authorgravatar for julius0216@outlook.comJulius Marminge <julius0216@outlook.com> 2026-09-15 21:20:38-07:00
committergravatar for julius0216@outlook.comJulius Marminge <julius0216@outlook.com> 2026-09-15 21:20:38-07:00
log3060cc461458e66842dfb656d979c4acca4dfb20
tree4a02750636d8fd53fe6b274480c301d08dcb0455
parent47ef0177dc18d328e91c64a1641cfe1f37298160

fix(release): restrict stable channels to main

4 files changed, 141 insertions(+), 9 deletions(-)

.github/scripts/check-nightly-release.cjs+44-1
......@@ -1,5 +1,43 @@
11const MINIMUM_RELEASE_GAP_MS = 6 * 60 * 60 * 1000;
22
3function repositoryDefaultBranch(context) {
4 const branch = context.payload.repository?.default_branch;
5 if (!branch) {
6 throw new Error("GitHub did not provide the repository default branch.");
7 }
8 return branch;
9}
10
11async function assertCommitOnDefaultBranch({ github, context, sha }) {
12 const defaultBranch = repositoryDefaultBranch(context);
13 const { data: comparison } = await github.rest.repos.compareCommitsWithBasehead({
14 ...context.repo,
15 basehead: `${sha}...${defaultBranch}`,
16 per_page: 1,
17 });
18 if (comparison.status !== "ahead" && comparison.status !== "identical") {
19 throw new Error(
20 `Release commit ${sha} is not contained in ${defaultBranch} (${comparison.status}).`,
21 );
22 }
23}
24
25async function assertReleaseSource({ github, context, releaseChannel }) {
26 if (releaseChannel === "preview") return;
27 if (releaseChannel !== "stable" && releaseChannel !== "nightly") {
28 throw new Error(`Unsupported release channel: ${releaseChannel}`);
29 }
30
31 const defaultBranch = repositoryDefaultBranch(context);
32 if (context.eventName === "workflow_dispatch" && context.ref !== `refs/heads/${defaultBranch}`) {
33 throw new Error(
34 `${releaseChannel} releases must be dispatched from ${defaultBranch}; selected ${context.ref}. Use the preview channel for branch builds.`,
35 );
36 }
37
38 await assertCommitOnDefaultBranch({ github, context, sha: context.sha });
39}
40
341const isNightlyTag = (tag) => /^v.*-nightly\./.test(tag) || tag.startsWith("nightly-v");
442
543// Newest published nightly by publication time, or undefined when none exists.
......@@ -64,4 +102,9 @@ async function resolveLatestNightlyCommit({ github, context, core }) {
64102 return { tag, sha: commit.sha, version };
65103}
66104
67module.exports = { shouldReleaseNightly, resolveLatestNightlyCommit };
105module.exports = {
106 assertCommitOnDefaultBranch,
107 assertReleaseSource,
108 shouldReleaseNightly,
109 resolveLatestNightlyCommit,
110};
.github/scripts/check-nightly-release.test.cjs+76-1
......@@ -1,6 +1,10 @@
11const assert = require("node:assert/strict");
22const test = require("node:test");
3const { shouldReleaseNightly } = require("./check-nightly-release.cjs");
3const {
4 assertCommitOnDefaultBranch,
5 assertReleaseSource,
6 shouldReleaseNightly,
7} = require("./check-nightly-release.cjs");
48
59const now = Date.parse("2026-09-05T12:00:00Z");
610const hour = 60 * 60 * 1000;
......@@ -11,6 +15,77 @@ const nightly = (hoursAgo, overrides = {}) => ({
1115 ...overrides,
1216});
1317
18function releaseSourceFixture({
19 comparisonStatus = "ahead",
20 eventName = "workflow_dispatch",
21 ref = "refs/heads/main",
22 sha = "candidate",
23} = {}) {
24 const calls = [];
25 return {
26 calls,
27 options: {
28 context: {
29 eventName,
30 payload: { repository: { default_branch: "main" } },
31 ref,
32 repo: { owner: "example", repo: "app" },
33 sha,
34 },
35 github: {
36 rest: {
37 repos: {
38 async compareCommitsWithBasehead(params) {
39 calls.push(params);
40 return { data: { status: comparisonStatus } };
41 },
42 },
43 },
44 },
45 },
46 };
47}
48
49test("allows preview releases from any branch without consulting main", async () => {
50 const { options, calls } = releaseSourceFixture({ ref: "refs/heads/feature" });
51 await assertReleaseSource({ ...options, releaseChannel: "preview" });
52 assert.equal(calls.length, 0);
53});
54
55for (const releaseChannel of ["stable", "nightly"]) {
56 test(`rejects a manual ${releaseChannel} release from a feature branch`, async () => {
57 const { options, calls } = releaseSourceFixture({ ref: "refs/heads/feature" });
58 await assert.rejects(
59 assertReleaseSource({ ...options, releaseChannel }),
60 new RegExp(`${releaseChannel} releases must be dispatched from main`),
61 );
62 assert.equal(calls.length, 0);
63 });
64
65 test(`allows a manual ${releaseChannel} release from main`, async () => {
66 const { options, calls } = releaseSourceFixture();
67 await assertReleaseSource({ ...options, releaseChannel });
68 assert.equal(calls[0].basehead, "candidate...main");
69 });
70}
71
72for (const comparisonStatus of ["behind", "diverged"]) {
73 test(`rejects a release commit that is ${comparisonStatus} from main`, async () => {
74 const { options } = releaseSourceFixture({ comparisonStatus, eventName: "push" });
75 await assert.rejects(
76 assertCommitOnDefaultBranch({ ...options, sha: "release-commit" }),
77 new RegExp(`not contained in main \\(${comparisonStatus}\\)`),
78 );
79 });
80}
81
82test("accepts a release commit already contained in main", async () => {
83 for (const comparisonStatus of ["ahead", "identical"]) {
84 const { options } = releaseSourceFixture({ comparisonStatus, eventName: "push" });
85 await assertCommitOnDefaultBranch({ ...options, sha: "release-commit" });
86 }
87});
88
1489function fixture({ releases = [nightly(7)], comparisonStatus = "ahead" } = {}) {
1590 const calls = [];
1691 return {
.github/workflows/release.yml+17-5
......@@ -14,12 +14,12 @@ on:
1414 channel:
1515 description: "Release channel"
1616 required: false
17 default: stable
17 default: preview
1818 type: choice
1919 options:
20 - preview
2021 - stable
2122 - nightly
22 - preview
2323 version:
2424 description: "Stable version override (for example 1.2.3). Defaults to the version the latest nightly previewed."
2525 required: false
......@@ -67,15 +67,27 @@ jobs:
6767 with:
6868 script: |
6969 const {
70 assertCommitOnDefaultBranch,
71 assertReleaseSource,
7072 shouldReleaseNightly,
7173 resolveLatestNightlyCommit,
7274 } = require('./.github/scripts/check-nightly-release.cjs');
7375
76 const dispatchChannel = process.env.DISPATCH_CHANNEL || 'preview';
77 const releaseChannel = context.eventName === 'schedule'
78 ? 'nightly'
79 : context.eventName === 'workflow_dispatch'
80 ? dispatchChannel
81 : 'stable';
82
83 await assertReleaseSource({ github, context, releaseChannel });
84
7485 if (context.eventName === 'schedule') {
7586 core.setOutput('has_changes', await shouldReleaseNightly({ github, context, core }));
7687 core.setOutput('ref', context.sha);
77 } else if (context.eventName === 'workflow_dispatch' && process.env.DISPATCH_CHANNEL !== 'nightly' && process.env.DISPATCH_CHANNEL !== 'preview') {
88 } else if (context.eventName === 'workflow_dispatch' && dispatchChannel === 'stable') {
7889 const { tag, sha, version } = await resolveLatestNightlyCommit({ github, context, core });
90 await assertCommitOnDefaultBranch({ github, context, sha });
7991 core.notice(`Stable release builds ${sha}, the commit shipped by ${tag}.`);
8092 core.setOutput('ref', sha);
8193 core.setOutput('nightly_version', version);
......@@ -133,7 +145,7 @@ jobs:
133145 NIGHTLY_SHA: ${{ needs.resolve_commit.outputs.ref }}
134146 NIGHTLY_RUN_NUMBER: ${{ github.run_number }}
135147 run: |
136 if [[ "${GITHUB_EVENT_NAME}" == "schedule" || ( "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${DISPATCH_CHANNEL:-stable}" == "nightly" ) ]]; then
148 if [[ "${GITHUB_EVENT_NAME}" == "schedule" || ( "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${DISPATCH_CHANNEL:-preview}" == "nightly" ) ]]; then
137149 nightly_date="$(date -u -d "$NIGHTLY_DATE" +%Y%m%d)"
138150
139151 node scripts/resolve-nightly-release.ts \
......@@ -146,7 +158,7 @@ jobs:
146158 echo "cli_dist_tag=nightly" >> "$GITHUB_OUTPUT"
147159 echo "is_prerelease=true" >> "$GITHUB_OUTPUT"
148160 echo "make_latest=false" >> "$GITHUB_OUTPUT"
149 elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${DISPATCH_CHANNEL:-stable}" == "preview" ]]; then
161 elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${DISPATCH_CHANNEL:-preview}" == "preview" ]]; then
150162 # Manual-only test train: exercises the whole release flow for a
151163 # commit end users must never receive. Never scheduled.
152164 # Same versioning as nightly under its own prerelease identifier.
docs/operations/release.md+4-2
......@@ -8,11 +8,13 @@ This document covers the unified release workflow for stable and nightly desktop
88
99- Workflow: `.github/workflows/release.yml`
1010- Triggers:
11 - manual `workflow_dispatch` with `channel=stable`, the normal way to ship stable
11 - manual `workflow_dispatch` with `channel=stable`, the normal way to ship stable. Stable
12 and nightly dispatches must select `main`; preview may select any branch. The channel defaults
13 to preview so an omitted selection cannot publish a stable release.
1214 - push tag matching `v*.*.*` for a stable release of an explicit commit
1315 - scheduled nightly check every 30 minutes
1416 - manual `workflow_dispatch` with `channel=nightly`
15 - manual `workflow_dispatch` with `channel=preview`, the maintainers' test train. It exercises the whole release flow (build, sign, notarize, smoke, publish) for a commit that end users must never receive, which is how an unmerged branch or a risky change gets a real release run before it lands. It builds the triggering commit with nightly's versioning under the `preview` prerelease identifier (`0.0.41-preview.<date>.<run>`) and publishes a GitHub prerelease plus the npm packages under the `preview` dist-tag. Nothing ever selects preview on its own: it is not on the schedule, no default npm dist-tag points at it, its desktop builds carry no update feed, and no updater manifest (`latest*.yml`, `nightly*.yml`, blockmaps) is attached, so a stable or nightly install cannot be offered one. The only ways onto it are downloading the release by hand, `npx t3@preview`, `T3CODE_CHANNEL=preview` for the install scripts, or `t3 update --channel preview` from a terminal; each prints a warning, and the CLI asks for confirmation when the running build is not itself a preview. The release itself is named as a maintainer test build and its body is a warning rather than generated notes: a changelog of unmerged branch history is not a changelog, and nightly and stable notes are unaffected because each series resolves its previous tag within its own channel. The hosted web app, AUR, and Discord announcements are skipped. Keep it; it costs nothing when idle.
17 - manual `workflow_dispatch` with `channel=preview`, the maintainers' test train. It exercises the whole release flow (build, sign, notarize, smoke, publish) for a commit that end users must never receive, which is how an unmerged branch or a risky change gets a real release run before it lands. It builds the triggering commit with nightly's versioning under the `preview` prerelease identifier (`0.0.41-preview.<date>.<run>`) and publishes a GitHub prerelease plus the npm packages under the `preview` dist-tag. Preview is not on the schedule, no default npm dist-tag points at it, its desktop builds carry no update feed, and no updater manifest (`latest*.yml`, `nightly*.yml`, blockmaps) is attached, so a stable or nightly install cannot be offered one. The only ways onto it are downloading the release by hand, `npx t3@preview`, `T3CODE_CHANNEL=preview` for the install scripts, or `t3 update --channel preview` from a terminal; each prints a warning, and the CLI asks for confirmation when the running build is not itself a preview. The release itself is named as a maintainer test build and its body is a warning rather than generated notes: a changelog of unmerged branch history is not a changelog, and nightly and stable notes are unaffected because each series resolves its previous tag within its own channel. The hosted web app, AUR, and Discord announcements are skipped. Keep it; it costs nothing when idle.
1618- A manual stable release builds the commit of the latest published nightly, not `main` HEAD.
1719 Nightly is the release candidate: verify the nightly, then promote it. Merges to `main` keep
1820 landing while you verify and never leak into the stable build.