Skip to content

Commit 6f593da

Browse files
authored
Merge ci/release-safety-main: draft-first promote + per-name asset verification, valkey-identity consumer-verify on main
PR CI fully green (both busbar legs + destructive-wipe test). Local behavioral proof: actionlint clean; embedded verifier proven against six synthetic asset sets plus the truncated-manifest floor. consumer-verify carries the valkey identity, not the retired redis one, and pins the shared workflow to an immutable SHA.
2 parents 32f07cf + c807923 commit 6f593da

3 files changed

Lines changed: 279 additions & 70 deletions

File tree

.github/release-targets.json

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"_comment": [
3+
"THE PLATFORM LIST, IN EXACTLY ONE PLACE.",
4+
"",
5+
"release.yml's `targets` job reads this file and emits TWO things from it: the build matrix the",
6+
"`store-plugin` job runs, and the exact set of release-asset filenames that matrix is contractually",
7+
"obliged to produce. `verify-assets` asserts every one of those names is present on the DRAFT",
8+
"release before promoting it, so adding or removing a platform is ONE edit here and its",
9+
"verification comes along automatically.",
10+
"",
11+
"WHY A NAME AND NOT A COUNT. busbar v1.5.3 published FIVE assets where SEVEN were expected:",
12+
"aarch64-apple-darwin and x86_64-unknown-linux-gnu were both missing, which is Apple Silicon Mac",
13+
"and x86_64 Linux, the two most common platforms there are. The guard of the day asserted",
14+
"`assets != 0`, which a five-asset release passes comfortably. A COUNT CAN NEVER SEE A MISSING",
15+
"PLATFORM; ONLY A NAME CAN. And a hardcoded expected-names list inside the verifier would just be",
16+
"a SECOND place to forget a platform, which is the same defect one level up -- hence one file,",
17+
"two derived outputs.",
18+
"",
19+
"FIELDS, all of which are inputs to the SAME build steps, never selectors for different ones:",
20+
" target the rust target triple. The published asset is always",
21+
" <asset_prefix>-<version>-<target>.tar.gz -- plugin-pack writes a tarball on every",
22+
" platform, Windows included.",
23+
" os the GitHub-hosted runner label that builds this target natively.",
24+
" libext the cdylib extension this platform produces (so / dylib / dll).",
25+
" libprefix the cdylib filename prefix ('lib' everywhere except MSVC)."
26+
],
27+
"asset_prefix": "busbar-store-valkey",
28+
"targets": [
29+
{
30+
"target": "x86_64-unknown-linux-gnu",
31+
"os": "ubuntu-latest",
32+
"libext": "so",
33+
"libprefix": "lib"
34+
},
35+
{
36+
"target": "aarch64-unknown-linux-gnu",
37+
"os": "ubuntu-24.04-arm",
38+
"libext": "so",
39+
"libprefix": "lib"
40+
},
41+
{
42+
"target": "x86_64-apple-darwin",
43+
"os": "macos-latest",
44+
"libext": "dylib",
45+
"libprefix": "lib"
46+
},
47+
{
48+
"target": "aarch64-apple-darwin",
49+
"os": "macos-latest",
50+
"libext": "dylib",
51+
"libprefix": "lib"
52+
},
53+
{
54+
"target": "x86_64-pc-windows-msvc",
55+
"os": "windows-latest",
56+
"libext": "dll",
57+
"libprefix": ""
58+
}
59+
]
60+
}
Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: consumer-verify
2+
3+
# Does what this repo PUBLISHED actually work when a user gets it?
4+
#
5+
# Every other workflow here reports on itself. ci.yml proves the code builds and its tests pass.
6+
# release.yml's verify-assets proves the upload step believed it succeeded, asserted from inside the
7+
# run that did the uploading. None of that is evidence about the artifact a user downloads, and the
8+
# gap is not theoretical: webrequest-hook v1.0.4 published as a zero-asset phantom, and
9+
# headroom-hook's published bundle could not boot the gateway because its shipped config used shapes
10+
# busbar 1.5.3 retired. Both were green everywhere. Nothing anywhere noticed.
11+
#
12+
# The logic lives in ONE place for the whole fleet, exactly like plugin-ci.yml, so a fix reaches
13+
# every plugin at once instead of being copied ten times and drifting nine.
14+
#
15+
# WHY BOTH TRIGGERS. release: published catches a broken publish immediately, and it fires whether or
16+
# not the release workflow itself finished happy - which matters, because a verifier that only runs
17+
# when everything already worked is not a verifier. The daily schedule catches ROT: an artifact that
18+
# published fine can stop working later when nothing about it changed (a bundle that no longer boots
19+
# against a newer engine, an asset deleted by hand, a release un-flagged as latest). A
20+
# publish-time-only check structurally cannot see that class.
21+
on:
22+
release:
23+
types: [published]
24+
schedule:
25+
- cron: "3 10 * * *"
26+
workflow_dispatch:
27+
inputs:
28+
version:
29+
description: "Version to verify (e.g. 1.0.4). Empty means the newest published release."
30+
required: false
31+
type: string
32+
33+
permissions:
34+
contents: read
35+
issues: write
36+
actions: read
37+
38+
jobs:
39+
consumer:
40+
# Pinned to an IMMUTABLE ref, never @dev: the verdict must not change because the shared
41+
# workflow moved. This SHA is the tip of plugin-consumer-verify.yml as of busbar v1.5.4
42+
# (the file is not carried by the v1.5.4 tag itself, so the commit SHA is the pin).
43+
uses: GetBusbar/busbar/.github/workflows/plugin-consumer-verify.yml@ceb7104a4cdb06f3bba20b68c6c1a76fac2215f7
44+
with:
45+
version: ${{ inputs.version || '' }}
46+
# Read off the PUBLISHED artifact, not guessed from the crate name: the filename prefix and the
47+
# manifest name genuinely differ across this fleet (the store repos drop the trailing -plugin
48+
# that the auth repos keep, and store-valkey publishes as busbar-store-redis).
49+
# THE VALKEY IDENTITY, NOT THE RETIRED REDIS ONE. release.yml packs
50+
# `--name busbar-store-valkey-plugin --alias valkey` and uploads
51+
# busbar-store-valkey-<ver>-<target>.tar.gz, which is the stem busbar itself resolves
52+
# (crates/busbar/src/config/mod.rs STORE_MODULE_VALKEY_ASSET_STEM). These three inputs were
53+
# still naming the `redis` identity that v1.0.4 retired, so the consumer check was fetching
54+
# an asset that has not existed since -- a gate aimed at a name nothing publishes cannot
55+
# report on the artifact users actually get.
56+
asset_prefix: busbar-store-valkey
57+
plugin_name: busbar-store-valkey-plugin
58+
plugin_alias: valkey
59+
plugin_kind: store
60+
# EMPTY, and correct: this repo publishes exactly one kind of artifact, a signed
61+
# busbar-store-*.tar.gz per target (see release.yml's `plugin-dist/*.tar.gz` upload) -- no
62+
# container bundle anywhere in this repo's workflows. `bundle_image: ""` makes the shared
63+
# workflow declare the runnable-bundle boot check NOT-APPLICABLE rather than silently skip it.
64+
bundle_image: ""
65+
bundle_env: ""
66+
secrets: inherit

0 commit comments

Comments
 (0)