An upstream release ping opened a PR and stopped there, waiting for a
maintainer, while the daily sweep merged the identical pins unattended at
06:17 UTC. That gap is what upstreams see: zbcoding dropped the Notify
FlatPark step from ImpastoPaint's release job because "each ping opens an
update PR that only their side can merge, and nothing about their setup
suggests those merges are automatic".
Merge it here on the daily sweep's terms, with two things the sweep cannot
be as strict about:
- the diff must be exactly the pinged app's <id>.yml / <id>.metainfo.xml,
since push mode knows which app it asked for (the sweep can only require
"some app's manifest or metainfo");
- the payload was already unpacked with the app's own apply_extra.sh two
steps up, before the PR was opened at all.
Also install appstreamcli: update-pins validates upstream's release notes
before writing a <release> into the metainfo, but silently skips that when
the validator is missing, and this job now merges those notes unattended.
Same AUTO_MERGE_PINS kill switch as the sweep rather than a second variable,
the same post-merge publish dispatch (a GITHUB_TOKEN push triggers no
workflow), and the same cleanup of the orphaned pr-checks run left behind by
--delete-branch.
No per-app opt-in: the sweep already merges every app's pins unattended, so
gating push mode per app would only delay the same bytes by a day.
Co-authored-by: Claude Opus 5 <[email protected]>
Unauthenticated /release spam could burn the PAT's 5000 req/h GitHub
quota, since every request with a valid app_id costs one authenticated
release check. Add Workers rate-limiting bindings checked before any
parsing or GitHub calls: 5/min per source IP, plus a 30/min whole-
endpoint cap that keeps even a multi-IP flood under the quota.
Counters are per Cloudflare location and eventually consistent — a
damper, not an accounting system.
Co-Authored-By: Claude Fable 5 <[email protected]>
Upstream CI can now notify FlatPark the moment a release is published,
instead of waiting for the daily cron:
- release-dispatch.yml: fires on repository_dispatch (app-release),
recomputes pins for that one app only, opens a focused PR on its own
auto/release-<app-id> branch. Per-app concurrency; no supersede (a
single-app diff is never a superset of anything).
- update-check.yml stays the daily full-sweep safety net; its supersede
step now also closes auto/release-* PRs once the batch covers them.
- workers/release-hook/: Cloudflare Worker for hooks.flatpark.org/release.
Bridges unauthenticated pings from upstream CI (flatpark/publish-action)
to an authenticated repository_dispatch: validates the app against
catalog.json sourceUrl and the real GitHub release, then dispatches with
a repo-scoped PAT held only as a Worker secret.
- gen-apps-json.sh: catalog.json entries now carry sourceUrl (public info
already shown on app pages) — the Worker's lookup source, since the
per-app apps/<id>.json files are stripped from the published site.
- docs/publish-action-launch.md: remaining manual launch steps.
The action itself lives at github.com/flatpark/publish-action (v1.0.0, v1).
Co-Authored-By: Claude Fable 5 <[email protected]>
