mirror of
https://github.com/stablyai/orca.git
synced 2026-10-30 16:47:34 +00:00
ci: drop the relay Windows process-tree job from desktop packaging (#27412)
* ci: drop the relay Windows process-tree job from desktop packaging * ci: refuse relay-era tags in a directly dispatched mac release build --------- Co-authored-by: m4air <m4air@Mac.localdomain>
This commit is contained in:
OrcaWin
m4air
@@ -128,18 +128,6 @@ jobs:
|
||||
echo "Resolved $REQUESTED_REF -> $sha"
|
||||
echo "sha=$sha" >>"$GITHUB_OUTPUT"
|
||||
|
||||
# Why its own job: this package ships relays for Windows SSH hosts, and only a
|
||||
# Windows runner compiles the addon that launches one outside sshd's job.
|
||||
# Why the unvetted ref is safe here: this job holds no secrets, and the mac job
|
||||
# vets the same ref before it downloads anything, so fork code never gets signed.
|
||||
relay-windows-process-tree:
|
||||
needs: resolve-ref
|
||||
permissions:
|
||||
contents: read
|
||||
uses: ./.github/workflows/relay-windows-process-tree.yml
|
||||
with:
|
||||
ref: ${{ needs.resolve-ref.outputs.sha }}
|
||||
|
||||
# Why: a branch cut before the orcad template landed has none to build or ship.
|
||||
orcad-template-support:
|
||||
needs: resolve-ref
|
||||
@@ -156,8 +144,17 @@ jobs:
|
||||
ref: ${{ needs.resolve-ref.outputs.sha }}
|
||||
sparse-checkout: |
|
||||
/config/scripts/packaged-orcad-template.cjs
|
||||
/config/tsconfig.relay.json
|
||||
sparse-checkout-cone-mode: false
|
||||
persist-credentials: false
|
||||
# Why: a relay-era ref (before #27215) needs the Windows relay addon this build no longer compiles.
|
||||
- name: Refuse a ref that still ships the SSH relay
|
||||
shell: bash
|
||||
run: |
|
||||
if [[ -e config/tsconfig.relay.json ]]; then
|
||||
echo "::error::This ref predates #27215 and still ships the SSH relay; build a commit at or after 2b4b60a87e."
|
||||
exit 1
|
||||
fi
|
||||
- name: Detect whether the ref ships the orcad template
|
||||
id: detect
|
||||
shell: bash
|
||||
@@ -171,8 +168,8 @@ jobs:
|
||||
|
||||
# Design D2, as release-cut does: every desktop build ships the orcad template (server JS plus
|
||||
# every target's addons), merged from the node-server lanes that qualify each slot at this ref.
|
||||
# Without it an adhoc build cannot deploy managed orcad to an SSH host. No secrets, like the
|
||||
# relay job, and the mac job vets the ref before anything is signed.
|
||||
# Without it an adhoc build cannot deploy managed orcad to an SSH host. No secrets, and the mac
|
||||
# job vets the ref before anything is signed.
|
||||
orcad-template:
|
||||
needs: [resolve-ref, orcad-template-support]
|
||||
if: needs.orcad-template-support.outputs.ships == 'true'
|
||||
@@ -184,11 +181,10 @@ jobs:
|
||||
build_template: true
|
||||
|
||||
build-adhoc-mac:
|
||||
needs: [resolve-ref, relay-windows-process-tree, orcad-template-support, orcad-template]
|
||||
needs: [resolve-ref, orcad-template-support, orcad-template]
|
||||
# Why not the implicit success(): a ref without the orcad template skips that job on purpose.
|
||||
if: >-
|
||||
!cancelled() && github.repository == 'stablyai/orca' &&
|
||||
needs.relay-windows-process-tree.result == 'success' &&
|
||||
needs.orcad-template-support.result == 'success' &&
|
||||
(needs.orcad-template.result == 'success' ||
|
||||
(needs.orcad-template.result == 'skipped' &&
|
||||
@@ -371,14 +367,6 @@ jobs:
|
||||
fi
|
||||
cat "$RUNNER_TEMP/adhoc-identity.txt" >>"$GITHUB_OUTPUT"
|
||||
|
||||
# Only a Windows runner compiles these; the relay-windows-process-tree job
|
||||
# built them for this run.
|
||||
- name: Collect the Windows process-table addons for the relay
|
||||
uses: actions/download-artifact@v8
|
||||
with:
|
||||
name: relay-windows-process-tree
|
||||
path: .build/windows-process-tree
|
||||
|
||||
- name: Build app
|
||||
run: pnpm build:release
|
||||
env:
|
||||
@@ -387,9 +375,6 @@ jobs:
|
||||
# gate accepts only 'stable' or 'rc', so leaving this unset keeps them
|
||||
# silent, which is correct for unvetted branch artifacts.
|
||||
ORCA_DIAGNOSTICS_TOKEN_URL: https://www.onorca.dev/diagnostics/token
|
||||
# Fail the build rather than ship a relay that cannot launch outside
|
||||
# sshd's job for a standard user on a Windows SSH host.
|
||||
ORCA_REQUIRE_RELAY_NATIVE_ADDONS: x64,arm64
|
||||
|
||||
# After the app build so nothing that cleans out/ can drop it; electron-builder ships it.
|
||||
- name: Download the orcad deployment template
|
||||
|
||||
@@ -89,16 +89,6 @@ jobs:
|
||||
[[ "$head_sha" =~ ^[0-9a-f]{40}$ ]] || { echo "::error::Could not resolve main"; exit 1; }
|
||||
echo "head_sha=$head_sha" >>"$GITHUB_OUTPUT"
|
||||
|
||||
# Why its own job: this package ships relays for Windows SSH hosts, and only a
|
||||
# Windows runner compiles the addon that launches one outside sshd's job.
|
||||
relay-windows-process-tree:
|
||||
needs: resolve-main
|
||||
permissions:
|
||||
contents: read
|
||||
uses: ./.github/workflows/relay-windows-process-tree.yml
|
||||
with:
|
||||
ref: ${{ needs.resolve-main.outputs.head_sha }}
|
||||
|
||||
# As release-cut does: every SSH host runs orcad, deployed from the template this build ships.
|
||||
orcad-template:
|
||||
needs: resolve-main
|
||||
@@ -112,7 +102,6 @@ jobs:
|
||||
build-daily-mac:
|
||||
needs:
|
||||
- resolve-main
|
||||
- relay-windows-process-tree
|
||||
- orcad-template
|
||||
if: github.repository == 'stablyai/orca'
|
||||
outputs:
|
||||
@@ -290,15 +279,6 @@ jobs:
|
||||
fi
|
||||
cat "$RUNNER_TEMP/daily-identity.txt" >>"$GITHUB_OUTPUT"
|
||||
|
||||
# Only a Windows runner compiles these; the relay-windows-process-tree job
|
||||
# built them for this run.
|
||||
- name: Collect the Windows process-table addons for the relay
|
||||
if: steps.freshness.outputs.should_build == 'true'
|
||||
uses: actions/download-artifact@v8
|
||||
with:
|
||||
name: relay-windows-process-tree
|
||||
path: .build/windows-process-tree
|
||||
|
||||
- name: Build app
|
||||
if: steps.freshness.outputs.should_build == 'true'
|
||||
run: pnpm build:release
|
||||
@@ -308,9 +288,6 @@ jobs:
|
||||
# gate accepts only 'stable' or 'rc', so leaving this unset keeps them
|
||||
# silent, which is correct for unvetted dev artifacts.
|
||||
ORCA_DIAGNOSTICS_TOKEN_URL: https://www.onorca.dev/diagnostics/token
|
||||
# Fail the build rather than ship a relay that cannot launch outside
|
||||
# sshd's job for a standard user on a Windows SSH host.
|
||||
ORCA_REQUIRE_RELAY_NATIVE_ADDONS: x64,arm64
|
||||
|
||||
# After the app build so nothing that cleans out/ can drop it; electron-builder ships it.
|
||||
- name: Download the orcad deployment template
|
||||
|
||||
@@ -180,6 +180,15 @@ jobs:
|
||||
# (zizmor: artipacked).
|
||||
persist-credentials: false
|
||||
|
||||
# Why: a relay-era ref (before #27215) needs the Windows relay addon this build no longer compiles.
|
||||
- name: Refuse a ref that still ships the SSH relay
|
||||
shell: bash
|
||||
run: |
|
||||
if [[ -e config/tsconfig.relay.json ]]; then
|
||||
echo "::error::This ref predates #27215 and still ships the SSH relay; build a commit at or after 2b4b60a87e."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Why a guard and not just a build: the workflow file comes from the
|
||||
# dispatch ref, but the packaging config comes from the *built* commit. A
|
||||
# branch cut before Windows dev builds landed has a config that ignores
|
||||
@@ -247,23 +256,10 @@ jobs:
|
||||
shell: bash
|
||||
run: node config/scripts/verify-dev-channel-packaging.mjs --channel="$CHANNEL" --platform=win32
|
||||
|
||||
# Why here and not in build:relay: only a Windows runner can compile it, and
|
||||
# arm64 cross-compiles from this same x64 agent. Runs before the 20-minute
|
||||
# build so a runner image missing the MSVC ARM64 cross toolset fails in
|
||||
# seconds with MSB8020 naming the component, rather than deep into packaging.
|
||||
- name: Build Windows process-table addon for the relay
|
||||
shell: bash
|
||||
run: |
|
||||
node config/scripts/build-windows-process-tree-relay-addon.mjs --arch=x64
|
||||
node config/scripts/build-windows-process-tree-relay-addon.mjs --arch=arm64
|
||||
|
||||
- name: Build app
|
||||
shell: bash
|
||||
run: pnpm build:release
|
||||
env:
|
||||
# Fail the build rather than ship a relay that silently falls back to
|
||||
# the PowerShell scan on every Windows SSH host.
|
||||
ORCA_REQUIRE_RELAY_NATIVE_ADDONS: 'x64,arm64'
|
||||
# Why unset ORCA_BUILD_IDENTITY: telemetry's transport gate accepts only
|
||||
# 'stable' or 'rc', so leaving it unset keeps dev builds silent — which
|
||||
# is correct for unvetted artifacts. Same as the mac dev channels.
|
||||
|
||||
@@ -116,17 +116,6 @@ jobs:
|
||||
echo "main moved to $head_sha (last hourly built $last_sha); building."
|
||||
fi
|
||||
|
||||
# Why its own job: this package ships relays for Windows SSH hosts, and only a
|
||||
# Windows runner compiles the addon that launches one outside sshd's job.
|
||||
relay-windows-process-tree:
|
||||
needs: preflight
|
||||
if: needs.preflight.outputs.should_build == 'true'
|
||||
permissions:
|
||||
contents: read
|
||||
uses: ./.github/workflows/relay-windows-process-tree.yml
|
||||
with:
|
||||
ref: ${{ needs.preflight.outputs.head_sha }}
|
||||
|
||||
# As release-cut does: every SSH host runs orcad, deployed from the template this build ships.
|
||||
orcad-template:
|
||||
needs: preflight
|
||||
@@ -141,7 +130,6 @@ jobs:
|
||||
build-hourly-mac:
|
||||
needs:
|
||||
- preflight
|
||||
- relay-windows-process-tree
|
||||
- orcad-template
|
||||
if: needs.preflight.outputs.should_build == 'true'
|
||||
outputs:
|
||||
@@ -279,14 +267,6 @@ jobs:
|
||||
fi
|
||||
cat "$RUNNER_TEMP/hourly-identity.txt" >>"$GITHUB_OUTPUT"
|
||||
|
||||
# Only a Windows runner compiles these; the relay-windows-process-tree job
|
||||
# built them for this run.
|
||||
- name: Collect the Windows process-table addons for the relay
|
||||
uses: actions/download-artifact@v8
|
||||
with:
|
||||
name: relay-windows-process-tree
|
||||
path: .build/windows-process-tree
|
||||
|
||||
- name: Build app
|
||||
run: pnpm build:release
|
||||
env:
|
||||
@@ -295,9 +275,6 @@ jobs:
|
||||
# gate accepts only 'stable' or 'rc', so leaving this unset keeps them
|
||||
# silent, which is correct for unvetted dev artifacts.
|
||||
ORCA_DIAGNOSTICS_TOKEN_URL: https://www.onorca.dev/diagnostics/token
|
||||
# Fail the build rather than ship a relay that cannot launch outside
|
||||
# sshd's job for a standard user on a Windows SSH host.
|
||||
ORCA_REQUIRE_RELAY_NATIVE_ADDONS: x64,arm64
|
||||
|
||||
# After the app build so nothing that cleans out/ can drop it; electron-builder ships it.
|
||||
- name: Download the orcad deployment template
|
||||
|
||||
@@ -205,14 +205,26 @@ jobs:
|
||||
env:
|
||||
ORCA_BUN_ORCAD_SLOT: ${{ steps.bun-orcad.outputs.slot }}
|
||||
BUN_EXECUTABLE: ${{ steps.bun-orcad.outputs.executable }}
|
||||
# Only a Windows runner compiles it; arm64 cross-compiles here, as release-cut does for the relay.
|
||||
# Only a Windows runner compiles it; arm64 cross-compiles here.
|
||||
# Before the Node 18 check below: the build script imports TypeScript, which Node 18 cannot load.
|
||||
# orcad's instance lock and stop proof read a PID's creation time through it; the x64 binary this
|
||||
# runner loads must answer it, and answer nothing for a missing PID rather than a stale time.
|
||||
- name: Build the Windows process-table addons for the desktop template
|
||||
if: inputs.build_template && matrix.os == 'windows-2022'
|
||||
shell: bash
|
||||
run: |
|
||||
node config/scripts/build-windows-process-tree-relay-addon.mjs --arch=x64
|
||||
node config/scripts/build-windows-process-tree-relay-addon.mjs --arch=arm64
|
||||
node -e "
|
||||
const { assertWindowsProcessTreeCreationTime } = require('./config/scripts/windows-process-tree-creation-time.cjs')
|
||||
const addon = require('./.build/windows-process-tree/x64/windows-process-tree.node')
|
||||
assertWindowsProcessTreeCreationTime({ module: addon })
|
||||
const own = addon.getProcessCreationTime(process.pid)
|
||||
const started = Date.now() - process.uptime() * 1000
|
||||
if (typeof own !== 'number' || Math.abs(own - started) > 5000) throw new Error('creation time ' + own + ' vs ' + started)
|
||||
if (addon.getProcessCreationTime(0x7ffffff0) !== undefined) throw new Error('a missing PID must read undefined')
|
||||
console.log('creation time ok:', own)
|
||||
"
|
||||
- name: Keep the Windows process-table addons for the desktop template
|
||||
if: inputs.build_template && matrix.os == 'windows-2022'
|
||||
uses: actions/upload-artifact@v7
|
||||
|
||||
@@ -1,88 +0,0 @@
|
||||
name: Relay Windows process-tree addons
|
||||
|
||||
# Why a reusable workflow: every desktop package ships relays for Windows SSH hosts,
|
||||
# but only a Windows runner can compile the addon that launches a relay outside
|
||||
# sshd's job. macOS and Linux packaging jobs download this artifact into
|
||||
# .build/windows-process-tree before `pnpm build:release` stages it.
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
ref:
|
||||
description: Commit or tag to build; must match what the packaging job checks out.
|
||||
required: true
|
||||
type: string
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
build:
|
||||
# Why windows-2022: windows-latest moved to VS 2026 before node-gyp could detect
|
||||
# it. GitHub-hosted, so release-cut's SignPath provenance rule still holds.
|
||||
runs-on: windows-2022
|
||||
timeout-minutes: 30
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
ref: ${{ inputs.ref }}
|
||||
persist-credentials: false
|
||||
|
||||
# Plain setup rather than a composite action: `uses: ./` resolves from the
|
||||
# checked-out ref, which may be a release tag that predates the action.
|
||||
- name: Setup pnpm
|
||||
uses: pnpm/setup@v2
|
||||
with:
|
||||
install: false
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version-file: package.json
|
||||
cache: pnpm
|
||||
cache-dependency-path: pnpm-lock.yaml
|
||||
|
||||
# Why host-only: the addon is compiled from the patched source pnpm
|
||||
# materializes, and arm64 cross-compiles through node-gyp --arch.
|
||||
- name: Install dependencies
|
||||
uses: nick-fields/retry@v4
|
||||
with:
|
||||
timeout_minutes: 10
|
||||
max_attempts: 3
|
||||
retry_wait_seconds: 30
|
||||
command: pnpm install --frozen-lockfile
|
||||
|
||||
# The build script refuses unpatched source and checks each output's PE
|
||||
# machine, ReadProcessMemory import, and spawnOutsideJob export.
|
||||
- name: Build Windows process-table addons for the relay
|
||||
shell: bash
|
||||
run: |
|
||||
node config/scripts/build-windows-process-tree-relay-addon.mjs --arch=x64
|
||||
node config/scripts/build-windows-process-tree-relay-addon.mjs --arch=arm64
|
||||
|
||||
# orcad's instance lock and stop proof read one PID's creation time through this addon on
|
||||
# Windows SSH hosts; prove the x64 binary this runner can load answers it, and answers
|
||||
# nothing for a PID that does not exist rather than a stale or zero time.
|
||||
- name: Assert the addon reads process creation time
|
||||
shell: bash
|
||||
run: |
|
||||
node -e "
|
||||
const { assertWindowsProcessTreeCreationTime } = require('./config/scripts/windows-process-tree-creation-time.cjs')
|
||||
const addon = require('./.build/windows-process-tree/x64/windows-process-tree.node')
|
||||
assertWindowsProcessTreeCreationTime({ module: addon })
|
||||
const own = addon.getProcessCreationTime(process.pid)
|
||||
const started = Date.now() - process.uptime() * 1000
|
||||
if (typeof own !== 'number' || Math.abs(own - started) > 5000) throw new Error('creation time ' + own + ' vs ' + started)
|
||||
if (addon.getProcessCreationTime(0x7ffffff0) !== undefined) throw new Error('a missing PID must read undefined')
|
||||
console.log('creation time ok:', own)
|
||||
"
|
||||
|
||||
- name: Upload relay addons
|
||||
uses: actions/upload-artifact@v7
|
||||
with:
|
||||
name: relay-windows-process-tree
|
||||
path: .build/windows-process-tree/
|
||||
if-no-files-found: error
|
||||
retention-days: 7
|
||||
# A rerun attempt re-uploads under the same name, which is otherwise refused.
|
||||
overwrite: true
|
||||
@@ -113,6 +113,15 @@ jobs:
|
||||
# `git push` overwrites the existing tag.
|
||||
fetch-tags: true
|
||||
|
||||
# Why: a relay-era ref (before #27215) needs the Windows relay addon this build no longer compiles.
|
||||
- name: Refuse a ref that still ships the SSH relay
|
||||
shell: bash
|
||||
run: |
|
||||
if [[ -e config/tsconfig.relay.json ]]; then
|
||||
echo "::error::This ref predates #27215 and still ships the SSH relay; build a commit at or after 2b4b60a87e."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
@@ -1200,18 +1209,6 @@ jobs:
|
||||
- name: Confirm blocking release gates passed
|
||||
run: echo "All blocking release gates passed; artifact builds may start."
|
||||
|
||||
# Why its own job: every desktop package ships Windows relays, but only a
|
||||
# Windows runner compiles the addon that launches one outside sshd's job.
|
||||
# Needs only cut, so it overlaps the release gates instead of extending them.
|
||||
relay-windows-process-tree:
|
||||
needs: cut
|
||||
if: needs.cut.outputs.should_release == 'true'
|
||||
permissions:
|
||||
contents: read
|
||||
uses: ./.github/workflows/relay-windows-process-tree.yml
|
||||
with:
|
||||
ref: refs/tags/${{ needs.cut.outputs.tag }}
|
||||
|
||||
# Compilation can overlap the release gates; signing remains behind release-preflight.
|
||||
release-javascript:
|
||||
needs: cut
|
||||
@@ -1231,7 +1228,6 @@ jobs:
|
||||
- orcad-template
|
||||
- release-preflight
|
||||
- release-javascript
|
||||
- relay-windows-process-tree
|
||||
# Why not the implicit success(): a tag without the orcad template skips that job on purpose.
|
||||
if: >-
|
||||
!cancelled() &&
|
||||
@@ -1240,7 +1236,6 @@ jobs:
|
||||
needs.create-release.result == 'success' &&
|
||||
needs.release-preflight.result == 'success' &&
|
||||
needs.release-javascript.result == 'success' &&
|
||||
needs.relay-windows-process-tree.result == 'success' &&
|
||||
(needs.orcad-template.result == 'success' ||
|
||||
(needs.orcad-template.result == 'skipped' && needs.cut.outputs.ships_orcad_template == 'false'))
|
||||
env:
|
||||
@@ -1450,16 +1445,6 @@ jobs:
|
||||
echo "identity=$identity" >>"$GITHUB_OUTPUT"
|
||||
echo "Classified $TAG as $identity"
|
||||
|
||||
# Why every leg: each package ships relays for Windows SSH hosts. v1.4.203 and
|
||||
# earlier shipped Windows relays with no windows-process-tree.node, and mac and
|
||||
# Linux packages shipped none until the addon moved to its own Windows job.
|
||||
# Why no run_attempt guard: Build app is ungated, so a rerun needs it staged too.
|
||||
- name: Collect the Windows process-table addons for the relay
|
||||
uses: actions/download-artifact@v8
|
||||
with:
|
||||
name: relay-windows-process-tree
|
||||
path: .build/windows-process-tree
|
||||
|
||||
# Why an explicit step rather than trusting the runner image: the packaged
|
||||
# CLI launcher is a native Rust binary, and a Windows host without cargo
|
||||
# fails deep inside electron-builder's native hook instead of here. Real
|
||||
@@ -1500,9 +1485,6 @@ jobs:
|
||||
ORCA_RELEASE_JAVASCRIPT_SOURCE_SHA: ${{ needs.release-javascript.outputs.source_sha }}
|
||||
ORCA_DIAGNOSTICS_TOKEN_URL: https://www.onorca.dev/diagnostics/token
|
||||
ORCA_POSTHOG_WRITE_KEY: ${{ secrets.ORCA_POSTHOG_WRITE_KEY }}
|
||||
# Fail the release rather than ship a relay that cannot launch outside
|
||||
# sshd's job for a standard user on a Windows SSH host.
|
||||
ORCA_REQUIRE_RELAY_NATIVE_ADDONS: x64,arm64
|
||||
|
||||
# After the app build so nothing that cleans out/ can drop it; electron-builder ships it.
|
||||
- name: Download the orcad deployment template
|
||||
@@ -2343,8 +2325,6 @@ jobs:
|
||||
- orcad-template
|
||||
- release-preflight
|
||||
- release-javascript
|
||||
# release-mac-build.yml downloads the relay addons from this run.
|
||||
- relay-windows-process-tree
|
||||
# Why not the implicit success(): a tag without the orcad template skips that job on purpose.
|
||||
if: >-
|
||||
!cancelled() &&
|
||||
@@ -2353,7 +2333,6 @@ jobs:
|
||||
needs.create-release.result == 'success' &&
|
||||
needs.release-preflight.result == 'success' &&
|
||||
needs.release-javascript.result == 'success' &&
|
||||
needs.relay-windows-process-tree.result == 'success' &&
|
||||
(needs.orcad-template.result == 'success' ||
|
||||
(needs.orcad-template.result == 'skipped' && needs.cut.outputs.ships_orcad_template == 'false'))
|
||||
# Why: SignPath requires every job in this signing workflow to be
|
||||
|
||||
@@ -36,7 +36,7 @@ jobs:
|
||||
# faster runner.
|
||||
runs-on: blacksmith-6vcpu-macos-15
|
||||
timeout-minutes: 60
|
||||
# actions: read fetches the relay addons from the release-cut run.
|
||||
# actions: read fetches the release-cut run's artifacts.
|
||||
permissions:
|
||||
actions: read
|
||||
contents: write
|
||||
@@ -48,6 +48,15 @@ jobs:
|
||||
with:
|
||||
ref: refs/tags/${{ inputs.tag }}
|
||||
|
||||
# Why: a relay-era ref (before #27215) needs the Windows relay addon this build no longer compiles.
|
||||
- name: Refuse a ref that still ships the SSH relay
|
||||
shell: bash
|
||||
run: |
|
||||
if [[ -e config/tsconfig.relay.json ]]; then
|
||||
echo "::error::This ref predates #27215 and still ships the SSH relay; build a commit at or after 2b4b60a87e."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Restore draft-publish scripts from the workflow ref
|
||||
env:
|
||||
WORKFLOW_SHA: ${{ github.workflow_sha }}
|
||||
@@ -138,16 +147,6 @@ jobs:
|
||||
echo "identity=$identity" >>"$GITHUB_OUTPUT"
|
||||
echo "Classified $TAG as $identity"
|
||||
|
||||
# Only a Windows runner compiles these; release-cut's relay-windows-process-tree
|
||||
# job built them from this tag before dispatching this workflow.
|
||||
- name: Collect the Windows process-table addons for the relay
|
||||
uses: actions/download-artifact@v8
|
||||
with:
|
||||
name: relay-windows-process-tree
|
||||
path: .build/windows-process-tree
|
||||
run-id: ${{ inputs.release_run_id }}
|
||||
github-token: ${{ github.token }}
|
||||
|
||||
- name: Download release JavaScript from the release run
|
||||
if: inputs.javascript_source_sha != ''
|
||||
uses: actions/download-artifact@v8
|
||||
@@ -173,9 +172,6 @@ jobs:
|
||||
ORCA_RELEASE_JAVASCRIPT_SOURCE_SHA: ${{ inputs.javascript_source_sha }}
|
||||
ORCA_DIAGNOSTICS_TOKEN_URL: https://www.onorca.dev/diagnostics/token
|
||||
ORCA_POSTHOG_WRITE_KEY: ${{ secrets.ORCA_POSTHOG_WRITE_KEY }}
|
||||
# Fail the release rather than ship a relay that cannot launch outside
|
||||
# sshd's job for a standard user on a Windows SSH host.
|
||||
ORCA_REQUIRE_RELAY_NATIVE_ADDONS: x64,arm64
|
||||
|
||||
# Design D2: the parent release-cut run merged it from every node-server lane at this tag.
|
||||
- name: Download the orcad deployment template from the release run
|
||||
|
||||
@@ -157,8 +157,6 @@ jobs:
|
||||
arches: ${{ matrix.arch }}
|
||||
- name: Build the win32 template and the relay
|
||||
shell: bash
|
||||
env:
|
||||
ORCA_REQUIRE_RELAY_NATIVE_ADDONS: ${{ matrix.arch }}
|
||||
run: |
|
||||
pnpm build:orcad-prebuilds --require-slots "win32-${{ matrix.arch }}"
|
||||
node config/scripts/build-orcad-template.mjs --targets "win32-${{ matrix.arch }}"
|
||||
|
||||
@@ -61,7 +61,6 @@ afterAll(() => rmSync(directory, { recursive: true, force: true }))
|
||||
describe('adhoc build pins one commit for the whole run', () => {
|
||||
it('checks out the pinned commit in every job that builds from the repo', () => {
|
||||
const { jobs } = workflow
|
||||
expect(jobs['relay-windows-process-tree'].with.ref).toBe(PINNED)
|
||||
expect(jobs['orcad-template'].with.ref).toBe(PINNED)
|
||||
const support = jobs['orcad-template-support'].steps.find((step) =>
|
||||
step.uses?.startsWith('actions/checkout@')
|
||||
@@ -69,12 +68,7 @@ describe('adhoc build pins one commit for the whole run', () => {
|
||||
expect(support.with.ref).toBe(PINNED)
|
||||
const vet = jobs['build-adhoc-mac'].steps.find((step) => step.id === 'vetted')
|
||||
expect(vet.env.REQUESTED_REF).toBe(PINNED)
|
||||
for (const name of [
|
||||
'relay-windows-process-tree',
|
||||
'orcad-template-support',
|
||||
'orcad-template',
|
||||
'build-adhoc-mac'
|
||||
]) {
|
||||
for (const name of ['orcad-template-support', 'orcad-template', 'build-adhoc-mac']) {
|
||||
expect([jobs[name].needs].flat(), name).toContain('resolve-ref')
|
||||
}
|
||||
})
|
||||
|
||||
@@ -37,7 +37,6 @@ describe.each(channels)('$name build ships the orcad template', (channel) => {
|
||||
expect(template.permissions).toEqual({ contents: 'read' })
|
||||
expect(template.secrets).toBeUndefined()
|
||||
expect(mac.steps.find((step) => step.name === 'Checkout').with.ref).toBe(channel.pinnedSha)
|
||||
expect(jobs['relay-windows-process-tree'].with.ref).toBe(channel.pinnedSha)
|
||||
})
|
||||
|
||||
it('packages the macOS build only with the template present', () => {
|
||||
|
||||
@@ -62,7 +62,7 @@ describe('hourly build preflight', () => {
|
||||
expect(
|
||||
preflight.steps.find((step) => step.id === 'app_token').with['permission-contents']
|
||||
).toBe('read')
|
||||
expect(build.needs).toEqual(['preflight', 'relay-windows-process-tree', 'orcad-template'])
|
||||
expect(build.needs).toEqual(['preflight', 'orcad-template'])
|
||||
expect(build.if).toBe("needs.preflight.outputs.should_build == 'true'")
|
||||
expect(build.steps.find((step) => step.name === 'Checkout').with.ref).toBe(
|
||||
build.outputs.head_sha
|
||||
|
||||
@@ -203,7 +203,6 @@ describe('SSH Windows consumers of qualified server slots', () => {
|
||||
expect(addon).toBeLessThan(sshSteps.indexOf(sshPrepare))
|
||||
expect(sshSteps.indexOf(sshPrepare)).toBeLessThan(template)
|
||||
expect(template).toBeLessThan(hosts)
|
||||
expect(sshSteps[template].env.ORCA_REQUIRE_RELAY_NATIVE_ADDONS).toBe('${{ matrix.arch }}')
|
||||
expect(sshSteps[template].run).toContain('--require-slots "win32-${{ matrix.arch }}"')
|
||||
expect(sshSteps[hosts].run).toContain("@('orcad-cmd','orcad-powershell')")
|
||||
for (const workflowPaths of [
|
||||
|
||||
@@ -0,0 +1,56 @@
|
||||
// Desktop builds no longer compile the Windows relay addon, so every workflow that packages an
|
||||
// arbitrary ref must refuse one that still ships the relay rather than ship it without the addon.
|
||||
import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
|
||||
import { tmpdir } from 'node:os'
|
||||
import { join } from 'node:path'
|
||||
import { afterAll, describe, expect, it } from 'vitest'
|
||||
import { parse } from 'yaml'
|
||||
import { runProcess } from '@orca/process-host'
|
||||
|
||||
const STEP = 'Refuse a ref that still ships the SSH relay'
|
||||
const directory = mkdtempSync(join(tmpdir(), 'relay-era-ref-refusal-'))
|
||||
afterAll(() => rmSync(directory, { recursive: true, force: true }))
|
||||
|
||||
function steps(workflow, job) {
|
||||
return parse(readFileSync(`.github/workflows/${workflow}`, 'utf8')).jobs[job].steps
|
||||
}
|
||||
|
||||
async function runAt(run, relayEra) {
|
||||
const checkout = mkdtempSync(join(directory, 'ref-'))
|
||||
mkdirSync(join(checkout, 'config'))
|
||||
if (relayEra) {
|
||||
writeFileSync(join(checkout, 'config', 'tsconfig.relay.json'), '{}')
|
||||
}
|
||||
writeFileSync(join(checkout, 'step.sh'), run)
|
||||
return runProcess({ program: 'bash', args: ['step.sh'], cwd: checkout })
|
||||
}
|
||||
|
||||
describe.each([
|
||||
// The refusal must precede everything that tags, signs or publishes.
|
||||
[
|
||||
'adhoc-mac-build.yml',
|
||||
'orcad-template-support',
|
||||
'Detect whether the ref ships the orcad template'
|
||||
],
|
||||
['release-cut.yml', 'cut', 'Resolve ref SHA'],
|
||||
// Dispatchable on its own with any tag, so release-cut's refusal does not cover it.
|
||||
['release-mac-build.yml', 'build-mac', 'Build app'],
|
||||
['dev-channel-win-build.yml', 'build-win', 'Build app']
|
||||
])('%s refuses a relay-era ref', (workflow, job, laterStep) => {
|
||||
const jobSteps = steps(workflow, job)
|
||||
const index = jobSteps.findIndex((step) => step.name === STEP)
|
||||
|
||||
it('checks the ref before it builds or tags anything', () => {
|
||||
expect(index).toBeGreaterThan(0)
|
||||
expect(jobSteps[index - 1].uses).toMatch(/^actions\/checkout@/)
|
||||
const sparse = jobSteps[index - 1].with['sparse-checkout']
|
||||
expect(sparse?.split('\n').includes('/config/tsconfig.relay.json') ?? true).toBe(true)
|
||||
expect(index).toBeLessThan(jobSteps.findIndex((step) => step.name === laterStep))
|
||||
})
|
||||
|
||||
it('fails only when the checkout still has the relay', async () => {
|
||||
const run = jobSteps[index].run
|
||||
expect((await runAt(run, true)).code).toBe(1)
|
||||
expect((await runAt(run, false)).code).toBe(0)
|
||||
})
|
||||
})
|
||||
@@ -68,9 +68,6 @@ const EXPECTED_MATRIX = {
|
||||
contents: 'read'
|
||||
},
|
||||
[`${RELEASE_WORKFLOW}#release-preflight`]: { contents: 'read' },
|
||||
[`${RELEASE_WORKFLOW}#relay-windows-process-tree`]: { contents: 'read' },
|
||||
[`${RELEASE_WORKFLOW}#relay-windows-process-tree -> .github/workflows/relay-windows-process-tree.yml#build`]:
|
||||
{ contents: 'read' },
|
||||
[`${RELEASE_WORKFLOW}#skill-sharing-linux-floor-release-gate`]: { contents: 'read' },
|
||||
[`${RELEASE_WORKFLOW}#skill-sharing-release-gate`]: { contents: 'read' },
|
||||
[`${RELEASE_WORKFLOW}#terminal-rendering-golden`]: { contents: 'read' },
|
||||
|
||||
Reference in New Issue
Block a user