[codex] Add stable nightly promotion gate (#962)

* Upload beta e2e spec reports to R2 * Expose beta report URLs in summary * Complete Indonesian deploy locale keys * chore: factor release workflow scripts * chore: bump packaged beta base version * test: wait for mac packaged runtime health * fix: capture mac packaged startup logs * chore: improve mac release build observability * fix: ad-hoc sign unsigned mac builds * chore: diagnose mac packaged startup * fix: relax unsigned mac launch signing * chore: improve mac launch diagnostics * chore: simplify beta mac release artifacts * fix: align packaged mac smoke launch config * fix: externalize mac daemon wasm dependency * chore: require signed stable mac releases * fix: use stable app version for nightly package builds * chore: clean release artifacts after publish * chore: publish beta reports as zip * ci: disable beta mac tools-pack cache * fix: skip mac framework binary symlinks when signing * fix: sign mac framework version bundles * ci: disable beta mac pnpm cache * chore: align stable release reports * ci: require matching nightly before stable release * ci: avoid mac pnpm cache for packaged smoke
2026-10-27 09:51:12 +01:00 · 2026-05-08 21:48:54 +08:00
parent f951ccb612
commit dcfab797c2
33 changed files with 2684 additions and 1004 deletions
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+for name in GITHUB_REPOSITORY GITHUB_RUN_ID; do
+  if [ -z "${!name:-}" ]; then
+    echo "$name is required" >&2
+    exit 1
+  fi
+done
+
+if [ -z "${GH_TOKEN:-${GITHUB_TOKEN:-}}" ]; then
+  echo "GH_TOKEN or GITHUB_TOKEN is required" >&2
+  exit 1
+fi
+
+artifacts_file="$(mktemp)"
+trap 'rm -f "$artifacts_file"' EXIT
+
+gh api --paginate \
+  -H "Accept: application/vnd.github+json" \
+  "/repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/artifacts?per_page=100" \
+  --jq '.artifacts[] | select(.expired | not) | [.id, .name] | @tsv' \
+  > "$artifacts_file"
+
+if [ ! -s "$artifacts_file" ]; then
+  echo "No workflow artifacts to delete for run $GITHUB_RUN_ID"
+  exit 0
+fi
+
+deleted_count=0
+while IFS=$'\t' read -r artifact_id artifact_name; do
+  if [ -z "$artifact_id" ]; then
+    continue
+  fi
+
+  echo "Deleting workflow artifact $artifact_name ($artifact_id)"
+  gh api \
+    -X DELETE \
+    -H "Accept: application/vnd.github+json" \
+    "/repos/$GITHUB_REPOSITORY/actions/artifacts/$artifact_id"
+  deleted_count=$((deleted_count + 1))
+done < "$artifacts_file"
+
+echo "Deleted $deleted_count workflow artifacts from run $GITHUB_RUN_ID"
+
+if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
+  {
+    echo ""
+    echo "### Workflow artifacts"
+    echo ""
+    echo "Deleted $deleted_count intermediate Actions artifacts after publish."
+  } >> "$GITHUB_STEP_SUMMARY"
+fi
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+for name in BRANCH_NAME CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN GITHUB_OUTPUT GITHUB_REPOSITORY GITHUB_SHA RELEASE_CHANNEL RELEASE_SIGNED RELEASE_VERSION RUNNER_TEMP VERSION_TAG; do
+  if [ -z "${!name:-}" ]; then
+    echo "$name is required" >&2
+    exit 1
+  fi
+done
+
+notes_file="$RUNNER_TEMP/open-design-stable-notes.md"
+public_origin="${CLOUDFLARE_R2_RELEASES_PUBLIC_ORIGIN%/}"
+cat > "$notes_file" <<EOF
+## Summary
+- channel: $RELEASE_CHANNEL
+- version: $RELEASE_VERSION
+- R2 metadata: $public_origin/$RELEASE_CHANNEL/latest/metadata.json
+- E2E report: $public_origin/$RELEASE_CHANNEL/versions/$RELEASE_VERSION/report.zip
+- mac signed/notarized: $RELEASE_SIGNED
+- windows signed: false
+- branch: $BRANCH_NAME
+- commit: $GITHUB_SHA
+
+See [CHANGELOG.md](https://github.com/${GITHUB_REPOSITORY}/blob/$VERSION_TAG/CHANGELOG.md) for the full release notes.
+
+This stable release ships mac arm64 DMG/update ZIP, Windows x64 NSIS installer assets, checksums, updater feed files, and a zipped packaged e2e spec report. Linux AppImage packaging remains optional through the stable Linux lane.
+EOF
+echo "notes_file=$notes_file" >> "$GITHUB_OUTPUT"