mirror of
https://github.com/0xrsydn/idx-cli.git
synced 2026-11-07 09:45:36 +00:00
304709f3ac
From the full-repo Codex audit: - The publisher read discovery fields one per line, so a report title with newlines shifted every later field and published a manifest without source.publish_date, which every client rejects (blocking all syncs). Read them NUL-separated, and refuse to write a manifest missing a field clients require. - The snapshot builder copied the SQLite file with cp; committed data still in the -wal file of an open database would be missing. Checkpoint first (a no-op for the publisher's closed database, so the bytes and hash are unchanged) and refuse to copy when that cannot complete. - install.sh took the tag from a greedy match, which on a compact single-line releases response picks the last tag, not the newest (it installed v0.2.3 over v0.2.4 in the new test). Split fields first. - scripts/audit-msn-fundamentals.sh read the symbol map from a path that no longer exists and silently checked no stocks. - release.yml granted contents: write to every job; only publish gets it now. Actions in the release and snapshot workflows are pinned to commit SHAs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V3syn2fN2LNo5pvTSqc6eh
61 lines
1.9 KiB
YAML
61 lines
1.9 KiB
YAML
name: Publish Ownership Snapshot
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
release_tag:
|
|
description: Stable GitHub release tag to publish the snapshot assets to
|
|
required: true
|
|
default: ownership-snapshot-current
|
|
history:
|
|
description: Number of earlier monthly above-1% reports to include for `ownership changes`
|
|
required: false
|
|
default: "5"
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
concurrency:
|
|
group: ownership-snapshot-publish
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
publish:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
|
|
- name: Install Nix
|
|
uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
|
|
|
|
- name: Build ownership publisher
|
|
run: nix build .#ownership-publisher
|
|
|
|
- name: Publish ownership snapshot
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
REPO: ${{ github.repository }}
|
|
RELEASE_TAG: ${{ inputs.release_tag }}
|
|
HISTORY: ${{ inputs.history }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
# The packaged publisher owns the full protocol: discovery, import,
|
|
# content-addressed SQLite upload + SHA-256 verification, and the
|
|
# manifest as the final commit point. It is a no-op when current.
|
|
./result/bin/idx-ownership-publish \
|
|
--output-dir dist/ownership-snapshot \
|
|
--repo "$REPO" \
|
|
--release-tag "$RELEASE_TAG" \
|
|
--history "$HISTORY"
|
|
|
|
- name: Upload workflow artifact copy
|
|
# A legitimate up-to-date run produces no new local artifacts.
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
|
with:
|
|
name: ownership-snapshot-${{ github.run_id }}
|
|
path: dist/ownership-snapshot/*
|
|
if-no-files-found: ignore
|