Repository navigation
fix(ci): recover immutable releases and retain honest public upgrade checks - #9
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 727c983d5b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| assert len(names)==len(set(names))==22 | ||
| assert replies[2]['result']['isError'] is False | ||
| caps=replies[2]['result']['structuredContent'] | ||
| assert sum(len(caps[key]) for key in ('videoModels','imageModels','audioModels'))==16 |
There was a problem hiding this comment.
The shipped capabilities_list tool returns structuredContent with snapshotVersion, publishedAt, and a single models array, not videoModels, imageModels, and audioModels. Running the MCP exchange locally confirms that this assertion raises KeyError: 'videoModels'. Consequently, every new public-install-and-upgrade matrix job fails during fresh-install verification and never exercises the v0.5.0 upgrade. Count caps['models'] instead.
Useful? React with 👍 / 👎.
| self.install('actual-v050-install','v0.5.0',old) | ||
| self.cli('isolated-key',old,'auth','set-key','--stdin','--no-verify',input='hc-isolated-release-test-not-a-real-key\n') | ||
| config=Path(old['HOLYCRAB_CONFIG_DIR']);plans=config/'upload-plans';plans.mkdir(exist_ok=True) | ||
| (config/'attempts.json').write_text(json.dumps({'retainedAttempt':{'state':'unknown','taskId':'known-task'}})) |
There was a problem hiding this comment.
On Linux and macOS with a typical umask of 022, write_text() creates this ledger with mode 0644, but state.load_attempts() explicitly rejects any Unix ledger with group or other permission bits. After the MCP assertion is corrected, this fixture therefore causes the upgraded installation's doctor --json check in verify_new() to fail despite a successful upgrade. Create the fixture through write_private_json() or explicitly set mode 0600 before running the CLI.
Useful? React with 👍 / 👎.
cyaolong
changed the title
The v0.6.0 release workflow failed when checkout's lightweight local tag collided with the remote annotated tag. Use an independent fetch ref and verify the exact release commit; every manual validation/publication job checks out the immutable requested tag. The official v0.6.0 tag and all 25 shipped files remain unchanged.
Adds repeatable public installation and genuine v0.5.0 upgrade checks with isolated credentials, valid legacy recovery records, private file permissions, native PowerShell 5.1 setup, complete runtime/MCP checks and observed uninstall completion. Website metadata verification uses the scoped read-only Actions token only in its verification step, avoiding shared-runner anonymous API limits; installers receive no token. Failed self-updates retain version/doctor diagnostics and remain failed. Official-installer upgrades are an explicitly separate path.
Validation:
Website commit 2d117885 synchronizes only 25 CLI installer/version/guide files, explicitly approved by the user. Four deployed files match Release bytes and all five language installation pages reference v0.6.0. User working trees and business data were not used in post-release checks.