promotion-gate: detect available 7z binary instead of hardcoding 7zz - #149
Merged
Conversation
v150.0.6's first promotion-gate run 127'd on the Info.plist step because '7zz: command not found' — the '7zip' apt package (binary 7zz) only exists on Ubuntu 24+; ubuntu-latest is currently 22.04 where the correct package is p7zip-full (binary 7z). Gate rejected a good artifact for the wrong reason. Fix: install p7zip-full (stable across runner versions) and detect whichever 7z-family binary is available. Also propagates 'set -eo pipefail' + better error output on plist-not-found so a future failure surfaces the DMG structure instead of a mystery 1. Meta-lesson (encoding in the diff comment): gates that catch bug classes must themselves be exercised — my local pre-verify caught the plist=150.0.6 correctly, but this CI-side check had never actually run against a real DMG. First real run is when you find the bug. Add promotion-gate to packaging-and-update-tests.yml's stanza so future edits smoke it against a fixture DMG. Follow-up.
mdheller
added a commit
that referenced
this pull request
Aug 4, 2026
…binary plist) (#150) Second false-negative from promotion-gate.yml: first run 127'd on missing 7zz (#149 fixed that), second run extracted the DMG fine but reported empty version because: - Info.plist in a real DMG is a BINARY plist, not XML - plistutil (libplist-utils) was supposed to convert it to XML but silently failed (its '2>/dev/null' swallowed the error) - The fallback 'cp' put the binary blob at /tmp/plist.xml - grep matched (binary file matches) but sed on binary yielded '' - Version comparison: '' != '150.0.6' → gate quarantined a good release Use Python's plistlib instead. Handles binary AND XML formats natively, zero extra deps (Python 3 is on every ubuntu-latest runner). Meta-lesson (again): a two-step tool chain where the first step's failure is silenced becomes a two-step tool chain where you cannot tell which step failed. Both '2>/dev/null' fallbacks in this gate have now bitten us. Removing libplist-utils entirely closes the class.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First real production run of promotion-gate.yml (on v150.0.6 release-publish) 127'd on the Info.plist step:
7zz: command not found. The7zipapt package (binary7zz) only exists on Ubuntu 24+; ubuntu-latest is currently 22.04 where the correct package isp7zip-full(binary7z).Result: gate rejected a good v150.0.6 artifact for the wrong reason (my local pre-verify confirmed
CFBundleShortVersionString: 150.0.6correctly)./latestcorrectly reverted to v150.0.5 — the quarantine-on-failure path itself worked.Fix
Install
p7zip-full(stable across all runner versions) and detect whichever 7z-family binary is available (7z,7zz,7za). Addsset -eo pipefailand better error output on the plist-not-found path so a future failure surfaces the DMG structure instead of a mystery exit.Meta-lesson
Gates that catch bug classes must themselves be exercised — my local pre-verify caught
plist=150.0.6correctly, but this CI-side check had never actually run against a real DMG. First real run is when you find the bug. Follow-up: smoke-test promotion-gate.yml against a fixture DMG in a PR-time job so future edits don't wait for a release to prove themselves.