Populates the tarball.mirror field reserved in MANIFEST v2 and wires
setup.sh to fall back to the mirror when codeload.github.com returns
either a network error or bytes whose sha256 no longer matches the
manifest — the exact failure mode that has hit GitHub's git archive
toolchain at least twice (2023, 2024). Without this, the release gate
would hard-fail on the next codeload regeneration until a maintainer
manually rewrote the pinned checksums.
- scripts/upload-init-corpus-mirror.sh: idempotent maintainer tool that
downloads each fixture from primary, verifies sha256 against MANIFEST,
and uploads as <sha256>.tar.gz to the init-corpus-v1 release. Refuses
to upload on sha mismatch so drifted bytes can never reach the mirror.
- tests/fixtures/init-corpus/setup.sh: primary→mirror fallback via a new
download_and_verify helper. Emits loud WARNING lines on fallback so
CI surfaces codeload drift even when the job stays green. Adds
AQE_CORPUS_MANIFEST_PATH and AQE_CORPUS_FORCE_MIRROR env overrides for
the mirror test workflow.
- .github/workflows/init-corpus-mirror-test.yml: exercises both the
mirror-reachability path (FORCE_MIRROR=1) and the fallback-on-drift
path (local python3 http.server serves bogus primary bytes). Runs on
every PR that touches the corpus and weekly on Mondays.
- MANIFEST.json: populates tarball.mirror for tiny-ts, mid-ts, and
multi-lang-real with the now-uploaded release assets.
Closes#411
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Dragan Spiridonov