refactor(release): simplify desktop distribution channels#10163
Conversation
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
789c488 to
7974266
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 79742669d0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1502c04a65
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Failure-Class: none
Failure-Class: FC-nonrecoverable-promotion
Failure-Class: FC-nonrecoverable-promotion
Failure-Class: FC-nonrecoverable-promotion
The canonical apply owner now stamps updates at the maximum of its UTC wall clock and the persisted captured_at and updated_at chronology anchors. This preserves strict MemoryItem validity when an apply host clock lags a persisted item, while retaining the persisted short-term TTL and existing retry/revision behavior. RED: BACKEND_UNIT_TEST_FILE_LIST=/tmp/omi-memory-apply-red.* bash backend/test.sh (1 failed, 6 passed; strict MemoryItem chronology validation failed with an earlier apply clock). GREEN: focused persisted apply regression (7 passed); tests/unit/test_ws_b_short_term_lifecycle.py via backend/test.sh 3x (28 passed each); 11 adjacent apply/lifecycle/model suites (all passed). Verification: black --line-length 120 --skip-string-normalization; scripts/pr-preflight --suggest; failure-class explain/validate; relevant no-service pre-push gates; git diff --check. Failure-Class: FC-split-mutation-authority
Failure-Class: FC-nonrecoverable-promotion
Failure-Class: FC-split-mutation-authority
Failure-Class: FC-nonrecoverable-promotion Reviewed-Findings: bound ephemeral Cloud Run IDs, separate Beta artifact schema names, route retained manifests under admin policy, and keep verifier fixtures stdlib-only.
Failure-Class: FC-nonrecoverable-promotion Policy: require trusted retained manifest fetch, exact beta/stable precondition, pointer-before-bridge ordering, and external appcast verification.
Failure-Class: FC-deployment-proof-gap Regression: request the tagged candidate URL while minting the IAM identity token for the canonical service audience.
Failure-Class: FC-nonrecoverable-promotion Review: retain doctor-compatible evidence identity and publish the beta-identity DMG on every static beta redirect surface.
Failure-Class: FC-nonrecoverable-promotion
Failure-Class: FC-deployment-proof-gap Regression: require all-traffic egress plus pre-creation Private Google Access validation for the production candidate probe.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cf154451b4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| gh workflow run desktop_promote_beta.yml --repo "$REPO" \ | ||
| -f release_tag="$RELEASE_TAG" \ | ||
| -f automatic=true | ||
| -f automatic=true \ | ||
| -f qualification_run_id="$GITHUB_RUN_ID" |
There was a problem hiding this comment.
When automatic qualification succeeds, this last step dispatches desktop_promote_beta.yml with the current run's $GITHUB_RUN_ID before the current workflow has actually completed. The promotion workflow immediately queries that run and requires .conclusion == success (.github/workflows/desktop_promote_beta.yml), but GitHub only reports a success conclusion after the source run is completed; gh workflow run only creates a workflow_dispatch event, so the promoted workflow can start while this run is still in_progress and fail the gate despite valid evidence. This leaves automatic beta promotion flaky/blocked whenever the dispatched workflow is scheduled before the qualifier run is finalized.
Useful? React with 👍 / 👎.
|
|
||
| - name: Preflight Omi Bot repository access | ||
| - name: Validate trusted qualification run for initial promotion | ||
| if: ${{ inputs.operation == 'promote' }} |
There was a problem hiding this comment.
Because the only step that checks CONFIRM == promote-stable is skipped when inputs.operation == 'repoint', a manual stable repoint can mutate the Stable pointer without satisfying the required typed confirmation. This matters for the new retained-manifest repoint path: even with CAS inputs, an operator who selects repoint accidentally or leaves the confirmation wrong still reaches Advance explicit stable pointer, bypassing the workflow's stated safety prompt.
Useful? React with 👍 / 👎.
cf15445 to
914bdd3
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 914bdd3e41
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if gh workflow run desktop_qualify_beta.yml --repo "$GITHUB_REPO" \ | ||
| -f release_tag="$CM_TAG" -f dispatch_key="$dispatch_key"; then | ||
| -f release_tag="$CM_TAG"; then |
There was a problem hiding this comment.
When main advances while Codemagic is building/smoking a candidate, this unqualified gh workflow run dispatch runs the qualification workflow at the repository default branch, not at $CM_TAG (the GitHub CLI manual's no---ref example runs at the remote default branch). The beta promotion gate then compares that run's .head_sha to the release tag SHA, so a valid candidate whose tag is no longer the current main tip fails promotion after qualification evidence is produced. Pass a ref that matches the tag/SHA or change the promotion trust check to validate the evidence/tag rather than the dispatch run's default-branch SHA.
Useful? React with 👍 / 👎.
1 participant
Summary
Simplifies Omi release distribution while closing the executable draft-PR blockers. The branch is rebased onto current
origin/mainand now includes the independently reviewed memory chronology fix that was blocking the broad backend CI lane.Beta and Stable remain two desktop distribution pointers over one immutable qualified manifest. The generalized release-record/ring system, Beta backend fleet/routing, nomination, emergency promotion, holds/receipts, and qualification-claim state are not restored.
Trust, deployment, and routing changes
.89upgrade,.70side-by-side, core journeys, soak, and same-manifest Stable promotion.main, use actual access-token expansion, retain exact lost-response pointer idempotency, accept retained qualified repoints, and verify exactly oneidentity=stableXML item with immutable version/build/enclosure/signature facts.environment=prod, deploy_targets=allrejects before checkout, cloud authentication, image publication, or mutation because transactional GKE/config rollback parity does not exist.environment=prod, deploy_targets=cloud-run-onlyis intentionally narrow: exact no-traffic tag, VPC Cloud Run Job known-audio gate with Cloud Run IAM plus Firebase auth, traffic snapshot/restore, and unconditional cleanup of the tag, Job, temporary invoker grant, and temporary service account. It performs no GKE mutation.gcp_backend_listen_helm.yml, pusher, llm-gateway, agent-proxy) remain their respective production paths and report checked-out HEAD identity with fresh-origin/mainancestry diagnostics.https://api.omi.me/; the startup function called bymain.dartvalidates the production API and agent WSS authority. It rejects old Beta/dev/staging/arbitrary overrides while development remains configurable.updated_atmonotonic under clock skew; receipt chronology cannot predate capture or grant freshness.Product invariants affected
Failure-Class: FC-nonrecoverable-promotion
Verification
test_sync_v2.py163 passed.actionlintfor changed release/deploy workflows andgit diff --check: passed.library_private_types_in_public_apiinformation message.APIClientRoutingTests: 60 passed.Qualification boundary
Source-built named-bundle T2/fault evidence and exact signed-artifact evidence are separate layers. Signed production binaries do not expose a local automation/fault interface. Before Stable promotion, the exact signed Beta artifact still requires
.89upgrade,.70side-by-side operation, real core journeys, recovery checks, and soak. Stable advances the same immutable qualified manifest without rebuilding.Non-executed live operations
No cloud resources, releases, pointers, production app bundles, secrets, deployments, or workflows were changed or dispatched.