dtourolle
5d02628689
🏗️ Build and Test JellyTau / Run Tests (pull_request) Successful in 15m1s
🏗️ Build and Test JellyTau / Supply Chain (pull_request) Successful in 42s
Traceability Validation / Check Requirement Traces (pull_request) Successful in 10s
🏗️ Build and Test JellyTau / Android Compile Check (pull_request) Successful in 4m6s
Two defects found while preparing v0.9.2, both of which had been shipping for months without anything to notice them by. **Every release note was the same 1,050 bytes.** All 35 releases from v0.0.1 to v0.9.1 published identical generic install instructions whose "What's New" section read "See CHANGELOG.md" -- a link that does not resolve from a release page. A reader learned nothing about what changed in any release the project has ever made. The body now comes from the `## <version>` section of CHANGELOG.md, and a missing section fails the release: notes that say nothing are worse than a build that waits for a maintainer to write two sentences. The 35 published bodies have been backfilled from the changelog via the tea CLI. This also corrects something introduced two commits ago. That change generated the body from `bun run release:notes`, which CLAUDE.md is explicit about -- its output is "a reviewed draft, not a final changelog". Publishing it unreviewed proved the point immediately: the v0.9.1..HEAD range contains a repo-wide prettier sweep, so every file in src/ counted as changed, their TRACES resolved to nearly the whole matrix, and the draft claimed the release had added the entire application. The script now skips cosmetic commits (chore(format), chore(deps), style) and reports how many rather than silently returning a smaller set, but it stays a local drafting tool. **Every release from v0.1.0 to v0.8.2 shipped every Windows installer ever built.** src-tauri/target/*/release/bundle/ is not versioned, cargo never cleans it, and the runner reuses the target directory -- so the copy step's bundle/**/*-setup.exe glob collected the lot. v0.8.2 carried sixteen installers, thirteen of them stale; v0.5.0 offered users a download list going back to 0.1.0. Eight months, and nothing to notice it by: the upload loop reported success, the files were real, and the page looked busy rather than wrong. It stopped only because an unrelated cargo cache change wiped the runner's target dir, so it was dormant, not fixed. Both desktop builds now remove the bundle directory before building, so a stale file cannot exist to be copied. Filtering the copy by version would have hidden it instead. The Linux job gets the same treatment: it was never hit only because Linux packaging is newer, and the glob is identical. scripts/check-release-artifacts.sh is the backstop for whatever reintroduces one by a route nobody predicted. It runs before the SBOM, the checksums and the upload -- all of which describe the file set, so a stale artifact has to be caught before it is hashed and published as part of the release. Verified against a reconstruction of the real v0.8.2 accumulation. DR-219, DR-220, UT-210.
104 lines
3.4 KiB
Bash
Executable File
104 lines
3.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Refuse to publish a release whose artifacts are not all from this release.
|
|
#
|
|
# TRACES: | DR-220
|
|
#
|
|
# ./scripts/check-release-artifacts.sh <version> <dir> [<dir>...]
|
|
#
|
|
# e.g.
|
|
# ./scripts/check-release-artifacts.sh v0.9.2 artifacts/linux artifacts/windows
|
|
#
|
|
# ## The defect this exists for
|
|
#
|
|
# Every JellyTau release from v0.1.0 to v0.8.2 shipped every Windows installer
|
|
# ever built. `src-tauri/target/*/release/bundle/` is not versioned, cargo never
|
|
# cleans it, and the CI runner reuses the target directory between builds — so
|
|
# the copy step's `bundle/**/*-setup.exe` glob collected the whole history. By
|
|
# v0.8.2 that was sixteen installers, thirteen of them stale. v0.5.0 offered
|
|
# users a download list going back to 0.1.0.
|
|
#
|
|
# Nobody noticed for eight months. There was nothing to notice with: the upload
|
|
# loop reported success, the assets were real files, and the release page looked
|
|
# busy rather than wrong.
|
|
#
|
|
# The builds now clear the bundle directory first, which removes the cause. This
|
|
# is the backstop for the next thing that reintroduces a stale file by a route
|
|
# nobody predicted — a cached directory, a restored artifact, a hand-copied fix.
|
|
#
|
|
# ## What it checks
|
|
#
|
|
# Every file whose name embeds a semantic version must embed *this* version.
|
|
# Files with no version in the name (jellytau-release.apk, jellytau.exe,
|
|
# SHA256SUMS, latest.json) are accepted: they are produced fresh each build and
|
|
# have no version to disagree with.
|
|
|
|
set -euo pipefail
|
|
|
|
if [ "$#" -lt 2 ]; then
|
|
echo "usage: $0 <version> <dir> [<dir>...]" >&2
|
|
exit 2
|
|
fi
|
|
|
|
VERSION_RAW="$1"
|
|
shift
|
|
# Accept the tag form (v0.9.2) or the bare form (0.9.2).
|
|
VERSION="${VERSION_RAW#v}"
|
|
|
|
echo "🔎 Checking release artifacts are all version ${VERSION}…"
|
|
|
|
FOUND=0
|
|
STALE=0
|
|
UNVERSIONED=0
|
|
|
|
for dir in "$@"; do
|
|
if [ ! -d "$dir" ]; then
|
|
echo " (no $dir — skipping)"
|
|
continue
|
|
fi
|
|
|
|
# -print0/read -d '' so a filename with a space cannot split into two.
|
|
while IFS= read -r -d '' file; do
|
|
name="$(basename "$file")"
|
|
FOUND=$((FOUND + 1))
|
|
|
|
# First x.y.z in the filename, if any.
|
|
embedded="$(printf '%s' "$name" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)"
|
|
|
|
if [ -z "$embedded" ]; then
|
|
UNVERSIONED=$((UNVERSIONED + 1))
|
|
continue
|
|
fi
|
|
|
|
if [ "$embedded" != "$VERSION" ]; then
|
|
echo " ❌ $name carries version $embedded"
|
|
STALE=$((STALE + 1))
|
|
fi
|
|
done < <(find "$dir" -type f -print0)
|
|
done
|
|
|
|
echo ""
|
|
echo " $FOUND file(s) checked; $UNVERSIONED carry no version in the name."
|
|
|
|
if [ "$FOUND" -eq 0 ]; then
|
|
echo "❌ No artifacts found at all. A release with no files is a failed build," >&2
|
|
echo " not an empty one." >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [ "$STALE" -gt 0 ]; then
|
|
echo ""
|
|
echo "❌ $STALE artifact(s) belong to a different version than ${VERSION}." >&2
|
|
echo "" >&2
|
|
echo " This is how every release from v0.1.0 to v0.8.2 came to ship its" >&2
|
|
echo " predecessors' Windows installers: src-tauri/target/*/release/bundle/" >&2
|
|
echo " is never cleaned and the runner reuses it, so a glob picks up" >&2
|
|
echo " whatever was left behind." >&2
|
|
echo "" >&2
|
|
echo " The builds clear that directory first, so seeing this means a stale" >&2
|
|
echo " file arrived by some other route. Find it before publishing — do not" >&2
|
|
echo " delete the file and re-run." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "✅ Every versioned artifact is ${VERSION}."
|