docs: record the four release-pipeline blockers and their fixes #30
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: stale-secrets-check | |
| # Catches two failure modes of the chunked-secret release flow before the | |
| # real build runs: | |
| # | |
| # 1. Secret corruption in transit (chunked base64 over Actions env vars | |
| # is robust, but a single bit-flip in 12 secrets would otherwise | |
| # produce a build that dies in tarfile.extract with no actionable | |
| # pointer at the cause). | |
| # | |
| # 2. Drift between the secrets and the working tree. If the maintainer | |
| # edited src/*.rs locally and forgot to re-pack + refresh the | |
| # GitHub secrets, the chunks currently in CI do not match the source | |
| # the build will be tested against. Without this check the wheel | |
| # ships and the discrepancy is invisible. | |
| # | |
| # The check uses `python scripts/pack_rust_core.py verify`, which is | |
| # already part of the repo. No script changes required. | |
| # | |
| # This is a one-command, ~10s job that runs on every push and PR. If it | |
| # fails the rest of the suite still runs (so a real source bug is not | |
| # hidden behind a stale-secret error) but the failure surfaces a clear | |
| # "you need to re-pack and refresh the RUST_SRC_B64_* secrets" message | |
| # in the run log. | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| workflow_dispatch: | |
| jobs: | |
| verify-packed-secrets: | |
| name: packed secrets match working tree | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Verify packed secrets | |
| env: | |
| RUST_SRC_B64_1: ${{ secrets.RUST_SRC_B64_1 }} | |
| RUST_SRC_B64_2: ${{ secrets.RUST_SRC_B64_2 }} | |
| RUST_SRC_B64_3: ${{ secrets.RUST_SRC_B64_3 }} | |
| RUST_SRC_B64_4: ${{ secrets.RUST_SRC_B64_4 }} | |
| RUST_SRC_B64_5: ${{ secrets.RUST_SRC_B64_5 }} | |
| RUST_SRC_B64_6: ${{ secrets.RUST_SRC_B64_6 }} | |
| RUST_SRC_B64_7: ${{ secrets.RUST_SRC_B64_7 }} | |
| RUST_SRC_B64_8: ${{ secrets.RUST_SRC_B64_8 }} | |
| RUST_SRC_B64_9: ${{ secrets.RUST_SRC_B64_9 }} | |
| RUST_SRC_B64_10: ${{ secrets.RUST_SRC_B64_10 }} | |
| RUST_SRC_B64_11: ${{ secrets.RUST_SRC_B64_11 }} | |
| RUST_SRC_B64_12: ${{ secrets.RUST_SRC_B64_12 }} | |
| run: | | |
| # First, restore the proprietary Rust core from the secrets so | |
| # `verify` has something to compare against. | |
| python scripts/pack_rust_core.py unpack --from-env | |
| # Then, re-pack the just-restored tree and compare its SHA-256 | |
| # to the SHA-256 of the chunked archive. The archives are | |
| # deterministic (fixed mtime, sorted names) so a matching hash | |
| # is a real guarantee that the secrets are self-consistent. | |
| python scripts/pack_rust_core.py verify --from-env | |
| # `verify` above proves the secrets are self-consistent, which on a | |
| # fresh checkout is all it CAN prove: src/* is gitignored and absent | |
| # until the line above restores it, so the comparison is the secrets | |
| # against themselves. It cannot see failure mode 2 in this file's | |
| # header - a maintainer who edited src/, re-packed, and never ran | |
| # `gh secret set`. That drift is exactly what shipped a local fix | |
| # nowhere for hours. | |
| # | |
| # rust_core.sha256 IS tracked, so it travels with the commit. Compare | |
| # the restored tree against it: if the secrets are older than the last | |
| # pack, the digests differ and this fails with instructions. | |
| python scripts/pack_rust_core.py check-manifest |