Files
nexu-io-open-design/.github/scripts/release/report/mac.sh
PerishFire 8f6cdaaba1 Harden release-beta-s self-hosted beta lane (#3641)
* Fix Windows smoke launcher payload layout

* Harden release-beta-s runner probe

* Use cmd shell for release-beta-s probe

* Add win beta build script for self-hosted lane

* Keep release-beta-s checkout lightweight

* Use explicit local beta version for release-beta-s

* Install dependencies in beta build script

* Repair Electron dist before Windows beta build

* Add release-beta-s timings and diagnostics

* Polish release-beta-s observability guardrails

* Trace tools-pack cache materialization

* Reuse materialized workspace build cache

* Trace Windows packaging segments

* Trace Windows archive process details

* Reuse installer unpacked materialization

* Preserve reusable Windows unpacked projection

* Add fast smoke telemetry for self-hosted beta

* Cache Windows archive outputs for beta lane

* Tighten fast Windows smoke lane

* Scope Windows beta artifact reporting by target

* Clean stale Windows target artifacts

* Wire Windows Authenticode signing

* Expose self-hosted beta validation modes

* Add core Windows smoke profile

* Decouple core smoke from updater fixture version

* Trace Windows smoke lifecycle steps

* Skip unpacked materialization on NSIS cache hit

* Add Nexu S3 beta publisher

* Harden self-hosted Windows beta lane

* Use Windows PowerShell for publish probe

* Run publish probe via repo script

* Require explicit self-hosted S3 public origin

* Run real installer acceptance for external feeds

* Skip ready-prompt checks for external feeds

* Relax optional self-hosted update inputs

* Tolerate BOM in self-hosted publish probe

* Converge self-hosted beta metadata and signing flow

* Run self-hosted beta metadata prep on the runner lane

* Use Windows PowerShell for self-hosted beta metadata checks

* Bypass execution policy in self-hosted beta metadata checks

* Split self-hosted beta metadata publish

* Suppress mc output in beta publish helpers

* Split Windows NSIS payload cache layers

* Require fresh tool dist metadata

* Preserve Windows overlay payload paths

* Default beta-s gate to core

* Optimize win beta packaging reuse

* simplify windows full smoke lifecycle

* preserve onboarding state after windows upgrade smoke

* fix windows tools-pack test portability

* recover stale tools-pack locks

* Allow auto signing fallback for beta builds

* Add self-hosted beta mac arm64 lane

* Quote self-hosted signing choices

* Run self-hosted beta metadata on mac lane

* Use shallow metadata checkout on self-hosted beta

* Use sparse beta metadata checkout

* Make mac release profile bash-compatible

* Allow file sparse metadata checkout

* Isolate self-hosted metadata checkout

* Clear sparse skip-worktree before mac build

* Isolate self-hosted mac build checkout

* Run self-hosted beta publish without aws cli

* Use unsigned beta prefix for mixed platform publish

* Sparse checkout self-hosted beta publish

* Publish mac beta platform before metadata

* Pass mac publish release profile

* Probe mac signing keychain import

* Expand mac signing preflight variants

* Use sudo keychain helper for self-hosted mac signing

* Route self-hosted mac codesign through sudo wrapper

* Normalize mac signing identity name

* Harden self-hosted mac notarization

* Optimize self-hosted mac release cache

* Fix mac signing helper cleanup

* Retry transient mac notarization uploads

* Keep mac notarization fail-fast

* Reduce mac symlink diagnostics noise

* Normalize self-hosted beta platform inputs

* chore: bump beta base version to 0.9.1

* chore: tune release tools-pack cache retention

* test: add temporary cache validation marker

* chore: key windows nsis base payload by content

* Revert "test: add temporary cache validation marker"

This reverts commit e8487bfd3e.

* chore: probe windows nsis payload cache before materializing

* chore: align self-hosted beta smoke modes

* chore: skip mac smoke report upload when disabled

* chore: default self-hosted beta to publish both platforms

* chore: make beta signing modes explicit

* Add release report artifacts and metatool metadata

* Fix Windows release report zip publishing

* Remove artifact handoff from release beta self-hosted lane

* Fix release beta merge follow-ups

* Fix release beta install regressions

* Restore web build dependencies

* Route Windows beta downloads through mirrors

* Use PowerShell 7 for Windows beta lane

* Fix release beta preflight gates

Generated-By: looper 0.9.4 (runner=fixer, agent=codex)

* Fix Windows beta smoke update reuse

Generated-By: looper 0.9.4 (runner=fixer, agent=codex)

* Fix release beta review follow-ups

* Refresh Nix pnpm dependency hashes

Generated-By: looper 0.9.4 (runner=fixer, agent=codex)

* Fix Windows signtool fallback resolution

* Reject stale beta platform manifests

* Validate beta platform manifest run identity

Generated-By: looper 0.9.4 (runner=fixer, agent=codex)

* Validate beta manifest commit identity

Generated-By: looper 0.9.4 (runner=fixer, agent=codex)

* Allow beta metadata publish reruns

Generated-By: looper 0.9.4 (runner=fixer, agent=codex)

* Build tools-pack fully in beta Windows bootstrap

Generated-By: looper 0.9.4 (runner=fixer, agent=codex)

* Emit r2 metadata for Windows beta publish

Generated-By: looper 0.9.4 (runner=fixer, agent=codex)

* Stabilize beta publish browser test

Generated-By: looper 0.9.4 (runner=fixer, agent=codex)

* Stabilize Windows beta metadata smoke test

Generated-By: looper 0.9.4 (runner=fixer, agent=codex)

* Restore multi-platform Vela CLI package

* Refresh Nix pnpm dependency hashes

Generated-By: looper 0.9.5 (runner=fixer, agent=codex)

---------

Co-authored-by: Looper <looper@noreply.github.com>
2026-06-05 03:00:55 +00:00

92 lines
3.3 KiB
Bash

#!/usr/bin/env bash
set -euo pipefail
summary_title="${SUMMARY_TITLE:-tools-pack build}"
build_json_path="${BUILD_JSON_PATH:-$RUNNER_TEMP/tools-pack-build.json}"
report_root="${REPORT_ROOT:-$RUNNER_TEMP/release-report/mac}"
report_zip_path="${REPORT_ZIP_PATH:-$RUNNER_TEMP/release-report/mac-report.zip}"
write_step_summary="${WRITE_STEP_SUMMARY:-true}"
create_report_zip() {
local root="$1"
local zip_path="$2"
if ! command -v zip >/dev/null 2>&1; then
echo "zip is required to package release report artifacts" >&2
return 1
fi
mkdir -p "$root" "$(dirname "$zip_path")"
rm -f "$zip_path"
(
cd "$root"
zip -qr "$zip_path" .
)
echo "wrote release report zip: $zip_path"
}
if [ "$write_step_summary" != "false" ] && [ ! -f "$build_json_path" ]; then
{
echo "### $summary_title"
echo
echo "Build JSON was not found at \`$build_json_path\`."
} >> "$GITHUB_STEP_SUMMARY"
elif [ "$write_step_summary" != "false" ]; then
BUILD_JSON_PATH="$build_json_path" SUMMARY_TITLE="$summary_title" node --input-type=module <<'NODE' >> "$GITHUB_STEP_SUMMARY"
import { readFileSync } from "node:fs";
const build = JSON.parse(readFileSync(process.env.BUILD_JSON_PATH, "utf8"));
const cell = (value) => String(value ?? "").replace(/\|/g, "\\|").replace(/[\r\n]+/g, " ");
const code = (value) => `\`${cell(value).replace(/`/g, "'")}\``;
const seconds = (value) => `${(Number(value) / 1000).toFixed(1)}s`;
console.log(`### ${process.env.SUMMARY_TITLE}`);
if (build.cacheReport?.root != null) {
console.log("");
console.log(`cacheRoot=${code(build.cacheReport.root)}`);
}
if ((build.releaseScriptTimings ?? []).length > 0) {
console.log("");
console.log("| Release script step | Status | Duration |");
console.log("| --- | --- | ---: |");
for (const timing of build.releaseScriptTimings ?? []) {
console.log(`| ${code(timing.step)} | ${code(timing.status)} | ${seconds(timing.durationMs)} |`);
}
}
console.log("");
console.log("| Phase | Duration |");
console.log("| --- | ---: |");
for (const timing of build.timings ?? []) {
console.log(`| ${code(timing.phase)} | ${seconds(timing.durationMs)} |`);
}
console.log("");
console.log("| Cache node | Status | Reason | Duration |");
console.log("| --- | --- | --- | ---: |");
for (const entry of build.cacheReport?.entries ?? []) {
console.log(`| ${code(entry.nodeId)} | ${code(entry.status)} | ${cell(entry.reason)} | ${seconds(entry.durationMs)} |`);
}
const materialized = (build.cacheReport?.entries ?? [])
.flatMap((entry) => (entry.materialized ?? []).map((target) => ({
nodeId: entry.nodeId,
...target,
})))
.sort((left, right) => Number(right.durationMs) - Number(left.durationMs))
.slice(0, 10);
if (materialized.length > 0) {
console.log("");
console.log("| Materialized cache output | Mode | Duration |");
console.log("| --- | --- | ---: |");
for (const entry of materialized) {
const mode = entry.skipped === true ? "reused" : "copied";
console.log(`| ${code(`${entry.nodeId}:${entry.from}`)} | ${code(mode)} | ${seconds(entry.durationMs)} |`);
}
}
NODE
fi
REPORT_PLATFORM="${REPORT_PLATFORM:-mac}" \
REPORT_ROOT="$report_root" \
REPORT_ZIP_PATH="$report_zip_path" \
BUILD_JSON_PATH="$build_json_path" \
node --experimental-strip-types .github/scripts/release/report/report-json.ts
create_report_zip "$report_root" "$report_zip_path"