mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
Alberto Schiabel
08f7072110
## Summary Permanently stops the recurring *"release published with zero assets → install/upgrade 404s"* outage (https://github.com/ComposioHQ/composio/issues/3408, https://github.com/ComposioHQ/composio/issues/3269; regressions of https://github.com/ComposioHQ/composio/issues/2625 and https://github.com/ComposioHQ/composio/issues/1820 — 3 of the last 5 stable releases shipped empty). **Root cause:** a concurrent-writer race. On a CLI version bump, `changesets/action` creates an empty `@composio/cli@x.y.z` GitHub Release in seconds, then the slower `build-cli-binaries.yml` fails its `gh release create` because the release already exists — so binaries never attach. > 🥞 **Stacked on #3415** (`pi/exclude-cli-ts-release-42161920`), which removes the *second writer* (changesets no longer creates CLI releases). Review/merge #3415 first; this PR targets that branch. This PR hardens the now-sole writer so a *partial* build can't publish either, and fixes the monitoring that hid the failure. ## What changed (`build-cli-binaries.yml` + canary) - **Draft → verify → publish.** The release is built as a **draft**, then a gate asserts all 6 canonical assets are present **and** `state == "uploaded"` (loud `::error::` + fail otherwise), and only the final step flips it to published. Drafts fire no `release: published` event and are excluded from `/releases/latest`, so no install.sh / Homebrew / redirect consumer can observe an incomplete release. - **`fail-fast: false`** on the build matrix → a single platform failure can never publish a partial set (`needs.build.result` is `success` only if all legs pass). - **Per-tag job-level `concurrency`** so re-runs / quick pushes can't interleave uploads on the same tag, without serializing unrelated betas. - **Beta-safe:** `--prerelease` is set on the draft so betas stay prereleases through the publish flip. - **`promote-stable` guard** uses `gh release view --json isDraft` (the REST tags endpoint 404s on drafts) to resume an existing draft but refuse an already-published tag. - **Least privilege:** workflow defaults to `contents: read`; only the release job opts up to `contents: write`. - **Canary fix** (`cli.install-health-check.yml`): install the newest stable **pinned** tag (`npm view @composio/cli version`) instead of the asset-aware no-arg flow, which self-heals to the last good release and kept the canary green through every outage. ## Idempotency note Re-running a run that failed **before publish** is safe (reuse draft + `--clobber`). An already-**published** tag is refused, not mutated — by design. ## Testing - Extended `test/release-workflow.test.ts` (run via `pnpm test:release-workflow`) to lock in: draft→verify→publish ordering, `fail-fast: false`, per-tag concurrency, preserved `--prerelease`, and the pinned-tag canary. ✅ passes. - `shellcheck` clean on the new `run:` scripts; YAML validated. `actionlint` runs in CI. - Runtime verification of the full green path happens on the next release CI run. ## Out of scope (deferred to their own PRs) Per reviewer consensus, these are real but *not this bug*: a per-release npm↔GitHub asset auditor (needs a grace window), the Homebrew trigger constraint (folds into #3355), `composio upgrade` missing-asset back-off (https://github.com/ComposioHQ/composio/issues/3269), and a rollback runbook. --------- Co-authored-by: Rahul Tarak <cryogenicplanet@gmail.com>
49 lines
1.8 KiB
Bash
Executable File
49 lines
1.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Loud failure gate: assert the full canonical asset set is attached to the release AND fully
|
|
# uploaded (state == "uploaded"). An asset can appear in the listing while still processing,
|
|
# which is exactly how a release ends up serving 404s — so require state == "uploaded", with a
|
|
# bounded retry while uploads settle.
|
|
#
|
|
# Inputs (env): RELEASE_TAG, GH_TOKEN
|
|
# VERIFY_ATTEMPTS / VERIFY_SLEEP_SECONDS (optional, for fast tests)
|
|
set -euo pipefail
|
|
|
|
# Keep this list in lock-step with the build matrix in build-cli-binaries.yml (4 platforms)
|
|
# plus the skill bundle and checksums. Adding a platform to the matrix must extend this list.
|
|
expected=(
|
|
composio-linux-x64.zip
|
|
composio-linux-aarch64.zip
|
|
composio-darwin-x64.zip
|
|
composio-darwin-aarch64.zip
|
|
composio-skill.zip
|
|
checksums.txt
|
|
)
|
|
|
|
attempts="${VERIFY_ATTEMPTS:-10}"
|
|
sleep_seconds="${VERIFY_SLEEP_SECONDS:-15}"
|
|
|
|
for attempt in $(seq 1 "$attempts"); do
|
|
# Single snapshot per attempt — querying names and state separately would open a
|
|
# time-of-check/time-of-use gap in the very gate meant to close one.
|
|
payload=$(gh release view "$RELEASE_TAG" --json assets)
|
|
mapfile -t uploaded < <(jq -r '.assets[] | select(.state == "uploaded") | .name' <<<"$payload" | sort)
|
|
|
|
missing=()
|
|
for want in "${expected[@]}"; do
|
|
printf '%s\n' "${uploaded[@]}" | grep -qxF "$want" || missing+=("$want")
|
|
done
|
|
|
|
if [[ ${#missing[@]} -eq 0 ]]; then
|
|
echo "✅ All ${#expected[@]} expected assets present and uploaded."
|
|
exit 0
|
|
fi
|
|
|
|
echo "Attempt ${attempt}/${attempts} — missing or not-yet-uploaded: ${missing[*]}"
|
|
if [[ "$attempt" -eq "$attempts" ]]; then
|
|
echo "::error::Release $RELEASE_TAG is incomplete — missing or not uploaded: ${missing[*]}"
|
|
exit 1
|
|
fi
|
|
sleep "$sleep_seconds"
|
|
done
|