mirror of
https://github.com/stablyai/orca.git
synced 2026-10-22 16:03:47 +00:00
NeilandOrca
484273844a
* feat(updater): add an adhoc release channel for branch builds Hourly covers main. This covers everything that is not main yet: a dispatchable macOS build of an unlanded branch, published to stablyai/orca-adhoc, so the team can run an experimental feature for a few days instead of reasoning about it from a diff. Adhoc sits at the bottom of the version order — 'adhoc' < 'hourly' < 'rc' < stable — so no routine check can walk anyone onto somebody's branch; only an explicit pinned jump reaches one. It gets its own repo rather than sharing orca-hourly's, because a branch build must not appear in the list a developer riding main is looking at. Signed and notarized exactly like hourly, for the same reason: macOS anchors a notarized app's TCC grants on identifier + team, so an unnotarized build reads as a new client and silently loses file access under Documents/Desktop/Downloads. Tags stamp to the second rather than the minute. Hourly runs under a concurrency group and cannot overlap itself; adhoc builds are dispatched on demand, so two people cutting from different branches inside one minute is ordinary — and a minute-resolution tag would collide and fail the second build after its whole pack-and-notarize run. Channel-specific behaviour now derives from one DEDICATED_REPO_CHANNELS list: repo mapping, macOS-only support, and UpdateSource. The RPC schema that validates releaseChannelOverride was a hand-copied enum missing the new channel, which would have rejected the override on its way to the main process; it reads the predicate now. * fix(updater): merge the duplicated shared/types import Co-authored-by: Orca <help@stably.ai> * fix(ci): default the adhoc build ref to the dispatch branch The Actions UI puts its own "Use workflow from" branch picker directly above the ref field, and picking a branch there is what most people read as "build this". Making the field optional means the obvious action is also the correct one; naming a branch explicitly still wins, so main's copy of the workflow runs rather than a stale one on an old branch. Co-authored-by: Orca <help@stably.ai> --------- Co-authored-by: Orca <help@stably.ai>
90 lines
3.4 KiB
Bash
Executable File
90 lines
3.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Creates stablyai/orca-adhoc and grants the existing release App write access to
|
|
# it, so adhoc-mac-build.yml can publish there.
|
|
#
|
|
# Why a separate repo rather than reusing orca-hourly: an adhoc build is somebody's
|
|
# unlanded branch. Sharing hourly's repo would put branch builds in the list a
|
|
# developer riding main sees, and the two are different levels of unvetted.
|
|
#
|
|
# Why no secrets are set here: the adhoc workflow reuses the same GitHub App as
|
|
# hourly — one App id, one private key, one thing to rotate. This script only has
|
|
# to widen that App's installation to cover the new repo.
|
|
#
|
|
# Run once, after config/scripts/setup-hourly-release-token.sh:
|
|
# bash config/scripts/setup-adhoc-release-repo.sh
|
|
#
|
|
set -euo pipefail
|
|
|
|
ORG="stablyai"
|
|
ADHOC_REPO="$ORG/orca-adhoc"
|
|
MAIN_REPO="$ORG/orca"
|
|
APP_SLUG="orca-hourly-release"
|
|
|
|
fail() {
|
|
echo "error: $*" >&2
|
|
exit 1
|
|
}
|
|
|
|
command -v gh >/dev/null 2>&1 || fail "gh CLI not found. See https://cli.github.com"
|
|
gh auth status >/dev/null 2>&1 || fail "Not logged in. Run: gh auth login"
|
|
|
|
if gh api "repos/$ADHOC_REPO" --jq '.full_name' >/dev/null 2>&1; then
|
|
echo "$ADHOC_REPO already exists."
|
|
else
|
|
echo "Creating $ADHOC_REPO..."
|
|
# Why public: the in-app updater fetches release assets unauthenticated, exactly
|
|
# as it does for orca-hourly. A private repo would 404 for every client.
|
|
#
|
|
# Why the features are off: this repo holds releases and nothing else. Leaving
|
|
# issues open invites bug reports against a branch build in a repo nobody
|
|
# watches, where they are simply lost.
|
|
gh repo create "$ADHOC_REPO" \
|
|
--public \
|
|
--description "Adhoc macOS dev builds of Orca, cut from unlanded branches. Not a source repo." \
|
|
--disable-issues \
|
|
--disable-wiki ||
|
|
fail "Could not create $ADHOC_REPO."
|
|
fi
|
|
|
|
echo
|
|
echo "Granting $APP_SLUG access to $ADHOC_REPO..."
|
|
|
|
# Why attempt the API before printing instructions: an org owner can do this in
|
|
# one call. Everyone else gets a 403 and the manual path below — GitHub does not
|
|
# let a mere admin widen an App's repository selection.
|
|
INSTALL_ID="$(gh api "orgs/$ORG/installations" --paginate \
|
|
--jq ".installations[] | select(.app_slug == \"$APP_SLUG\") | .id" 2>/dev/null || true)"
|
|
REPO_ID="$(gh api "repos/$ADHOC_REPO" --jq '.id' 2>/dev/null || true)"
|
|
|
|
GRANTED=false
|
|
if [[ -n "$INSTALL_ID" && -n "$REPO_ID" ]]; then
|
|
if gh api -X PUT "user/installations/$INSTALL_ID/repositories/$REPO_ID" >/dev/null 2>&1; then
|
|
GRANTED=true
|
|
echo "Done — $APP_SLUG can now write to $ADHOC_REPO."
|
|
fi
|
|
fi
|
|
|
|
if [[ "$GRANTED" != "true" ]]; then
|
|
# Why no automated check afterwards: the endpoints that report an App's
|
|
# repository access (repos/*/installation, user/installations/*/repositories)
|
|
# both reject an ordinary `gh auth login` token, so any "verified" this script
|
|
# printed would be guesswork. The smoke test below is the real check.
|
|
cat <<EOF
|
|
|
|
Could not do it from here${INSTALL_ID:+ (needs an Organization Owner)}. Do it in the browser:
|
|
|
|
1. Open: https://github.com/organizations/$ORG/settings/installations
|
|
2. Configure -> $APP_SLUG
|
|
3. Repository access -> Only select repositories -> add $ADHOC_REPO
|
|
(keep orca-hourly selected; both dev channels use this one App)
|
|
4. Save.
|
|
EOF
|
|
fi
|
|
|
|
echo
|
|
echo "Smoke-test the pipeline (after this merges):"
|
|
echo " gh workflow run adhoc-mac-build.yml --repo $MAIN_REPO --ref main \\"
|
|
echo " -f ref=<your-branch> -f label=<short-name>"
|
|
echo " gh run watch --repo $MAIN_REPO"
|