Skip to content

ci(release): mark Latest only after every asset uploads; install.sh falls back to an earlier release - #58

Merged
ralyodio merged 1 commit into
masterfrom
release-draft-then-publish
Oct 21, 2026
Merged

ralyodio merged 1 commit into
masterfrom
release-draft-then-publish

Conversation

@ralyodio

Copy link
Copy Markdown
Collaborator

Each tag made the release public + Latest on the first upload, so install.sh 404'd for ~3 minutes per release.

  • release.yml: draft job creates a draft release; platform jobs gh release upload --clobber into it; publish (needs all platforms) verifies all 10 assets, then gh release edit --draft=false --latest and checks every asset downloads. A failed platform leaves Latest on the previous release. workflow_dispatch takes a tag input.
  • scripts/install.sh: if latest has no asset for this platform, walk the 6 most recent published releases and install the first that has it.
  • Dry run: with C0MPUTE_RELEASE_BASE pointed so latest 404s, install.sh warned, fell back, and installed v0.2.32 (c0mpute version 0.2.32).

🤖 Generated with Claude Code

…ded; install.sh falls back to an earlier release

softprops/action-gh-release created the release public and Latest on the
first platform's upload, so for ~3 minutes after each tag
releases/latest/download/<artifact> 404'd for the platforms still building
and `curl -fsSL https://c0mpute.com/install.sh | sh` failed.

release.yml: a `draft` job creates the release as a draft (or reuses it),
the five platform jobs upload into the draft with `gh release upload
--clobber`, and `publish` (needs all five) checks every tarball/zip and its
.sha256 is on the release, then `gh release edit --draft=false --latest`
and checks each asset downloads. A failed platform leaves Latest on the
previous release. workflow_dispatch takes a tag input.

install.sh: when C0MPUTE_VERSION=latest and the asset is not 200, walk
the six most recent published releases (GitHub API, no jq) and install the
first that has this platform's asset.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

9 finding(s)

MEDIUM: 9

Severity Rule Location
MEDIUM js-unescaped-html-sink apps/web/src/app/blog/[slug]/page.tsx:53
MEDIUM js-unescaped-html-sink apps/web/src/app/layout.tsx:105
MEDIUM js-unescaped-html-sink apps/web/src/components/pit-footer.tsx:17
MEDIUM sh-remote-script-execution scripts/dev-setup.sh:25
MEDIUM sh-eval-expansion scripts/dev-setup.sh:35
MEDIUM sh-remote-script-execution scripts/install.sh:162
MEDIUM sh-remote-script-execution scripts/install.sh:187
MEDIUM sh-remote-script-execution scripts/install.sh:305
MEDIUM sh-remote-script-execution scripts/install.sh:322

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 17a90d7 into master Oct 21, 2026
13 of 14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant