mirror of
https://github.com/esengine/DeepSeek-Reasonix.git
synced 2026-11-11 01:51:33 -10:00
SivanCola
c45b168a87
Problem: Stable releases rebuild, resign, and rerun broad validation after publication failures or unrelated main-v2 changes, making recovery slow and fragile. Root cause: Build, signing, acceptance, and publication were coupled to one run. Candidate identity and evidence could not be verified across runs, platform scheduling introduced unrelated waits, and control-plane faults were found after expensive jobs started. Fix: Introduce immutable, provenance-bound release candidates; split preparation, promotion, recovery, and public verification; share CLI/npm binaries; decouple Desktop platform scheduling; reuse one Certum session; add a publication ledger; move release-control checks ahead of builds; route CI by affected surface; and document the new workflow. Verification: - node --test scripts/*.test.mjs npm/*.test.mjs - bash scripts/validate-release-control-plane.test.sh - bash scripts/validate-release-candidate-source.test.sh - bash scripts/verify-release-push-ci.test.sh - bash scripts/release-stable.test.sh - bash scripts/release-workflows.test.sh - actionlint .github/workflows/*.yml - go run ./tools/repolint - go vet ./... - (cd desktop && go vet ./...) - go test ./internal/agent ./internal/control ./tools/desktopinventory - (cd desktop && go test ./...)
27 lines
1.2 KiB
Bash
Executable File
27 lines
1.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Dispatch publication or recovery for a previously sealed release candidate.
|
|
# Tag creation belongs to the approved protected workflow, after provenance and
|
|
# artifact bytes have been verified.
|
|
set -euo pipefail
|
|
|
|
if [ "$#" -lt 1 ] || [ "$#" -gt 2 ] || [[ ! "$1" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)-[0-9a-f]{12}-[0-9a-f]{12}$ ]]; then
|
|
echo "usage: scripts/release-stable.sh CANDIDATE_ID [publish|recover]" >&2
|
|
exit 2
|
|
fi
|
|
|
|
candidate_id="$1"
|
|
operation="${2:-publish}"
|
|
case "$operation" in publish | recover) ;; *) echo "operation must be publish or recover" >&2; exit 2 ;; esac
|
|
repository="${RELEASE_REPOSITORY:-esengine/DeepSeek-Reasonix}"
|
|
|
|
for command in gh jq; do
|
|
command -v "$command" >/dev/null || { echo "required command is unavailable: $command" >&2; exit 2; }
|
|
done
|
|
|
|
payload="$(jq -cn --arg ref main-v2 --arg candidate_id "$candidate_id" --arg operation "$operation" \
|
|
'{ref: $ref, inputs: {candidate_id: $candidate_id, operation: $operation}}')"
|
|
gh api -X POST "repos/$repository/actions/workflows/release-promote.yml/dispatches" --input - <<<"$payload"
|
|
|
|
echo "Dispatched $operation for $candidate_id on protected main-v2."
|
|
echo "The workflow verifies the sealed candidate, then requests one release approval."
|