Repository navigation
ci(release): publish only the package job's artifacts - #434
Merged
Merged
Conversation
The release, repository, and AUR jobs downloaded every artifact in the run. The repository job uploads a bundle that holds re-signed copies of the RPMs under the same file names. A release job that runs after that upload, such as a re-run, would publish those copies over the originals, because action-gh-release overwrites same-named assets by default, and they would no longer match checksums.txt. Releases have avoided this only because the release job finished before the repository bundle existed. Download only the package job's tar, deb, rpm, and manifest artifacts, and upload an explicit list of release files that fails when one is missing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
release,package-repos, andaurjobs inbuild-packages.ymldownload every artifact in the run. The
package-reposjob uploads awayscriber-<version>-reposbundle that holds re-signed copies of the RPMsunder the same file names. When the
releasejob downloads after that upload,for example on a re-run,
files: dist/**/*picks up both copies. Becauseaction-gh-releaseoverwrites same-named assets by default, the published RPMcan then be the re-signed copy, which no longer matches
checksums.txt.Releases have avoided this so far only because of timing. In the v0.9.28 run,
releasefinished at 10:07:27 and the repository bundle was uploaded close to10:08:08.
Changes
pattern: wayscriber*-<version>-{tar,deb,rpm,manifest}.dist/*.tar.gz,dist/*.deb,dist/*.rpm,dist/checksums.txt,dist/manifest.json) withfail_on_unmatched_files: true. This list matches the v0.9.28 releaseassets.
Validation
minimatch, whichdownload-artifactuses. Itmatches the seven package artifacts and excludes
wayscriber-<version>-repos.patternandmerge-multipleagainst thedownload-artifact@v8action metadata, and
filesandfail_on_unmatched_filesagainstaction-gh-release@v3.git diff --checkis clean.This workflow runs only on tags, so the next release is its first real run.