mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
43573d114b
## Summary Separate OSS desktop artifact publication from fleet-wide auto-update promotion. - retain the exact generated updater manifest as `updater-manifest.json` on each immutable `desktop-vX.Y.Z` release - stop the tag-triggered build from mutating `buzz-desktop-latest/latest.json` - add a `main`-only manual promotion workflow with one global concurrency group - validate stable semver, release/tag commit identity, draft/prerelease state, exact platform set, signatures, version-bound asset URLs, asset existence, monotonicity, idempotent retries, and a final stale-state check before writing - document the operator flow and pin the split with focused contract tests ## Safety behavior Publishing a versioned GitHub release no longer exposes it through the in-app updater. Operators can install and test those exact signed/notarized artifacts, then manually run **Promote OSS Desktop Auto-Update** with the stable version. Promotion rejects downgrades. A same-version retry succeeds only when the rolling and candidate manifests are byte-identical. The workflow re-reads the current rolling version immediately before its only write and records the actor, source tag commit, previous version, manifest digest, and run URL. ## Verification Verified at commit `39caf1603be06bb476905225ec55f7bbbe86b237`: ```text scripts/test-oss-desktop-promotion.sh OSS desktop promotion contract passed scripts/test-release-ref-contract.sh release ref contract passed git diff --check origin/main...HEAD (clean) ``` The repository pre-push hook also passed `branch-skew` for the exact pushed head; package suites were correctly skipped because this change only touches release workflows, scripts, and documentation. Originating conversation: Buzz channel `separate-publish-step-release`, thread `8857ce8bbe928e891165eddcf06c666cf6eae16181c3f02a6d8c396d8a536026`. Signed-off-by: Wes <wesbillman@users.noreply.github.com> Co-authored-by: Carl <c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@buzz.block.builderlab.xyz>
38 lines
1.6 KiB
Bash
Executable File
38 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
workflow="$root/.github/workflows/promote-oss-desktop-release.yml"
|
|
promoter="$root/scripts/promote-oss-desktop-release.sh"
|
|
release="$root/.github/workflows/release.yml"
|
|
|
|
# Pin the separation contract: tag builds retain the exact candidate but cannot
|
|
# mutate the rolling updater release.
|
|
grep -Fq 'cp latest.json staged/updater-manifest.json' "$release"
|
|
[[ "$(grep -c 'gh release upload' "$release")" -eq 1 ]]
|
|
! grep -Fq 'gh release upload buzz-desktop-latest' "$release"
|
|
|
|
grep -Fq 'workflow_dispatch:' "$workflow"
|
|
grep -Fq 'group: oss-desktop-auto-update-promotion' "$workflow"
|
|
grep -Fq 'cancel-in-progress: false' "$workflow"
|
|
grep -Fq 'if: github.repository ==' "$workflow"
|
|
grep -Fq 'DISPATCH_REF' "$workflow"
|
|
grep -Fq 'contents: write' "$workflow"
|
|
grep -Fq 'VERSION: ${{ inputs.version }}' "$workflow"
|
|
grep -Fq 'scripts/promote-oss-desktop-release.sh "$VERSION"' "$workflow"
|
|
if grep -F 'run:' "$workflow" | grep -Fq '${{ inputs.version }}'; then
|
|
echo "untrusted workflow input must not be interpolated into run" >&2
|
|
exit 1
|
|
fi
|
|
|
|
grep -Fq 'refusing downgrade' "$promoter"
|
|
grep -Fq 'current_digest="$(sha256sum "$current"' "$promoter"
|
|
grep -Fq '== "$current_digest"' "$promoter"
|
|
grep -Fq 'updater-manifest.json' "$promoter"
|
|
grep -Fq 'desktop-v" + $version + "/"' "$promoter"
|
|
grep -Fq 'gh release upload "$ROLLING_TAG" "$promotion"' "$promoter"
|
|
grep -Fq 'served latest.json does not match the promoted candidate' "$promoter"
|
|
grep -Fq 'promotion upload failed' "$promoter"
|
|
|
|
echo "OSS desktop promotion contract passed"
|