base-layer/releasekit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

Build delivery retries from clean tagged source

Browse Source
This commit is contained in:
Eric Rakestraw
2026-11-04 01:52:26 +00:00
parent bd1c714935
commit bf4e2329ec
2 changed files with 21 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
docs/release.md
View File

@@ -188,25 +188,35 @@ Woodpecker workflow builds the CLI from the tagged checkout, then uses
destination and secret, copy it to `.woodpecker/releasekit-source-delivery.yml`
and add the Woodpecker repository secret `releasekit_gitea_token`. If page
delivery fails or is uncertain, inspect the hosted release and retry the same
immutable version from its tag:
immutable version from its tag. The retry requires a clean tagged checkout
before preparing or building the tool:
```sh
git fetch origin "refs/tags/vX.Y.Z:refs/tags/vX.Y.Z"
git checkout --detach "vX.Y.Z"
(
set -e
version=vX.Y.Z
tag_ref="refs/tags/$version"
git fetch origin "$tag_ref:$tag_ref"
tag_commit=$(git rev-parse --verify "$tag_ref^{commit}")
git checkout --detach "$tag_commit"
worktree_status=$(git status --porcelain --untracked-files=all)
if [ -n "$worktree_status" ]; then
printf '%s\n' 'Delivery retry requires a clean tagged checkout.' >&2
exit 1
fi
releasekit_host_os=$(GOTOOLCHAIN=local go env GOHOSTOS)
releasekit_host_arch=$(GOTOOLCHAIN=local go env GOHOSTARCH)
export GOOS="$releasekit_host_os" GOARCH="$releasekit_host_arch"
GOTOOLCHAIN=local go mod download
mkdir -p .releasekit/bin
GOTOOLCHAIN=local GOPROXY=off GOSUMDB=off go build -o .releasekit/bin/releasekit ./cmd/releasekit
.releasekit/bin/releasekit deliver "vX.Y.Z"
.releasekit/bin/releasekit deliver "$version"
)
```
For an older tag whose CLI predates `token_file`, supply the token through its
environment variable when retrying that tagged tool:
For an older tag whose CLI predates `token_file`, build the tagged executable
as above, then supply the token through its environment variable when retrying:
```sh
RELEASEKIT_GITEA_TOKEN="$(cat .releasekit/gitea-token)" \

5
docs/roadmap/remediation.md
View File

@@ -262,6 +262,11 @@ name and verify that only the intended tool runs.
### Stage 3: Build the manual retry tool only from a clean tagged checkout
**Completed.** The retry resolves and checks out the fetched tag and checks
cleanliness before invoking Go. Local probes verified that fetch failure,
checkout failure, and remaining edits stop before Go, and a clean retry
builds and runs the tagged tool for the host.
**Evidence:** The [manual retry block](../release.md) runs `git fetch` and
`git checkout --detach` before the subshell that enables `set -e`. A
failed checkout can therefore be followed by dependency preparation, a