Skip to content

ci: refuse reused plugin versions and wait for deploy readiness #198

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
HTExplicit wants to merge 1 commit into from
Closed

ci: refuse reused plugin versions and wait for deploy readiness #198

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions .github/workflows/downstream-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,31 @@ jobs:
echo "version=$version" >> "$GITHUB_OUTPUT"
echo "upstream_version=$upstream_version" >> "$GITHUB_OUTPUT"
echo "build_date=$(git show -s --format=%cI "$source_sha")" >> "$GITHUB_OUTPUT"
# Every release re-signs the bundled packages. An installed immutable plugin
# version cannot take different bytes, so a reused version leaves the plugin
# manager degraded and every gateway request unavailable after deploy.
- name: Require new bundled plugin versions
shell: bash
run: |
set -euo pipefail
previous=$(git tag --merged HEAD --list 'v*.*.*-codexrip.*' --sort=-v:refname | grep -vxF "$RELEASE_TAG" | head -n1 || true)
if [[ -z "$previous" ]]; then
echo 'No earlier release tag on this history; nothing to compare.'
exit 0
fi
reused=()
for manifest in plugins/*/manifest.source.json; do
# A plugin added since the previous release has nothing to compare.
git cat-file -e "$previous:$manifest" 2>/dev/null || continue
current=$(jq -r .version "$manifest")
before=$(git show "$previous:$manifest" | jq -r .version)
[[ "$current" != "$before" ]] || reused+=("$(basename "$(dirname "$manifest")")@$current")
done
if ((${#reused[@]})); then
echo "::error::Bundled plugin versions unchanged since $previous: ${reused[*]}. Bump every bundled plugin before tagging."
exit 1
fi
echo "Bundled plugin versions all differ from $previous."
# Required PR checks admit code to main. Reuse that validation here;
# publishing verifies immutable source metadata and builds the artifact,
# rather than rerunning source, frontend, race or migration test suites.
Expand Down
4 changes: 3 additions & 1 deletion .github/workflows/production-deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -353,8 +353,10 @@ jobs:
-p "$VPS_PORT" \
"${VPS_USER}@${VPS_HOST}" \
"$remote_command"
# The recreated container needs time for migrations and plugin bootstrap; the
# edge answers 502/503 until then, so keep retrying for up to three minutes.
- name: Verify public health
env:
PUBLIC_HEALTH_URL: ${{ secrets.PUBLIC_HEALTH_URL }}
shell: bash
run: curl --fail --silent --show-error --retry 3 --retry-delay 2 --max-time 30 "$PUBLIC_HEALTH_URL" >/dev/null
run: curl --fail --silent --show-error --retry 36 --retry-delay 5 --retry-max-time 180 --retry-connrefused --max-time 30 "$PUBLIC_HEALTH_URL" >/dev/null
Loading