldn't find remote ref master
git clone -b master <url>	fails	Remote branch master not found in upstream origin

So documentation links were never broken, but anything that pins the ref name at the git layer broke the moment the rename landed. Three such places exist in this repo, and all three are on user-facing install/build paths:

1. dstack/scripts/install.sh — DEFAULT_REF="master", consumed as git checkout "$ref" after cloning. This is the script behind the documented curl -fsSL .../install.sh | sh entrypoint. The script runs under set -eu, so the failed checkout aborts the install outright. Reproduced against the live repo:

   $ git clone --filter=blob:none https://github.com/Dstack-TEE/dstack.git repro
   $ cd repro && git checkout master
   error: pathspec 'master' did not match any file(s) known to git
   

2. dstack/crates/dstackup/src/cli.rs — DEFAULT_SOURCE_REF = "master", the clap default for --source-ref, consumed by install.rs as ["checkout", git_ref] on both the cached-source and fresh-clone paths. Same failure.

3. dstack/kms/auth-mock/Dockerfile — ARG DSTACK_BRANCH=master feeding git clone --branch ${DSTACK_BRANCH}. This is exactly the git clone -b master case measured above, so the image build fails at that layer.

The docs under docs/tutorials/ also instruct readers to run git checkout master, which now errors.

Fix

Three commits, each independently readable:

• ci: drop master from workflow branch filters — removes the now-dead master entry from all eight workflows. next was added in ci: add next to workflow branch filters #1025 before the rename so CI stayed green across the cutover; this removes the other half.
• fix: point default git refs at next — the three functional defaults above. This preserves the existing semantics of each knob (track the development mainline); it does not change what they track, only the name they track it by.
• ci: retire the dev-* branch pattern — drops the dev-* glob from the six workflows that carried it. The pattern is dead config: git ls-remote --heads origin 'refs/heads/dev-*' returns nothing and none of the last 100 workflow runs came from such a branch. All eight workflows now filter on exactly [next], so there is one rule instead of two. Working branches still get their checks through the pull_request trigger; only pushes to a branch with no open PR stop building, which nothing was relying on. (dstack-dev-* and dstack-nvidia-dev-* in the docs are image names, not branch patterns, and are untouched.)
• ci: run workflows on release branches — adds release/** to the eight filters. Note what this does and does not do: for both push and pull_request, GitHub runs the workflow files as they exist on the branch being built, so this cannot retroactively give CI to release/v0.5.x (cut from v0.5.11, whose filters predate the rename). It means any future release branch cut from next inherits working filters instead of needing the same fix again. Enabling CI on the existing release/v0.5.x is tracked separately.
• docs: update branch references to next — README, docs, tutorials, verifier README, the artifact-manifest $id, the simulator unit's Documentation= URL, and a new ## Branches section in CONTRIBUTING.md describing next / release/vX.Y / dev-* plus the clone-migration one-liner.

Deliberately not touched:

• CHANGELOG.md — generated history; the old branch names are a factual record.
• dtolnay/rust-toolchain@master, rwf2/Rocket branch = "master", tianocore/edk2 branch=master, the sysbox doc link — third-party refs.
• ip link set dev <tap> master <bridge> in vmm/src/netd.rs and bus_master in lspci — kernel/PCI terminology.
• dstack/tests/docs/kms-self-authorization.md — prose recording what a past test ran against.

Verification

• cargo check -p dstackup passes.
• sh -n dstack/scripts/install.sh passes.
• All eight workflow files parse; resolved triggers confirmed as push/pull_request on [next, release/**] uniformly across all eight, with mkosi-build's mkosi-os-v* tag trigger and paths-only pull_request filter unchanged.
• Full-tree sweep for master outside vendored os/yocto/deps/**: every remaining hit is in the deliberately-untouched list above.
• This PR is itself the first one based on next, so its own check run confirms pull_request dispatch works against the renamed branch.

Follow-up

release/v0.5.x now exists at the v0.5.11 commit, protected against deletion and force-push. It has no CI: creating it triggered zero workflow runs, and merge-protection targets ~DEFAULT_BRANCH only, so a backport PR into it currently faces no required checks. Its v0.5.11-era workflows are 1918 commits old and are not expected to pass unmodified on current runners, so which of them are worth reviving on that line is a separate decision.

[Copilot]

Pull request overview

This PR completes the repository-wide migration from the old default branch name master to the new default branch next, fixing breakages at the git ref layer (e.g., git checkout master, git clone -b master, workflow branch filters) across install/build entrypoints and documentation.

Changes:

• Updated user-facing installation/build defaults to track next instead of the removed master ref (installer script, dstackup, auth-mock Dockerfile).
• Removed master from GitHub Actions workflow branch filters so CI triggers match the renamed default branch.
• Updated documentation and canonical GitHub links to reference next, including new contributor guidance on branch naming and how to migrate existing clones.

Reviewed changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
README.md	Updates GitHub links to point at next instead of master.
os/yocto/layers/meta-dstack/recipes-core/dstack-tee-simulator/files/dstack-tee-simulator.service	Updates systemd unit Documentation= URL to next.
os/spec/artifact-manifest.schema.json	Updates schema $id URL to reference next.
dstack/verifier/README.md	Updates README links to SDK docs under next.
dstack/scripts/install.sh	Changes default git ref to next and updates the documented `curl
dstack/kms/auth-mock/Dockerfile	Changes default build ARG DSTACK_BRANCH to next for git clone --branch.
dstack/crates/dstackup/src/cli.rs	Updates dstackup default --source-ref from master to next.
docs/verification.md	Updates verifier repo link to next.
docs/tutorials/contract-deployment.md	Replaces master checkout instructions with next.
docs/tutorials/clone-build-dstack-vmm.md	Updates tutorial text/comments to expect next instead of master.
docs/onboarding.md	Updates installer raw.githubusercontent.com URLs to use next.
docs/attestation-tdx.md	Updates dstack-mr link to next.
CONTRIBUTING.md	Adds a Branches section describing next/release/vX.Y/dev-* and provides clone migration commands.
.github/workflows/vmm-ui.yml	Removes master from workflow branch filters.
.github/workflows/spdx-check.yml	Removes master from workflow branch filters (now next only).
.github/workflows/sdk.yaml	Removes master from workflow branch filters.
.github/workflows/rust.yml	Removes master from workflow branch filters.
.github/workflows/prek-check.yml	Removes master from workflow branch filters.
.github/workflows/mkosi-build.yml	Removes master from the push.branches filter (now next only).
.github/workflows/gateway-proxy-tests.yml	Removes master from workflow branch filters.
.github/workflows/docker-build-check.yml	Removes master from workflow branch filters.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.