nrobi144
84c4b461a9
P1 fixes (must-fix):
- AppRun: VLC path corrected to usr/lib/app/linux/vlc (jpackage actual
path), add VLC_PLUGIN_PATH env var for codec discovery
- linuxdeploy: use APPIMAGE_EXTRACT_AND_RUN=1 env var to bypass FUSE
on CI runners instead of fragile pre-extract + symlink approach
- Prerelease classifier: inverted to positive-match stable format
(^v[0-9]+\.[0-9]+\.[0-9]+$) across desktop, Android, and composite
action — eliminates regex drift between allowlists
- assert-stable-release: now accepts inputs (tag, is_prerelease,
is_draft) so workflow_dispatch on bump workflows also validates
P2 fixes (should-fix):
- .gitignore: add linuxdeploy-*.AppImage and extracted dirs
- RPM version: use replace("-", "~") instead of substringBefore("-")
for correct RPM prerelease ordering (1.08.0~rc1 < 1.08.0)
- linux-portable → linux alias moved into collect_assets() in
scripts/asset-name.sh (single source of truth)
- Android cache key: add gradle/libs.versions.toml to hashFiles
- r0adkll/sign-android-release: SHA-pinned to 349ebdef (v1)
P3 fixes (nice-to-have):
- LINUXDEPLOY_OUTPUT_VERSION env var replaced with
APPIMAGE_EXTRACT_AND_RUN (misleading comment + redundant var)
- nick-fields/retry timeout: 40m → 15m (surface real hangs)
- generate_release_notes: true only on Android job (avoid
last-writer-wins race across 6 concurrent uploaders)
- apt-get install rpm: tightened guard to matrix.family == 'linux'
(linux-portable leg doesn't need rpm tooling)
50 lines
1.6 KiB
YAML
50 lines
1.6 KiB
YAML
name: Assert Stable Release
|
|
description: >-
|
|
Defense-in-depth guard for package-manager bump workflows. Re-validates
|
|
tag format, prerelease flag, and draft status before invoking third-party
|
|
actions that hold write credentials to external package manager repos.
|
|
|
|
inputs:
|
|
tag:
|
|
description: "Tag to validate (e.g. v1.08.0)"
|
|
required: true
|
|
is_prerelease:
|
|
description: "Whether the release is marked as prerelease (empty string treated as false)"
|
|
required: false
|
|
default: "false"
|
|
is_draft:
|
|
description: "Whether the release is a draft (empty string treated as false)"
|
|
required: false
|
|
default: "false"
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Assert release is stable
|
|
shell: bash
|
|
env:
|
|
TAG: ${{ inputs.tag }}
|
|
IS_PRERELEASE: ${{ inputs.is_prerelease }}
|
|
IS_DRAFT: ${{ inputs.is_draft }}
|
|
run: |
|
|
set -euo pipefail
|
|
echo "tag=$TAG prerelease=$IS_PRERELEASE draft=$IS_DRAFT"
|
|
|
|
# Stable = exactly vMAJOR.MINOR.PATCH; reject everything else.
|
|
if ! [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
|
|
echo "::error::Tag $TAG does not match stable vMAJOR.MINOR.PATCH format; refusing bump"
|
|
exit 1
|
|
fi
|
|
|
|
# Draft releases must never trigger bumps.
|
|
if [[ "$IS_DRAFT" == "true" ]]; then
|
|
echo "::error::Release is draft; refusing bump"
|
|
exit 1
|
|
fi
|
|
|
|
# Prerelease flag cross-check (belt-and-suspenders with workflow-level `if:`).
|
|
if [[ "$IS_PRERELEASE" == "true" ]]; then
|
|
echo "::error::Release is prerelease; refusing bump"
|
|
exit 1
|
|
fi
|