base-layer/releasekit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

Build delivery retries from clean tagged source

Browse Source
This commit is contained in:
Eric Rakestraw
2026-11-04 01:52:26 +00:00
parent bd1c714935
commit bf4e2329ec
2 changed files with 21 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
docs/release.md
View File

@@ -188,25 +188,35 @@ Woodpecker workflow builds the CLI from the tagged checkout, then uses
destination and secret, copy it to `.woodpecker/releasekit-source-delivery.yml` destination and secret, copy it to `.woodpecker/releasekit-source-delivery.yml`
and add the Woodpecker repository secret `releasekit_gitea_token`. If page and add the Woodpecker repository secret `releasekit_gitea_token`. If page
delivery fails or is uncertain, inspect the hosted release and retry the same delivery fails or is uncertain, inspect the hosted release and retry the same
immutable version from its tag: immutable version from its tag. The retry requires a clean tagged checkout
before preparing or building the tool:
```sh ```sh
git fetch origin "refs/tags/vX.Y.Z:refs/tags/vX.Y.Z"
git checkout --detach "vX.Y.Z"
( (
set -e set -e
version=vX.Y.Z
tag_ref="refs/tags/$version"
git fetch origin "$tag_ref:$tag_ref"
tag_commit=$(git rev-parse --verify "$tag_ref^{commit}")
git checkout --detach "$tag_commit"
worktree_status=$(git status --porcelain --untracked-files=all)
if [ -n "$worktree_status" ]; then
printf '%s\n' 'Delivery retry requires a clean tagged checkout.' >&2
exit 1
fi
releasekit_host_os=$(GOTOOLCHAIN=local go env GOHOSTOS) releasekit_host_os=$(GOTOOLCHAIN=local go env GOHOSTOS)
releasekit_host_arch=$(GOTOOLCHAIN=local go env GOHOSTARCH) releasekit_host_arch=$(GOTOOLCHAIN=local go env GOHOSTARCH)
export GOOS="$releasekit_host_os" GOARCH="$releasekit_host_arch" export GOOS="$releasekit_host_os" GOARCH="$releasekit_host_arch"
GOTOOLCHAIN=local go mod download GOTOOLCHAIN=local go mod download
mkdir -p .releasekit/bin mkdir -p .releasekit/bin
GOTOOLCHAIN=local GOPROXY=off GOSUMDB=off go build -o .releasekit/bin/releasekit ./cmd/releasekit GOTOOLCHAIN=local GOPROXY=off GOSUMDB=off go build -o .releasekit/bin/releasekit ./cmd/releasekit
.releasekit/bin/releasekit deliver "vX.Y.Z" .releasekit/bin/releasekit deliver "$version"
) )
``` ```
For an older tag whose CLI predates `token_file`, supply the token through its For an older tag whose CLI predates `token_file`, build the tagged executable
environment variable when retrying that tagged tool: as above, then supply the token through its environment variable when retrying:
```sh ```sh
RELEASEKIT_GITEA_TOKEN="$(cat .releasekit/gitea-token)" \ RELEASEKIT_GITEA_TOKEN="$(cat .releasekit/gitea-token)" \

5
docs/roadmap/remediation.md
View File

@@ -262,6 +262,11 @@ name and verify that only the intended tool runs.
### Stage 3: Build the manual retry tool only from a clean tagged checkout ### Stage 3: Build the manual retry tool only from a clean tagged checkout
**Completed.** The retry resolves and checks out the fetched tag and checks
cleanliness before invoking Go. Local probes verified that fetch failure,
checkout failure, and remaining edits stop before Go, and a clean retry
builds and runs the tagged tool for the host.
**Evidence:** The [manual retry block](../release.md) runs `git fetch` and **Evidence:** The [manual retry block](../release.md) runs `git fetch` and
`git checkout --detach` before the subshell that enables `set -e`. A `git checkout --detach` before the subshell that enables `set -e`. A
failed checkout can therefore be followed by dependency preparation, a failed checkout can therefore be followed by dependency preparation, a