mirror of
https://github.com/0xrsydn/idx-cli.git
synced 2026-11-07 09:45:36 +00:00
304709f3ac
From the full-repo Codex audit: - The publisher read discovery fields one per line, so a report title with newlines shifted every later field and published a manifest without source.publish_date, which every client rejects (blocking all syncs). Read them NUL-separated, and refuse to write a manifest missing a field clients require. - The snapshot builder copied the SQLite file with cp; committed data still in the -wal file of an open database would be missing. Checkpoint first (a no-op for the publisher's closed database, so the bytes and hash are unchanged) and refuse to copy when that cannot complete. - install.sh took the tag from a greedy match, which on a compact single-line releases response picks the last tag, not the newest (it installed v0.2.3 over v0.2.4 in the new test). Split fields first. - scripts/audit-msn-fundamentals.sh read the symbol map from a path that no longer exists and silently checked no stocks. - release.yml granted contents: write to every job; only publish gets it now. Actions in the release and snapshot workflows are pinned to commit SHAs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V3syn2fN2LNo5pvTSqc6eh
138 lines
4.3 KiB
YAML
138 lines
4.3 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*"
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: "Existing release tag to build and attach binaries to (for example v0.2.3)"
|
|
required: true
|
|
pull_request:
|
|
paths:
|
|
- ".github/workflows/release.yml"
|
|
- "Cargo.toml"
|
|
- "crates/*/Cargo.toml"
|
|
- "Cargo.lock"
|
|
- "package.json"
|
|
- "npm/idx-mcp/package.json"
|
|
- "scripts/install.js"
|
|
- "install.sh"
|
|
|
|
# Read-only by default; only the publish job writes the release.
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
|
|
|
|
jobs:
|
|
build:
|
|
name: Build ${{ matrix.asset }}
|
|
runs-on: ${{ matrix.os }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- os: ubuntu-latest
|
|
target: x86_64-unknown-linux-musl
|
|
asset: linux-x64
|
|
- os: ubuntu-24.04-arm
|
|
target: aarch64-unknown-linux-musl
|
|
asset: linux-arm64
|
|
- os: macos-14
|
|
target: aarch64-apple-darwin
|
|
asset: darwin-arm64
|
|
- os: macos-14
|
|
target: x86_64-apple-darwin
|
|
asset: darwin-x64
|
|
|
|
steps:
|
|
- name: Check out source
|
|
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
with:
|
|
ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}
|
|
|
|
- name: Install Rust toolchain and target
|
|
uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
|
|
with:
|
|
targets: ${{ matrix.target }}
|
|
|
|
- name: Install musl toolchain
|
|
if: endsWith(matrix.target, '-linux-musl')
|
|
run: sudo apt-get update && sudo apt-get install --yes musl-tools
|
|
|
|
- name: Build release binary
|
|
shell: bash
|
|
run: |
|
|
target="${{ matrix.target }}"
|
|
if [[ "$target" == *-linux-musl ]]; then
|
|
# Bundled SQLite and ring compile C code; build it against musl too.
|
|
export "CC_${target//-/_}=musl-gcc"
|
|
fi
|
|
cargo build --release --locked --target "$target" -p idx-cli -p idx-mcp
|
|
for bin in idx idx-mcp; do
|
|
cp "target/${{ matrix.target }}/release/$bin" "$bin-${{ matrix.asset }}"
|
|
chmod 0755 "$bin-${{ matrix.asset }}"
|
|
done
|
|
|
|
- name: Check binaries run
|
|
if: matrix.target != 'x86_64-apple-darwin'
|
|
run: |
|
|
./idx-${{ matrix.asset }} --help >/dev/null
|
|
./idx-mcp-${{ matrix.asset }} --help >/dev/null
|
|
|
|
- name: Upload target artifacts
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
|
with:
|
|
name: idx-${{ matrix.asset }}
|
|
path: |
|
|
idx-${{ matrix.asset }}
|
|
idx-mcp-${{ matrix.asset }}
|
|
if-no-files-found: error
|
|
|
|
publish:
|
|
name: Attach binaries to release
|
|
needs: build
|
|
if: github.event_name != 'pull_request'
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- name: Check out install script
|
|
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
with:
|
|
ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}
|
|
sparse-checkout: install.sh
|
|
sparse-checkout-cone-mode: false
|
|
path: src
|
|
|
|
- name: Download target artifacts
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
|
|
with:
|
|
pattern: idx-*
|
|
merge-multiple: true
|
|
|
|
- name: Write checksums
|
|
run: |
|
|
sha256sum \
|
|
idx-linux-x64 idx-linux-arm64 idx-darwin-arm64 idx-darwin-x64 \
|
|
idx-mcp-linux-x64 idx-mcp-linux-arm64 idx-mcp-darwin-arm64 idx-mcp-darwin-x64 \
|
|
> SHA256SUMS
|
|
|
|
- name: Attach binaries to the version tag
|
|
uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
|
|
with:
|
|
tag_name: ${{ env.RELEASE_TAG }}
|
|
files: |
|
|
idx-linux-x64
|
|
idx-linux-arm64
|
|
idx-darwin-arm64
|
|
idx-darwin-x64
|
|
idx-mcp-linux-x64
|
|
idx-mcp-linux-arm64
|
|
idx-mcp-darwin-arm64
|
|
idx-mcp-darwin-x64
|
|
SHA256SUMS
|
|
src/install.sh
|