Tags: ever-co/ever-gauzy
Tags
ci: Linux VM runners + drop DO Spaces publisher (stage cherry-pick of #… …9827) (#9829) * ci: run Linux app packaging on VM runners + drop dead DO Spaces publisher First app-build wave since the ARC migration (v111.5.3, stage-apps 5b64c3f) exposed two deterministic failures unrelated to the app code: 1. release-linux died on the k8s ARC container runners: flatpak needs bwrap mount namespaces ("bwrap: Failed to make / slave: Permission denied") and snapcraft needs snapd - neither works in an unprivileged container. These packaging jobs ran on VM-class runners (ubicloud) until the RUNNER_LINUX_X64_8 conversion pointed them at the ARC fleet. Route them to a dedicated RUNNER_LINUX_APPS_X64 variable falling back to GitHub-hosted ubuntu-latest VMs (free for this public repo); the ARC labels stay for everything that does not package flatpak/snap. 2. electron-builder still uploaded artifacts to the DigitalOcean Spaces bucket 'ever' (sfo3); the DO account is gone, every upload 404s with NoSuchBucket and aborts the build after signing (seen on the MCP server Windows build). Remove the 'spaces' publisher from all 12 publish configs (6 apps x prerelease/release) - GitHub Releases remains the publish target. The DO_KEY_ID/DO_SECRET_KEY envs still passed by the workflows are now unused and can be cleaned up separately. * chore: add bwrap to the cspell dictionary --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
ci: run Linux app packaging on VM runners + drop dead DO Spaces publi… …sher (#9827) * ci: run Linux app packaging on VM runners + drop dead DO Spaces publisher First app-build wave since the ARC migration (v111.5.3, stage-apps 5b64c3f) exposed two deterministic failures unrelated to the app code: 1. release-linux died on the k8s ARC container runners: flatpak needs bwrap mount namespaces ("bwrap: Failed to make / slave: Permission denied") and snapcraft needs snapd - neither works in an unprivileged container. These packaging jobs ran on VM-class runners (ubicloud) until the RUNNER_LINUX_X64_8 conversion pointed them at the ARC fleet. Route them to a dedicated RUNNER_LINUX_APPS_X64 variable falling back to GitHub-hosted ubuntu-latest VMs (free for this public repo); the ARC labels stay for everything that does not package flatpak/snap. 2. electron-builder still uploaded artifacts to the DigitalOcean Spaces bucket 'ever' (sfo3); the DO account is gone, every upload 404s with NoSuchBucket and aborts the build after signing (seen on the MCP server Windows build). Remove the 'spaces' publisher from all 12 publish configs (6 apps x prerelease/release) - GitHub Releases remains the publish target. The DO_KEY_ID/DO_SECRET_KEY envs still passed by the workflows are now unused and can be cleaned up separately. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore: add bwrap to the cspell dictionary Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
ci: accept PR-merge promotions in the app release-tag gate (stage che… …rry-pick of #9818) (#9819) The check-release-tag gate (added on #9780 review) only accepted a vX.Y.Z release tag pointing at HEAD, assuming apps branches are promoted by fast-forward. Real promotions are GitHub PR merges (e.g. #9813, stage -> stage-apps), which create a merge commit the tag can never point at - so all six app build workflows polled ~15 min and died on their own timeout-minutes (reported as cancelled, masking the gate error) and every release-* job was skipped. See run 29754352240. Gate changes (all 18 app workflows): - Resolve the release tag at HEAD, or - only when HEAD^2 equals the current remote tip of the promoted-from branch (master/stage/develop) - at HEAD^2, the merged tip a promotion PR leaves the tag on. The source-tip equality keeps the old guarantees: an arbitrary tagged branch merged into an apps branch still fails the gate, and a fast-forward promotion racing the Release workflow keeps polling for HEAD's own tag instead of silently stamping the previous version from HEAD^2. - Poll with a cheap `git ls-remote` ref listing instead of refetching all tag objects every attempt (the old fetch took 60-90s/attempt on large tag counts, which is what pushed the loop past its own timeout). - timeout-minutes 15 -> 30 so the failure path surfaces the ::error message instead of a bare cancellation. - checkout fetch-depth: 2 so HEAD^2 resolves on merge commits. - Export the resolved tag as a job output. Version stamping: - Build jobs pass the gate's tag to bump-version-electron.js as GAUZY_RELEASE_TAG; the script prefers it over re-resolving. Previously an untagged merge commit fell back to the globally-latest tag, which would stamp a newer develop version onto stage/prod artifacts - the exact mislabeling the gate exists to prevent. Ad-hoc temp builds (no gate tag) keep the old fallback behavior. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
ci: accept PR-merge promotions in the app release-tag gate (#9818) The check-release-tag gate (added on #9780 review) only accepted a vX.Y.Z release tag pointing at HEAD, assuming apps branches are promoted by fast-forward. Real promotions are GitHub PR merges (e.g. #9813, stage -> stage-apps), which create a merge commit the tag can never point at - so all six app build workflows polled ~15 min and died on their own timeout-minutes (reported as cancelled, masking the gate error) and every release-* job was skipped. See run 29754352240. Gate changes (all 18 app workflows): - Resolve the release tag at HEAD, or - only when HEAD^2 equals the current remote tip of the promoted-from branch (master/stage/develop) - at HEAD^2, the merged tip a promotion PR leaves the tag on. The source-tip equality keeps the old guarantees: an arbitrary tagged branch merged into an apps branch still fails the gate, and a fast-forward promotion racing the Release workflow keeps polling for HEAD's own tag instead of silently stamping the previous version from HEAD^2. - Poll with a cheap `git ls-remote` ref listing instead of refetching all tag objects every attempt (the old fetch took 60-90s/attempt on large tag counts, which is what pushed the loop past its own timeout). - timeout-minutes 15 -> 30 so the failure path surfaces the ::error message instead of a bare cancellation. - checkout fetch-depth: 2 so HEAD^2 resolves on merge commits. - Export the resolved tag as a job output. Version stamping: - Build jobs pass the gate's tag to bump-version-electron.js as GAUZY_RELEASE_TAG; the script prefers it over re-resolving. Previously an untagged merge commit fell back to the globally-latest tag, which would stamp a newer develop version onto stage/prod artifacts - the exact mislabeling the gate exists to prevent. Ad-hoc temp builds (no gate tag) keep the old fallback behavior. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
PreviousNext