ci(release): publish desktop releases directly to OSS - #971
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bfa41c373e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ossutil cp --ignore-existing --region "$oss_region" \ | ||
| --content-type "$content_type" \ | ||
| --cache-control "public, max-age=31536000, immutable" \ | ||
| --metadata "sha256=$local_sha" \ | ||
| "$artifact" "$oss_destination" |
There was a problem hiding this comment.
In the scheduled release-macos workflow, a failure after any artifact is uploaded but before latest.json is replaced causes the next run to rebuild the same version, because the version is still derived from the unchanged latest manifest. Those rebuilt artifacts are not byte-identical—most clearly, the browser tarball records fresh build timestamps—so --ignore-existing keeps the first run's object and the subsequent metadata comparison rejects the new local SHA. A transient failure late in publishing can therefore wedge every retry of that release version; reuse the original artifacts or permit replacement until the version manifest is published.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bde9559910
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| echo " to $oss_destination" | ||
| ossutil cp --force --region "$oss_region" \ | ||
| --content-type "$content_type" \ | ||
| --cache-control "public, max-age=31536000, immutable" \ |
There was a problem hiding this comment.
When a run fails after an artifact is verified but before manifest.json is created, the verification request has already populated the CDN with the first upload under a one-year immutable cache policy. A retry's ossutil cp --force replaces only the OSS origin object, so the subsequent HEAD request can keep returning the cached old SHA and fail against the nondeterministic rebuild until the cache expires. Fresh evidence in this revision is that the new overwrite-based retry path still assigns provisional objects max-age=31536000, immutable; keep them uncached or publish each attempt under a unique URL until the manifest seals the bytes.
Useful? React with 👍 / 👎.
| curl -fsSL "$OPENSEEK_RELEASES_ORIGIN/latest.json" 2>/dev/null || | ||
| curl -fsSL "$OPENSEEK_API_ORIGIN/desktop/releases/latest.json" |
There was a problem hiding this comment.
After the first OSS publication, this script no longer updates the API-owned latest.json, so falling back on every CDN read failure can select a permanently stale pre-migration version. If the CDN recovers while the lengthy build is running, publish-release.sh finds that old version already sealed, republishes its old artifacts, and the workflow succeeds; the release-needed job then records the new head SHA as released and will not retry it. Restrict the migration fallback to a definitive missing-object response, rather than DNS, timeout, or 5xx failures.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 36dd8dceac
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
36dd8dc to
4c39054
Compare
1 participant
Summary
/console/POST /desktop/releases/:version/publish; openseek-api generates and atomically replaces its ownlatest.json/desktop/releases/latest.jsonon openseek-api and keep OSS limited to versioned artifacts, with no OSS manifest objectsValidation
bash -n desktop/scripts/publish-release.shshellcheck desktop/scripts/publish-release.shgit diff --checkmoon -C desktop fmtmoon -C desktop infojust check