fix(release): persist extension feeds before CDN publish (#2456)

* fix(release): persist extension feeds before publishing

* chore(release): sync BrowserOS neo production feed

* fix: address review findings for sync release manifests

* fix(release): cover multi-channel snapshot retries

* test(release): pin extension feed handoffs

* test(release): keep feed snapshot checks version-agnostic

* ci(release): pin write-enabled feed actions

Author: shadowfax92

.github/workflows/release-extension-feeds.yml

@@ -67,41 +67,51 @@ concurrency:
 jobs:
   feeds:
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    # `both` can consume two independent 15-minute snapshot-PR retry budgets.
+    timeout-minutes: 40
     permissions:
-      contents: read
+      contents: write
+      pull-requests: write
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.repository.default_branch || 'main' }}
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@v8.3.2
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
 
-      - name: Generate extension update feeds
-        working-directory: packages/browseros
+      - name: Generate, persist, and publish extension update feeds
         env:
+          ALLOW_DOWNGRADE: ${{ inputs.allow_downgrade }}
           CHANNEL: ${{ inputs.channel }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch || 'main' }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PINS: ${{ inputs.pins }}
           PUBLISH: ${{ inputs.publish }}
-          ALLOW_DOWNGRADE: ${{ inputs.allow_downgrade }}
           R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
           R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
           R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
           R2_BUCKET: ${{ secrets.R2_BUCKET }}
-        # Inputs are validated and appended to an args array, never a command string.
+        # Each channel is one ordered transaction. For `both`, alpha must be live
+        # before prod renders because bundled resolution carries newer versions
+        # across channels from live R2; batching both renders can lose that state.
         run: |
           set -euo pipefail
 
           case "$CHANNEL" in
-            alpha|prod|both) ;;
+            alpha) channels=(alpha) ;;
+            prod) channels=(prod) ;;
+            both) channels=(alpha prod) ;;
             *)
               echo "::error::Invalid channel '$CHANNEL'; expected alpha, prod, or both" >&2
               exit 1
               ;;
           esac
 
-          args=(--channel "$CHANNEL")
+          base_args=()
           normalized=${PINS//,/ }
           normalized=${normalized//$'\n'/ }
           normalized=${normalized//$'\r'/ }
@@ -111,32 +121,63 @@ jobs:
               echo "::error::Invalid pin '$pin'; expected name=version (for example, agent=0.0.119)" >&2
               exit 1
             fi
-            args+=(--set "$pin")
+            base_args+=(--set "$pin")
           done
-          if [ "$PUBLISH" = "true" ]; then
-            args+=(--publish)
-          fi
           if [ "$ALLOW_DOWNGRADE" = "true" ]; then
-            args+=(--allow-downgrade)
+            base_args+=(--allow-downgrade)
           fi
 
-          if [ "$CHANNEL" = "both" ]; then
-            for ch in alpha prod; do
-              args[1]="$ch"
-              {
-                echo "### Extension feed command ($ch)"
-                echo '```bash'
-                echo "browseros release extensions ${args[*]}"
-                echo '```'
-              } >> "$GITHUB_STEP_SUMMARY"
-              uv run browseros release extensions "${args[@]}"
-            done
-          else
+          for feed_channel in "${channels[@]}"; do
+            args=(--channel "$feed_channel" "${base_args[@]}")
             {
-              echo "### Extension feed command"
+              echo "### Extension feed command ($feed_channel)"
               echo '```bash'
               echo "browseros release extensions ${args[*]}"
               echo '```'
             } >> "$GITHUB_STEP_SUMMARY"
-            uv run browseros release extensions "${args[@]}"
+            uv run --directory packages/browseros browseros \
+              release extensions "${args[@]}"
+
+            if [ "$feed_channel" = "alpha" ]; then
+              feed_keys=(
+                extensions/update-manifest.alpha.xml
+                extensions/extensions.alpha.json
+                extensions/bundled-manifest.xml
+              )
+            else
+              feed_keys=(
+                extensions/update-manifest.xml
+                extensions/extensions.json
+                extensions/bundled-manifest.xml
+              )
+            fi
+
+            snapshot_paths=()
+            for feed_key in "${feed_keys[@]}"; do
+              snapshot_paths+=("updates/$feed_key")
+            done
+
+            if [ "$PUBLISH" != "true" ]; then
+              continue
+            fi
+
+            # The merged snapshot is the durability barrier. A later R2 failure
+            # is retryable; publishing before this returns would recreate drift.
+            packages/browseros-agent/scripts/release/commit-update-snapshot.sh \
+              "$DEFAULT_BRANCH" \
+              "chore(release): update extension ${feed_channel} feeds" \
+              "${snapshot_paths[@]}"
+
+            publish_flags=(--publish)
+            if [ "$ALLOW_DOWNGRADE" = "true" ]; then
+              publish_flags+=(--allow-downgrade)
+            fi
+            uv run --directory packages/browseros browseros \
+              release feeds publish-local \
+              "${feed_keys[@]}" \
+              "${publish_flags[@]}"
+          done
+
+          if [ "$PUBLISH" != "true" ]; then
+            echo "Dry run complete; snapshots were not committed or published"
           fi

packages/browseros-agent/scripts/release/release-extensions-workflow.test.ts

@@ -20,11 +20,15 @@ const browserClawWorkflow = readFileSync(
   'utf8',
 )
 
-function section(start: string, end?: string): string {
-  const startIndex = workflow.indexOf(start)
+function section(
+  start: string,
+  end?: string,
+  source: string = workflow,
+): string {
+  const startIndex = source.indexOf(start)
   expect(startIndex).toBeGreaterThanOrEqual(0)
-  const endIndex = end ? workflow.indexOf(end, startIndex + start.length) : -1
-  return workflow.slice(startIndex, endIndex >= 0 ? endIndex : undefined)
+  const endIndex = end ? source.indexOf(end, startIndex + start.length) : -1
+  return source.slice(startIndex, endIndex >= 0 ? endIndex : undefined)
 }
 
 describe('release-extensions workflow', () => {
@@ -220,6 +224,82 @@ describe('release-extensions workflow', () => {
     expect(section('on:', '\npermissions:')).not.toMatch(/\n {2}push:/)
   })
 
+  it('persists manual feed snapshots before publishing their exact files', () => {
+    const job = section('  feeds:', undefined, feedWorkflow)
+    const transaction = section(
+      '- name: Generate, persist, and publish extension update feeds',
+      undefined,
+      feedWorkflow,
+    )
+    const channelLoopStart = transaction.indexOf(
+      `for feed_channel in "\${channels[@]}"`,
+    )
+    expect(channelLoopStart).toBeGreaterThanOrEqual(0)
+    const channelLoop = transaction.slice(channelLoopStart)
+    const renderCommand = [
+      'uv run --directory packages/browseros browseros \\',
+      `              release extensions "\${args[@]}"`,
+    ].join('\n')
+    const commitCommand = [
+      'packages/browseros-agent/scripts/release/commit-update-snapshot.sh \\',
+      '              "$DEFAULT_BRANCH" \\',
+      `              "chore(release): update extension \${feed_channel} feeds" \\`,
+      `              "\${snapshot_paths[@]}"`,
+    ].join('\n')
+    const publishCommand = [
+      'uv run --directory packages/browseros browseros \\',
+      '              release feeds publish-local \\',
+      `              "\${feed_keys[@]}" \\`,
+      `              "\${publish_flags[@]}"`,
+    ].join('\n')
+    const channelLoopEnd = channelLoop.indexOf(
+      '\n          done\n\n          if [ "$PUBLISH"',
+    )
+
+    expect(job).toMatch(
+      /permissions:\n\s+contents: write\n\s+pull-requests: write/,
+    )
+    expect(job).toMatch(/uses: actions\/checkout@[0-9a-f]{40} # v7/)
+    expect(job).toMatch(/uses: astral-sh\/setup-uv@[0-9a-f]{40} # v8\.3\.2/)
+    expect(job).toContain('timeout-minutes: 40')
+    expect(job).toContain('fetch-depth: 0')
+    expect(job).toContain(
+      `ref: ${'$'}{{ github.event.repository.default_branch || 'main' }}`,
+    )
+    expect(transaction).toContain('both) channels=(alpha prod)')
+    expect(transaction).toContain('extensions/update-manifest.alpha.xml')
+    expect(transaction).toContain('extensions/extensions.alpha.json')
+    expect(transaction).toContain('extensions/update-manifest.xml')
+    expect(transaction).toContain('extensions/extensions.json')
+    expect(transaction).toContain('extensions/bundled-manifest.xml')
+    expect(
+      transaction.match(/extensions\/bundled-manifest\.xml/g),
+    ).toHaveLength(2)
+    expect(transaction).toContain('snapshot_paths+=("updates/$feed_key")')
+    expect(transaction).not.toContain('updates/extensions/update-manifest')
+    expect(transaction).toContain('if [ "$PUBLISH" != "true" ]')
+    expect(transaction).toContain('continue')
+    expect(transaction).toContain('commit-update-snapshot.sh')
+    expect(transaction).toContain('release feeds publish-local')
+    expect(transaction).toContain('--publish')
+    expect(transaction).not.toContain('base_args+=(--publish)')
+    expect(transaction).not.toContain('args+=(--publish)')
+    expect(transaction).toContain('base_args+=(--allow-downgrade)')
+    expect(transaction).toContain('publish_flags=(--publish)')
+    expect(transaction).toContain('publish_flags+=(--allow-downgrade)')
+    expect(channelLoop.indexOf(renderCommand)).toBeGreaterThanOrEqual(0)
+    expect(channelLoop.indexOf(commitCommand)).toBeGreaterThanOrEqual(0)
+    expect(channelLoop.indexOf(publishCommand)).toBeGreaterThanOrEqual(0)
+    expect(channelLoopEnd).toBeGreaterThanOrEqual(0)
+    expect(channelLoop.indexOf(renderCommand)).toBeLessThan(
+      channelLoop.indexOf(commitCommand),
+    )
+    expect(channelLoop.indexOf(commitCommand)).toBeLessThan(
+      channelLoop.indexOf(publishCommand),
+    )
+    expect(channelLoop.indexOf(publishCommand)).toBeLessThan(channelLoopEnd)
+  })
+
   it('requires the BrowserClaw PostHog key and keeps the host optional', () => {
     expect(workflow).toMatch(/VITE_CLAW_POSTHOG_KEY:\n\s+required: true/)
     expect(workflow).toMatch(/VITE_CLAW_POSTHOG_HOST:\n\s+required: false/)

packages/browseros/bos_build/README.md

@@ -246,6 +246,12 @@ gh workflow run release-extension-feeds.yml \
 Pins are optional; extensions not set carry over from the live manifests. The
 per-product browser release orchestrators still only stage extension feed
 previews; the standalone extension workflow is the automatic alpha entrypoint.
+With `publish=true`, the feed workflow merges each channel's exact generated
+snapshots into the default branch before it uploads those same files to R2. A
+failed snapshot merge therefore leaves that channel's live feeds untouched. For
+`channel=both`, alpha completes before production so production sees alpha's
+newer bundled versions. If production later fails, alpha remains durably
+committed and published; rerun the workflow to resume production.
 
 Locally there are two commands, and the difference matters:
 
@@ -259,7 +265,9 @@ browseros release extensions --channel alpha --set browserclaw=0.1.4 --publish
 ```
 
 `release extensions` regenerates the update manifest, `extensions.json`, and the
-bundled manifest together, so they cannot drift apart.
+bundled manifest together, so they cannot drift apart. Local `--publish` is an
+emergency escape hatch and does not persist `updates/` through git; use the feed
+workflow for normal publication.
 
 ## Servers and nightlies
 

packages/browseros/bos_build/release/feeds/publisher_test.py

@@ -25,6 +25,7 @@
     render_update_manifest,
 )
 from .spec import (
+    EXTENSIONS,
     all_feeds,
     browser_feeds_for_product,
     feed_by_key,
@@ -1075,69 +1076,43 @@ def test_mixed_repair_batch_is_retry_safe(self):
         )
         self.assertEqual(self.client.calls, [])
 
-    def test_repaired_snapshots_preserve_versions_and_original_payloads(self):
+    def test_tracked_snapshots_have_canonical_metadata(self):
         updates = Path(__file__).resolve().parents[5] / "updates"
-        server_cases = (
-            (
-                "appcast-server.xml",
-                "0.0.127",
-                (
-                    ("BrowserOS Server", "BrowserOS Server (Alpha)"),
-                    ("appcast-server.xml", "appcast-server.alpha.xml"),
-                    (
-                        "BrowserOS Server binary updates",
-                        "BrowserOS Server (Alpha) binary updates",
-                    ),
-                ),
-                "45a2ee4835b11d964584bdfc6c8d3c555d1384cbcbc91e7eb14aa97c3ba8fedf",
-            ),
-            (
-                "appcast-claw-server.xml",
-                "0.0.15",
-                (
-                    (
-                        "BrowserOS Claw Server",
-                        "BrowserOS Claw Server (Alpha)",
-                    ),
-                    (
-                        "appcast-claw-server.xml",
-                        "appcast-claw-server.alpha.xml",
-                    ),
-                    (
-                        "BrowserOS Claw Server binary updates",
-                        "BrowserOS Claw Server (Alpha) binary updates",
-                    ),
-                ),
-                "1df47182d63006294b87323d276896e489f141f2aed1f0266a2119c9ffef3eef",
-            ),
-        )
 
-        for filename, version, replacements, old_hash in server_cases:
-            with self.subTest(filename=filename):
-                content = (updates / "server" / filename).read_text()
-                spec = feed_by_key(filename)
+        # These files are release outputs, so pin stable schema and ownership
+        # invariants instead of versions or whole-file hashes. Otherwise every
+        # valid snapshot promotion makes the default branch's test suite stale.
+        for bundle_id in ("browseros-server", "browserclaw-server"):
+            spec = server_feed(bundle_id, "prod")
+            with self.subTest(key=spec.key):
+                content = (updates / "server" / spec.key).read_text()
                 self.assertEqual((spec.kind, spec.channel), ("server", "prod"))
-                self.assertEqual(extract_appcast_version(content), version)
-                original = content
-                for corrected, invalid in replacements:
-                    original = original.replace(corrected, invalid, 1)
                 self.assertEqual(
-                    hashlib.sha256(original.encode()).hexdigest(), old_hash
+                    extract_channel_metadata(content),
+                    (spec.title, spec.link),
+                )
+                self.assertIn(
+                    f"<description>{spec.title} binary updates</description>",
+                    content,
                 )
+                self.assertIsNotNone(extract_appcast_version(content))
 
-        manifest_path = updates / "extensions" / "update-manifest.alpha.xml"
-        manifest = manifest_path.read_text()
-        spec = feed_by_key("extensions/update-manifest.alpha.xml")
-        self.assertEqual((spec.kind, spec.channel), ("extensions", "alpha"))
-        self.assertEqual(
-            set(extract_manifest_versions(manifest).values()),
-            {"0.0.139.0", "54.0.0.0", "0.2.15.0"},
-        )
-        original = manifest.replace("</gupdate>", "  </app>\n</gupdate>")
-        self.assertEqual(
-            hashlib.sha256(original.encode()).hexdigest(),
-            "d2a7b386ea9928cb4ae4f0a8537f304db19e7e17e51178feecbe2f5a90f08fb7",
-        )
+        expected_extension_ids = {
+            extension.extension_id
+            for extension in EXTENSIONS
+            if extension.in_update_feed
+        }
+        for channel in ("alpha", "prod"):
+            spec = update_manifest_feed(channel)
+            with self.subTest(key=spec.key):
+                manifest = (updates / spec.key).read_text()
+                self.assertEqual(
+                    (spec.kind, spec.channel), ("extensions", channel)
+                )
+                self.assertEqual(
+                    set(extract_manifest_versions(manifest)),
+                    expected_extension_ids,
+                )
 
     def test_browserclaw_snapshots_use_current_product_title(self):
         updates = Path(__file__).resolve().parents[5] / "updates" / "browser"