mirror of
https://github.com/esengine/DeepSeek-Reasonix.git
synced 2026-11-07 10:45:59 -10:00
SivanCola
c45b168a87
Problem: Stable releases rebuild, resign, and rerun broad validation after publication failures or unrelated main-v2 changes, making recovery slow and fragile. Root cause: Build, signing, acceptance, and publication were coupled to one run. Candidate identity and evidence could not be verified across runs, platform scheduling introduced unrelated waits, and control-plane faults were found after expensive jobs started. Fix: Introduce immutable, provenance-bound release candidates; split preparation, promotion, recovery, and public verification; share CLI/npm binaries; decouple Desktop platform scheduling; reuse one Certum session; add a publication ledger; move release-control checks ahead of builds; route CI by affected surface; and document the new workflow. Verification: - node --test scripts/*.test.mjs npm/*.test.mjs - bash scripts/validate-release-control-plane.test.sh - bash scripts/validate-release-candidate-source.test.sh - bash scripts/verify-release-push-ci.test.sh - bash scripts/release-stable.test.sh - bash scripts/release-workflows.test.sh - actionlint .github/workflows/*.yml - go run ./tools/repolint - go vet ./... - (cd desktop && go vet ./...) - go test ./internal/agent ./internal/control ./tools/desktopinventory - (cd desktop && go test ./...)
47 lines
1.4 KiB
Bash
Executable File
47 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
repo_root="$(git rev-parse --show-toplevel)"
|
|
root="$(mktemp -d "${TMPDIR:-/tmp}/reasonix-candidate-source-test.XXXXXX")"
|
|
cleanup() {
|
|
case "$root" in */reasonix-candidate-source-test.*) rm -rf -- "$root" ;; *) exit 1 ;; esac
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
remote="$root/remote.git"
|
|
work="$root/work"
|
|
git init -q --bare "$remote"
|
|
git init -q -b main-v2 "$work"
|
|
git -C "$work" config user.name test
|
|
git -C "$work" config user.email [email protected]
|
|
mkdir -p "$work/release-notes"
|
|
printf '{"releases":[]}\n' >"$work/release-notes/releases.json"
|
|
git -C "$work" add .
|
|
git -C "$work" commit -q -m base
|
|
cat >"$work/release-notes/releases.json" <<'JSON'
|
|
{"releases":[{"version":"1.2.3","channel":"stable","status":"reviewed"}]}
|
|
JSON
|
|
git -C "$work" add .
|
|
git -C "$work" commit -q -m notes
|
|
candidate="$(git -C "$work" rev-parse HEAD)"
|
|
git -C "$work" commit --allow-empty -q -m "unrelated later merge"
|
|
git -C "$work" remote add origin "$remote"
|
|
git -C "$work" push -q origin main-v2
|
|
|
|
(
|
|
cd "$work"
|
|
RELEASE_REMOTE=origin "$repo_root/scripts/validate-release-candidate-source.sh" 1.2.3 "$candidate"
|
|
)
|
|
|
|
git -C "$work" tag v1.2.3 "$candidate"
|
|
git -C "$work" push -q origin v1.2.3
|
|
if (
|
|
cd "$work"
|
|
RELEASE_REMOTE=origin "$repo_root/scripts/validate-release-candidate-source.sh" 1.2.3 "$candidate"
|
|
); then
|
|
echo "existing release identity unexpectedly passed candidate preparation" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "release candidate source tests: PASS"
|