CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-21 04:10:47 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: add production runtime RC release channel

Browse Source 
Publish signed prerelease artifacts from v2.0.0-rc.* tags, bind bootstrap trust to the immutable RC tag, make missing-release errors actionable, and install the six public skills from the canonical subpath.
This commit is contained in:
Sinabina
2026-07-20 16:51:59 -07:00
parent d6ef673e4d
commit b0047cc525
84 changed files with 367 additions and 140 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/scripts/create-runtime-release-manifest.mjs
+12 -4
View File
@@ -2,11 +2,19 @@
import fs from "node:fs/promises";
import path from "node:path";
const [directory, repository = process.env.GITHUB_REPOSITORY, version = "2.0.0"] = process.argv.slice(2);
const [
directory,
repository = process.env.GITHUB_REPOSITORY,
version = "2.0.0",
releaseTag = `v${version}`,
] = process.argv.slice(2);
if (!directory || !repository) {
console.error("Usage: create-runtime-release-manifest.mjs <artifact-dir> <owner/repo> [version]");
console.error("Usage: create-runtime-release-manifest.mjs <artifact-dir> <owner/repo> [version] [release-tag]");
process.exit(2);
}
if (!/^v\d+\.\d+\.\d+(?:-rc\.\d+)?$/.test(releaseTag)) {
throw new Error(`Invalid runtime release tag: ${releaseTag}`);
}
const targets = [
"darwin-arm64",
@@ -35,8 +43,8 @@ const capabilityComponents = {
ios: ["ios"],
};
const commonComponents = ["core", "browser-code", "browser-headless", "browser-visible", "design", "diagram", "pdf"];
const release = `https://github.com/${repository}/releases/download/v${version}`;
const certificateIdentity = `https://github.com/${repository}/.github/workflows/release-artifacts.yml@refs/tags/v${version}`;
const release = `https://github.com/${repository}/releases/download/${releaseTag}`;
const certificateIdentity = `https://github.com/${repository}/.github/workflows/release-artifacts.yml@refs/tags/${releaseTag}`;
const targetRecords = {};
for (const target of targets) {
.github/workflows/release-artifacts.yml
+7 -3
View File
@@ -2,7 +2,9 @@ name: Release runtime artifacts
on:
push:
tags: [v2.0.0]
tags:
- v2.0.0
- v2.0.0-rc.*
workflow_dispatch:
permissions:
@@ -170,7 +172,7 @@ jobs:
- uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
- name: Create strict six-target manifest
run: node .github/scripts/create-runtime-release-manifest.mjs release-output "$GITHUB_REPOSITORY" 2.0.0
run: node .github/scripts/create-runtime-release-manifest.mjs release-output "$GITHUB_REPOSITORY" 2.0.0 "$GITHUB_REF_NAME"
- name: Checksum and keyless-sign manifest
run: |
@@ -188,11 +190,13 @@ jobs:
- name: Publish immutable release assets
env:
GH_TOKEN: ${{ github.token }}
PRERELEASE_FLAG: ${{ contains(github.ref_name, '-rc.') && '--prerelease' || '' }}
run: |
set -euo pipefail
gh release create "$GITHUB_REF_NAME" \
--verify-tag \
--title "GStack runtime 2.0.0" \
$PRERELEASE_FLAG \
--title "GStack runtime $GITHUB_REF_NAME" \
--notes "Signed optional runtime artifacts for the six portable GStack skills." \
release-output/*
shell: bash