Ally Founder
e999719b21
- Commit bun.lock (removes bun.lock/bun.lockb/package-lock.json/deno.lock from .gitignore) so CI reads a pinned revision of the git-dependency @revenge-mod/plugin-cli, which build.gradle.kts already declared as a buildJs input but never had a committed file to read. - Pin wrangler as a devDependency (4.120.0, matching the version already live) so `bunx wrangler deploy` resolves the local pinned install instead of "latest" at every run; verified empirically that bunx follows the local pin, not the cache/latest version. - Pin bun-version in oven-sh/setup-bun@v2 to 1.3.14, the version already in use, so CI's toolchain isn't a moving target either. - Add a post-deploy CI step (.github/scripts/verify-deploy.mjs) that fetches the live index.json, and downloads and sha256-verifies one artifact against the hash the index claims for it, failing the workflow on any mismatch. This promotes the manual verification done during implementation into a permanent regression check. - Add concurrency (cancel superseded deploys on rapid pushes), workflow_dispatch (manual redeploy without an empty commit), and an explicit permissions: contents: read block to deploy.yml. - Document in README.md that next.jarviscli.dev auto-deploys on every push to main, and that a plugin change without a manifest.json version bump silently republishes the same version pointer with different bytes, so already-installed clients never see the update.
22 lines
909 B
JavaScript
22 lines
909 B
JavaScript
// Post-deploy smoke test: confirms the live repository index is valid and that
|
|
// one published plugin's artifact actually matches the sha256 the index claims for it.
|
|
// Run with: bun .github/scripts/verify-deploy.mjs
|
|
|
|
const BASE_URL = process.env.VERIFY_BASE_URL ?? "https://next.jarviscli.dev";
|
|
|
|
const idx = await (await fetch(`${BASE_URL}/index.json`)).json();
|
|
const ids = Object.keys(idx.plugins ?? {});
|
|
if (!ids.length) throw new Error("index.json has no plugins");
|
|
|
|
const [id, plugin] = Object.entries(idx.plugins)[0];
|
|
const version = plugin.channels.latest;
|
|
const v = plugin.versions[version];
|
|
|
|
const buf = await (await fetch(v.url)).arrayBuffer();
|
|
const hash = Buffer.from(await crypto.subtle.digest("SHA-256", buf)).toString("hex");
|
|
|
|
if (hash !== v.sha256) {
|
|
throw new Error(`sha256 mismatch for ${id}: expected ${v.sha256} got ${hash}`);
|
|
}
|
|
|
|
console.log(`Verified ${id}@${version}: sha256 OK`);
|