ci: build and verify all six release targets on every PR#2
Merged
Conversation
…5gvj) Compiling all six targets proves almost nothing about what a user unpacks. scripts/verify-archives.sh asserts, against dist/, the things that break silently per-platform and never fail to compile: - all six archives present, listed in checksums.txt, and matching them (sha256sum -c catches any byte corruption); - unix binaries carry the exec bit as stored IN the tar header; - each Windows zip ships CoinRollHunter.exe, cli/coinrollhunter.exe, and READ ME FIRST.txt; - file(1) confirms CoinRollHunter.exe is the GUI subsystem and the CLI copy is console — i.e. -H=windowsgui actually took (a regression to console ships a flashing black window to every double-click user); - the embedded UI is really in the binary (grep the index.html mount point, since web/dist is a gitignored artifact resolved against a .gitkeep and a bare `go build` without `make ui` serves an EMPTY UI and still exits 0). Runnable locally against dist/; exits nonzero on any failure.
… (om-5gvj) We ship six release targets and verified none of them on any PR — "runs on six platforms" was a promise kept by hand. scripts/release.sh already cross-compiles all six (linux/windows/darwin x amd64/arm64) plus both Windows GUI-subsystem variants from one ubuntu box (CGO_ENABLED=0, pure-Go SQLite), so this is a matter of running the script we already have, not adding an Actions build matrix (which would be six runners doing one runner's job). ci.yml gains three jobs: - release-build (ubuntu): run scripts/release.sh, then verify-archives.sh, then unpack linux/amd64 and start `serve --spot-provider=none`, polling /api/health; uploads the archives for the native smoke jobs. - smoke-windows (windows-latest): start cli/coinrollhunter.exe (the GUI build cannot print) and poll /api/health. - smoke-macos (macos-latest, Apple silicon): start darwin/arm64 and poll /api/health. Honest scope: build all SIX, start THREE. linux/arm64, darwin/amd64 and windows/arm64 stay build-verified only — no hosted runner starts them natively. Runners are free here (public repo). release.yml runs the same verify-archives.sh before publishing, so a tagged release can never ship a corrupt or wrong-subsystem archive either. Both new build legs inherit the go-version-file pin (no floating go-version).
tompscanlan
added a commit
that referenced
this pull request
Jul 15, 2026
…ten decode ceiling (om-6hlp) Verify-stage fixes for adversarial-review findings on the photos branch: - #1 (major, path escape): the upload route ran MkdirAll/CreateTemp on photos/<owner_uid>/... BEFORE validating owner_kind, so an unknown kind + a traversal owner_uid escaped photosDir (empty dir + a transient temp file) before InsertPhoto's Validate rejected it with a 400 — falsifying the feature's own 'traversal structurally impossible' guarantee on the WRITE path. Now owner_kind, owner_uid (uidV4RE), and owner existence are all checked before any filesystem path is built, so the write path matches the serve route's whitelist-before-filesystem. - #4 (test gap): TestUploadRejectsOwnerKindEscapeBeforeTouchingDisk — proven to FAIL pre-fix (created an ESCAPED dir outside photosDir) and PASS post-fix. - #3 (decode DoS): maxPixels 100M->50M, maxDimension 30000->20000 — bounds the decode allocation (~200MB RGBA, recurs per lazy-regen cache miss), not just absurd headers. - #2 (invariant honesty): soften the overstated 'committed row always has its original on disk' claim to record the commit->rename crash window; tracked in om-9occ. Verified independently: go test ./... + -race clean; qa 106/106; live escape probe (happy 201, both attacks 400 with no filesystem escape).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
CI currently runs only build/test/vet on Ubuntu — the six cross-compiled release targets are never built or checked on a PR, so a break in the release path only surfaces at tag time. This wires the existing
scripts/release.sh(which already cross-compiles all six targets and both Windows GUI-subsystem variants from one Linux box,CGO_ENABLED=0) into CI on every PR, and adds archive verification.scripts/verify-archives.sh(new): asserts each archive contains the expected binaries, that the Windows GUI binary really is the GUI subsystem (file(1)on the PE header), that unix binaries carry the exec bit, and that the UI is embedded.ci.yml: newrelease-buildjob (runrelease.sh→verify-archives.sh→ linux/amd64 startup smoke → upload artifacts), plussmoke-windowsandsmoke-macosnative-startup jobs.release.yml: runsverify-archives.shbefore publish, so a tagged release can't ship a bad archive either.No Actions build matrix — the six targets build from a single
ubuntu-latestrunner, so a matrix would be wasteful..goreleaser.yamlis intentionally left alone (it lacks the Windows GUI variant and can't produce what we ship). The new jobs inherit the toolchain fromgo.modviago-version-file.Verified locally
scripts/release.shbuilds all six targets.verify-archives.shpasses on good artifacts and fails on a deliberately corrupted archive and on a GUI→console regression (checked both).What this PR run confirms (only Actions can)
The workflow triggering, the artifact upload/download round-trip, and the two native smoke jobs (windows/amd64, darwin/arm64) — no hosted Windows/macOS runner exists locally. One known unknown: the cross-compiled unsigned darwin binary may carry
com.apple.quarantinewhen artifact-extracted; the macOS smoke job is where we'll find out.Scope is "build all six, start three" — only three targets are natively startable on GitHub runners, and the jobs say so.