feat(release): macos/linux release artifacts + cross-platform Skill bootstrap (#59 P2) - #65
Merged
Merged
Conversation
…gate (#59 P2) release.yml restructured into three jobs: - release-windows keeps the full authoritative gate chain and now uploads its dist as a workflow artifact instead of publishing - package-unix (macos-latest/ubuntu-latest matrix): build --locked, the same release-blocking self-scan, packaging that preserves the executable bit (chmod 755 + system zip; Compress-Archive cannot carry POSIX modes), the same sha256 sidecar and release-manifest fields, and a packaged validation that executes the extracted binary (proving the exec bit survived) - publish (needs both): downloads all dists, fail-closed 9-asset inventory with sidecar re-hash, attests all three ZIPs, single no-clobber gh release. Workflow-level permissions dropped to contents:read; only publish holds contents:write + id-token + attestations. bootstrap.py: win32 raise replaced by a platform map (windows/macos/linux, clear error otherwise); POSIX modes restored from ZipInfo.external_attr on extraction with a fail-closed executable check on bin/code-intel after install; pwsh requirement message made platform-neutral; platform recorded in the plan JSON. tools/New-BetaPackage.ps1 / Test-BetaPackage.ps1: binary name parameterized (-BinaryName, default code-intel.exe, bare-name guard) - CLI contract unchanged. docs/public-beta.md and README: existing releases (<= v0.6.0) stay Windows-only; from the next tag onward all three platform ZIPs ship, same attestation verify applies, pwsh 7.2+ still required everywhere. Refs #59 (proposal 2 of 8; 5 and 6 remain open there)
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (7)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe release pipeline now builds, validates, and publishes Windows, macOS, and Linux ZIPs. Bootstrap selects platform assets, restores Unix executable permissions, and uses platform-specific paths. Packaging scripts accept binary names, while tests and documentation cover the expanded distribution model. ChangesCross-platform release distribution
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related issues
Possibly related PRs
Poem
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements proposal 2 of #59: every release from the next tag ships
code-intel-pipeline-<tag>-{windows,macos,linux}.zip, and the Skill bootstrap installs them on all three platforms.release.yml: one gate chain, three packages, one publisher
cargo build --release --locked, the same release-blocking self-scan, packaging viachmod 755+ systemzip(PowerShellCompress-Archivecannot carry POSIX modes), identical.sha256sidecar andcode-intel-release-manifest.v1fields, and a packaged validation that executes the binary straight from the extracted zip — proving the exec bit survived the round trip.needsboth) — downloads all dists, fail-closed 9-asset inventory with sidecar re-hash, attests all three ZIPs, then the original no-clobbergh releaselogic extended to 9 assets. Privilege split: workflow-level permissions dropped tocontents: read; onlypublishholdscontents:write + id-token + attestations— no build step ever sees a write-capable token.bootstrap.py: platform map + executable-bit restore
win32-only raise → platform map (windows/macos/linux; clear error otherwise), threaded into asset selection and recorded in the plan JSON.ZipInfo.external_attrduring extraction; after install, a fail-closed check ensuresbin/code-intelis executable (fallbackchmod 0o755).Also
New-BetaPackage.ps1/Test-BetaPackage.ps1:-BinaryNameparameter (defaultcode-intel.exe, bare-name guard) — existing callers unaffected.docs/public-beta.md+ README: honest versioned statement — releases ≤ v0.6.0 stay Windows-only; next tag onward ships all three; attestation verify applies to every ZIP.Verification
python tests/test_skill_package.py/test_repository_layout.py: OK (new cases: platform map incl. unsupported-platform error, mode-restore from crafted ZipInfo).yaml.safe_loadon release.yml passes; all embedded pwsh blocks parser-checked; action pins verified (download-artifactpin confirmed = v4.3.0 viagit ls-remote, chosen to match the repo's upload-artifact v4 generation).Refs #59 — proposals 5 (cargo install / brew) and 6 (CI real-user assertions) remain open there.