From 7a46a18c1545907ac311fa8b94c318b7c36002ca Mon Sep 17 00:00:00 2001 From: anandb71 Date: Sat, 1 Aug 2026 20:40:00 +0530 Subject: [PATCH] fix(release): correct v2.6.0 checksums and stop the job hiding its failure MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `brew install Anandb71/tap/arbor` was broken on v2.6.0. The formula still carried the v2.5.0 checksums, and the Scoop manifest advertised 2.6.0 while its download URL still pointed at the v2.5.0 zip. The release workflow's checksum job reported success while doing nothing. Its final line was: git push origin main || echo "::warning::Could not push to main..." `main` requires a pull request, so that push always fails — and `|| echo` turned the failure into a green job. Every release since branch protection was enabled has shipped the previous version's checksums. Two fixes to the workflow: - The push step now tries main, falls back to opening a PR, and *fails* if neither works. A green job must mean the manifests were actually updated. - The Scoop download URL is rewritten to the release version. Only the `version` field and hash were being updated, so the manifest pointed at the wrong asset regardless of the checksum. All five checksums in this commit were computed from the published v2.6.0 release assets and verified against them: macos-aarch64 733d2b9e… macos-x86_64 9de570cf… linux-aarch64 7ef21230… linux-x86_64 9a84fc66… windows-x86_64 72877177… --- .github/workflows/release.yml | 36 +++++++++++++++++++++++++++++++++-- packaging/homebrew/arbor.rb | 8 ++++---- packaging/scoop/arbor.json | 4 ++-- 3 files changed, 40 insertions(+), 8 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 78035da..ad82162 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -345,6 +345,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: write + pull-requests: write steps: - name: Checkout main branch uses: actions/checkout@v4 @@ -385,6 +386,10 @@ jobs: sed -i "/arbor-linux-x86_64.tar.gz/!b;n;s|sha256 \".*\"|sha256 \"${LINUX_X64_SHA}\"|" "$FILE" sed -i "s|\"version\": \".*\"|\"version\": \"${VERSION}\"|" "$SCOOP" + # The Scoop download URL carries the version literally and was never + # rewritten, so the manifest advertised the new version while still + # pointing at the previous release's zip. + sed -i -E "s|(releases/download/)v[0-9]+[.][0-9]+[.][0-9]+(/arbor-windows-x86_64[.]zip)|\1v${VERSION}\2|" "$SCOOP" sed -i "s|REPLACE_WITH_WINDOWS_X86_64_SHA256|${WIN_X64_SHA}|g" "$SCOOP" sed -i "s|\"hash\": \".*\"|\"hash\": \"${WIN_X64_SHA}\"|" "$SCOOP" @@ -401,6 +406,33 @@ jobs: exit 0 fi - git commit -m "chore: update manifests for v${{ needs.prepare.outputs.version }} [skip ci]" + VERSION='${{ needs.prepare.outputs.version }}' + git commit -m "chore: update manifests for v${VERSION} [skip ci]" git pull --rebase origin main - git push origin main || echo "::warning::Could not push to main (possibly branch protection)." + + # `main` requires a pull request, so a direct push always fails here. + # This step used to end in `|| echo "::warning::"`, which swallowed + # that failure: the job reported success while the Homebrew formula + # and Scoop manifest kept the *previous* release's checksums, so + # `brew install` broke for everyone on the new version and nothing in + # CI said so. + # + # Try the direct push in case protection is ever relaxed, otherwise + # open a PR. If neither works, fail — silently shipping stale + # checksums is the outcome this must never repeat. + if git push origin main 2>/dev/null; then + echo "Pushed manifest updates directly to main." + exit 0 + fi + + echo "Direct push rejected (branch protection); opening a pull request." + BRANCH="chore/manifest-checksums-v${VERSION}" + git push --force origin "HEAD:${BRANCH}" + + gh pr create \ + --base main \ + --head "${BRANCH}" \ + --title "chore: update package manifests for v${VERSION}" \ + --body "Homebrew and Scoop checksums for the v${VERSION} release assets, generated by the release workflow. Merge to keep \`brew install\` and \`scoop install\` working on the new version." + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/packaging/homebrew/arbor.rb b/packaging/homebrew/arbor.rb index f13946a..fc35c40 100644 --- a/packaging/homebrew/arbor.rb +++ b/packaging/homebrew/arbor.rb @@ -9,20 +9,20 @@ class Arbor < Formula on_macos do if Hardware::CPU.arm? url "https://github.com/Anandb71/arbor/releases/download/v#{version}/arbor-macos-aarch64.tar.gz" - sha256 "faac85e2b922dbbd1ecdf0afccba10e32ed0a16a64c92383a419fd89e55ecda1" + sha256 "733d2b9e8871be2b0c757cefe5a2d7cefc7e4375a7f15f2796b6c9680d940634" else url "https://github.com/Anandb71/arbor/releases/download/v#{version}/arbor-macos-x86_64.tar.gz" - sha256 "d3cdfe9d3f998c0a9641eb9d6d93c8a54afdf0f8b71f85ba75b9befd3db606e4" + sha256 "9de570cf05d5cf7a50d1c6e9c9a0081dfa22a3fe5b8a05c3b9058aab9bfdc032" end end on_linux do if Hardware::CPU.arm? url "https://github.com/Anandb71/arbor/releases/download/v#{version}/arbor-linux-aarch64.tar.gz" - sha256 "895223f8930cd5571d3568b22db22c7ecec38e63b1e6fa4d5bb29b77cdfb7b51" + sha256 "7ef2123047198f6678d8ef714e477edd1cbd53846bba6ed2c09090950722d4f3" else url "https://github.com/Anandb71/arbor/releases/download/v#{version}/arbor-linux-x86_64.tar.gz" - sha256 "715dddb5a17fef4a04f2a2cbc7e449ad08164652d704ff034a86523eb68ab941" + sha256 "9a84fc6654c8569c0a2c954c1093bdcbf5afc942b704f24dc6408c115f8222f8" end end diff --git a/packaging/scoop/arbor.json b/packaging/scoop/arbor.json index 4787758..04813df 100644 --- a/packaging/scoop/arbor.json +++ b/packaging/scoop/arbor.json @@ -5,8 +5,8 @@ "license": "MIT", "architecture": { "64bit": { - "url": "https://github.com/Anandb71/arbor/releases/download/v2.5.0/arbor-windows-x86_64.zip", - "hash": "1cef8cf672f51a106166fb1214105b52ca45a51d4f6ce0f790599deea12f2e8a", + "url": "https://github.com/Anandb71/arbor/releases/download/v2.6.0/arbor-windows-x86_64.zip", + "hash": "72877177b0a1bed7a8f7830627e86ddc86f0f59aa0cbeef957d500b662344fba", "bin": "arbor.exe" } },