Files
nexu-io__open-design/.github/scripts/release/publish-beta-metadata.ps1
PerishFire 8f6cdaaba1 Harden release-beta-s self-hosted beta lane (#3641)
* Fix Windows smoke launcher payload layout

* Harden release-beta-s runner probe

* Use cmd shell for release-beta-s probe

* Add win beta build script for self-hosted lane

* Keep release-beta-s checkout lightweight

* Use explicit local beta version for release-beta-s

* Install dependencies in beta build script

* Repair Electron dist before Windows beta build

* Add release-beta-s timings and diagnostics

* Polish release-beta-s observability guardrails

* Trace tools-pack cache materialization

* Reuse materialized workspace build cache

* Trace Windows packaging segments

* Trace Windows archive process details

* Reuse installer unpacked materialization

* Preserve reusable Windows unpacked projection

* Add fast smoke telemetry for self-hosted beta

* Cache Windows archive outputs for beta lane

* Tighten fast Windows smoke lane

* Scope Windows beta artifact reporting by target

* Clean stale Windows target artifacts

* Wire Windows Authenticode signing

* Expose self-hosted beta validation modes

* Add core Windows smoke profile

* Decouple core smoke from updater fixture version

* Trace Windows smoke lifecycle steps

* Skip unpacked materialization on NSIS cache hit

* Add Nexu S3 beta publisher

* Harden self-hosted Windows beta lane

* Use Windows PowerShell for publish probe

* Run publish probe via repo script

* Require explicit self-hosted S3 public origin

* Run real installer acceptance for external feeds

* Skip ready-prompt checks for external feeds

* Relax optional self-hosted update inputs

* Tolerate BOM in self-hosted publish probe

* Converge self-hosted beta metadata and signing flow

* Run self-hosted beta metadata prep on the runner lane

* Use Windows PowerShell for self-hosted beta metadata checks

* Bypass execution policy in self-hosted beta metadata checks

* Split self-hosted beta metadata publish

* Suppress mc output in beta publish helpers

* Split Windows NSIS payload cache layers

* Require fresh tool dist metadata

* Preserve Windows overlay payload paths

* Default beta-s gate to core

* Optimize win beta packaging reuse

* simplify windows full smoke lifecycle

* preserve onboarding state after windows upgrade smoke

* fix windows tools-pack test portability

* recover stale tools-pack locks

* Allow auto signing fallback for beta builds

* Add self-hosted beta mac arm64 lane

* Quote self-hosted signing choices

* Run self-hosted beta metadata on mac lane

* Use shallow metadata checkout on self-hosted beta

* Use sparse beta metadata checkout

* Make mac release profile bash-compatible

* Allow file sparse metadata checkout

* Isolate self-hosted metadata checkout

* Clear sparse skip-worktree before mac build

* Isolate self-hosted mac build checkout

* Run self-hosted beta publish without aws cli

* Use unsigned beta prefix for mixed platform publish

* Sparse checkout self-hosted beta publish

* Publish mac beta platform before metadata

* Pass mac publish release profile

* Probe mac signing keychain import

* Expand mac signing preflight variants

* Use sudo keychain helper for self-hosted mac signing

* Route self-hosted mac codesign through sudo wrapper

* Normalize mac signing identity name

* Harden self-hosted mac notarization

* Optimize self-hosted mac release cache

* Fix mac signing helper cleanup

* Retry transient mac notarization uploads

* Keep mac notarization fail-fast

* Reduce mac symlink diagnostics noise

* Normalize self-hosted beta platform inputs

* chore: bump beta base version to 0.9.1

* chore: tune release tools-pack cache retention

* test: add temporary cache validation marker

* chore: key windows nsis base payload by content

* Revert "test: add temporary cache validation marker"

This reverts commit e8487bfd3e.

* chore: probe windows nsis payload cache before materializing

* chore: align self-hosted beta smoke modes

* chore: skip mac smoke report upload when disabled

* chore: default self-hosted beta to publish both platforms

* chore: make beta signing modes explicit

* Add release report artifacts and metatool metadata

* Fix Windows release report zip publishing

* Remove artifact handoff from release beta self-hosted lane

* Fix release beta merge follow-ups

* Fix release beta install regressions

* Restore web build dependencies

* Route Windows beta downloads through mirrors

* Use PowerShell 7 for Windows beta lane

* Fix release beta preflight gates

Generated-By: looper 0.9.4 (runner=fixer, agent=codex)

* Fix Windows beta smoke update reuse

Generated-By: looper 0.9.4 (runner=fixer, agent=codex)

* Fix release beta review follow-ups

* Refresh Nix pnpm dependency hashes

Generated-By: looper 0.9.4 (runner=fixer, agent=codex)

* Fix Windows signtool fallback resolution

* Reject stale beta platform manifests

* Validate beta platform manifest run identity

Generated-By: looper 0.9.4 (runner=fixer, agent=codex)

* Validate beta manifest commit identity

Generated-By: looper 0.9.4 (runner=fixer, agent=codex)

* Allow beta metadata publish reruns

Generated-By: looper 0.9.4 (runner=fixer, agent=codex)

* Build tools-pack fully in beta Windows bootstrap

Generated-By: looper 0.9.4 (runner=fixer, agent=codex)

* Emit r2 metadata for Windows beta publish

Generated-By: looper 0.9.4 (runner=fixer, agent=codex)

* Stabilize beta publish browser test

Generated-By: looper 0.9.4 (runner=fixer, agent=codex)

* Stabilize Windows beta metadata smoke test

Generated-By: looper 0.9.4 (runner=fixer, agent=codex)

* Restore multi-platform Vela CLI package

* Refresh Nix pnpm dependency hashes

Generated-By: looper 0.9.5 (runner=fixer, agent=codex)

---------

Co-authored-by: Looper <looper@noreply.github.com>
2026-06-05 03:00:55 +00:00

151 lines
5.2 KiB
PowerShell

param(
[string]$ManifestRoot = "",
[string]$ChannelPrefix = "beta",
[switch]$Publish
)
$ErrorActionPreference = "Stop"
. (Join-Path $PSScriptRoot "publish-beta-common.ps1")
$channel = Assert-SafePrefix $ChannelPrefix
if ([string]::IsNullOrWhiteSpace($ManifestRoot)) {
$ManifestRoot = Join-Path $env:RUNNER_TEMP "release-platform-manifests"
}
if (-not (Test-Path -LiteralPath $ManifestRoot)) {
throw "platform manifest root not found: $ManifestRoot"
}
$platformDefs = @(
[ordered]@{ key = "win"; label = "Windows x64"; enabled = $true }
)
$platforms = [ordered]@{}
$expectedPlatforms = @()
$readyPlatforms = @()
$failedPlatforms = @()
$releaseVersion = ""
$signed = $false
$githubInfo = $null
$assetVersionSuffix = ""
foreach ($def in $platformDefs) {
if (-not $def.enabled) {
continue
}
$expectedPlatforms += $def.key
$manifestPath = Join-Path $ManifestRoot "$($def.key).json"
if (-not (Test-Path -LiteralPath $manifestPath)) {
$platforms[$def.key] = [ordered]@{
enabled = $true
label = $def.label
status = "missing"
}
$failedPlatforms += $def.key
continue
}
$manifest = Read-JsonFile $manifestPath
$platforms[$def.key] = $manifest
$readyPlatforms += $def.key
if ([string]::IsNullOrWhiteSpace($releaseVersion)) {
$releaseVersion = [string]$manifest.releaseVersion
$signed = [bool]$manifest.signed
$assetVersionSuffix = if ($signed) { ".signed" } else { ".unsigned" }
$githubInfo = $manifest.github
} elseif ($releaseVersion -ne [string]$manifest.releaseVersion) {
throw "manifest releaseVersion mismatch: expected $releaseVersion but got $($manifest.releaseVersion)"
}
}
if ([string]::IsNullOrWhiteSpace($releaseVersion)) {
throw "no published platform manifests found under $ManifestRoot"
}
$versionParts = Get-BetaVersionParts $releaseVersion
$publicOrigin = Get-PublicOrigin
$versionPrefix = "$channel/versions/$releaseVersion$assetVersionSuffix"
$latestPrefix = "$channel/latest"
$releaseState = if ($readyPlatforms.Count -eq $expectedPlatforms.Count) { "complete" } elseif ($readyPlatforms.Count -gt 0) { "partial" } else { "failed" }
$latestMetadataUpdated = $releaseState -eq "complete"
$reportUrl = "$publicOrigin/$versionPrefix/report/"
$stateSource = Optional-Env "STATE_SOURCE"
if ([string]::IsNullOrWhiteSpace($stateSource)) {
$stateSource = if ([string]::IsNullOrWhiteSpace($env:GITHUB_RUN_ID)) { "beta local publish" } else { "$($env:GITHUB_WORKFLOW) workflow_dispatch input" }
}
$metadata = [ordered]@{
assetVersionSuffix = $assetVersionSuffix
baseVersion = $versionParts.baseVersion
betaNumber = $versionParts.betaNumber
betaVersion = $releaseVersion
channel = "beta"
expectedPlatforms = $expectedPlatforms
failedPlatforms = $failedPlatforms
generatedAt = [DateTime]::UtcNow.ToString("o")
github = if ($null -eq $githubInfo) { Get-GitHubReleaseInfo } else { $githubInfo }
platforms = $platforms
readyPlatforms = $readyPlatforms
releaseState = $releaseState
signed = $signed
stateSource = $stateSource
storage = [ordered]@{
latestMetadataUrl = "$publicOrigin/$latestPrefix/metadata.json"
latestMetadataUpdated = $latestMetadataUpdated
latestPrefix = $latestPrefix
publicOrigin = $publicOrigin
report = [ordered]@{
type = "directory"
url = $reportUrl
}
reportUrl = $reportUrl
reportZipUrl = $null
versionMetadataUrl = "$publicOrigin/$versionPrefix/metadata.json"
versionPrefix = $versionPrefix
}
version = 1
}
$metadataPath = Join-Path $ManifestRoot "metadata.json"
Write-JsonFile -Path $metadataPath -Value $metadata -Depth 10
New-Item -ItemType Directory -Force -Path (Join-Path $env:RUNNER_TEMP "release-metadata") | Out-Null
Write-JsonFile -Path (Join-Path $env:RUNNER_TEMP "release-metadata\metadata.json") -Value $metadata -Depth 10
Set-GitHubOutput "latest_metadata_updated" $latestMetadataUpdated
Set-GitHubOutput "metadata_url" $metadata.storage.latestMetadataUrl
Set-GitHubOutput "release_state" $releaseState
Set-GitHubOutput "report_url" $metadata.storage.reportUrl
Set-GitHubOutput "version_metadata_url" $metadata.storage.versionMetadataUrl
Set-GitHubOutput "version_prefix" $versionPrefix
if (-not $Publish) {
Write-Host "dry-run only; pass -Publish to upload beta metadata"
exit 0
}
$storageSession = $null
try {
$storageSession = Open-BetaStorageSession -StageRoot $ManifestRoot
Publish-StorageFile -Session $storageSession -Path $metadataPath -ObjectKey "$versionPrefix/metadata.json" -CacheControl "public, max-age=31536000, immutable"
if ($latestMetadataUpdated) {
Publish-StorageFile -Session $storageSession -Path $metadataPath -ObjectKey "$latestPrefix/metadata.json" -CacheControl "public, max-age=60, must-revalidate"
} else {
Write-Host "left $($metadata.storage.latestMetadataUrl) unchanged because releaseState=$releaseState"
}
if (-not [string]::IsNullOrWhiteSpace($env:GITHUB_STEP_SUMMARY)) {
@(
""
"## beta metadata publish"
""
"- releaseVersion: ``$releaseVersion``"
"- releaseState: ``$releaseState``"
"- latestMetadataUpdated: ``$latestMetadataUpdated``"
"- metadataUrl: ``$($metadata.storage.latestMetadataUrl)``"
) | Add-Content -Path $env:GITHUB_STEP_SUMMARY -Encoding utf8
}
} finally {
Close-BetaStorageSession -Session $storageSession
}