Skip to content

Commit b077113

Browse files
arul28claude
arul28
and
claude
authored
Final Release Audit (#561)
* Release pipeline: mac-only DMG surface, brew tap, update-impact warnings - release-core.yml: comment out Windows build + publish; publish only the 4-asset macOS set (dmg + zip + blockmap + latest-mac.yml) that electron-updater requires; runtime binaries still build as app sidecars but are no longer published as release assets - validators: add ade-orchestrator to bundledAgentSkills (mac + win) - new update install impact probe (connected phones via sync status, in-process + runtime-backed) surfaced in the pre-install confirm and the quit dialog, with ADE Code / agent-session disconnect copy - scripts/update-brew-tap.sh + /release skill phase 8 updated for mac-only assets and post-publish cask bump; README gets brew install command Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Close isolated-brain gap, automate brew tap bump, scrub stale headless-install docs - isolated recovery now re-attempts the service install (60s cooldown) when the primary-socket probe fails, instead of probing forever against a socket nothing will ever bind; regression test added - runtimeMode (primary|isolated) exposed in LocalRuntimeStatus, shown in Settings > About, and surfaced via native notifications on degrade/restore - update-brew-tap.yml bumps the arul28/homebrew-ade cask on release publish using a write deploy key (HOMEBREW_TAP_DEPLOY_KEY secret, already set) - ade-cli README / ARCHITECTURE / remote-runtime docs now state that runtime release assets are unpublished and SSH bootstrap uses bundled sidecars Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ship: iter 1 — address review (phone filter, isolated-recovery race, brew-tap robustness) - main.ts: use canonical phone convention (deviceType "phone" AND platform "iOS") for update-impact warning, matching the phone device list + APNS targeting (Greptile P1 / CodeRabbit). - localRuntimeConnectionPool: confirm the isolated connection is still current before clearing the recovery timer, so a raced connection swap can't strand the pool in "isolated" mode with no retry (CodeRabbit). - update-brew-tap.sh: portable in-place sed, repo-local git identity for the fallback commit, and a loud guard if the cask substitution silently no-ops (Greptile P2 / CodeRabbit). - update-brew-tap.yml: same silent-no-op guard after the sed bumps. - release SKILL.md: align the Phase 5 draft-asset expectation to the mac-only set. Declined: pinning GitHub's SSH host key in update-brew-tap.yml — ssh-keyscan to github.com from a GitHub-hosted runner is standard and low-risk; pinning adds a key-rotation maintenance burden that can itself silently break the auto-bump. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
1 parent 4712bdf commit b077113

21 files changed

Lines changed: 584 additions & 137 deletions

File tree

‎.agents/skills/release/SKILL.md‎

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -271,9 +271,9 @@ RELEASE_SHA=$(git rev-parse origin/main)
271271
272272
Leave `isDraft=true`. Do not publish.
273273
274-
Expect the draft to carry both macOS and Windows assets once `publish-release` runs:
275-
- macOS: `ADE-<version>-universal.dmg`, `ADE-<version>-universal-mac.zip`, `ADE-<version>-universal-mac.zip.blockmap`, `latest-mac.yml`
276-
- Windows: `ADE-<version>-win-x64.exe`, `ADE-<version>-win-x64.exe.blockmap`, `latest.yml`
274+
Expect the draft to carry the macOS-only asset set once `publish-release` runs
275+
(the Windows/runtime surface is currently disabled in `release-core.yml`):
276+
- `ADE-<version>-universal.dmg`, `ADE-<version>-universal-mac.zip`, `ADE-<version>-universal-mac.zip.blockmap`, `latest-mac.yml`
277277
278278
---
279279
@@ -465,17 +465,17 @@ Before printing the summary, verify the draft release carries every expected ass
465465
gh release view "v<VERSION>" --json assets --jq '.assets[].name' | sort
466466
```
467467
468-
Expected asset set when `scope.desktop=true`:
468+
Expected asset set when `scope.desktop=true` (releases are macOS-only right now;
469+
Windows publishing is commented out in `release-core.yml`):
469470
- `ADE-<version>-universal.dmg`
470471
- `ADE-<version>-universal-mac.zip`
471472
- `ADE-<version>-universal-mac.zip.blockmap`
472473
- `latest-mac.yml`
473-
- `ADE-<version>-win-x64.exe`
474-
- `ADE-<version>-win-x64.exe.blockmap`
475-
- `latest.yml`
476474
477-
If any macOS asset is missing → mac build or upload broke; re-inspect the `build-mac-release` job.
478-
If any Windows asset is missing → `build-win-release` broke or its artifact upload failed; re-inspect that job. Do not flip the draft if Windows artifacts are missing — shipping an asymmetric desktop release will confuse electron-updater consumers on the missing platform.
475+
These four are the complete set — the zip + blockmap + `latest-mac.yml` are what
476+
electron-updater consumes for auto-update (macOS updates install from the zip,
477+
not the DMG), so a release missing any of them silently bricks auto-update.
478+
If any asset is missing → mac build or upload broke; re-inspect the `build-mac-release` job.
479479
480480
Then print a single final block and stop:
481481
@@ -484,12 +484,17 @@ Release v<VERSION> — summary
484484
485485
- Changelog: https://www.ade-app.dev/docs/changelog/v<VERSION>
486486
- Draft release: <gh release url> (still draft — flip manually)
487-
- Desktop assets: mac=<present|MISSING>, windows=<present|MISSING>
487+
- Desktop assets: mac=<present|MISSING>
488488
- Workflow run: <gh run url> (conclusion: success)
489489
- iOS TestFlight build <BUILD_NUMBER>: <VALID | processing | skipped>
490490
- Beta group: <group name | n/a>
491491
492-
Next step: review the draft release, then `gh release edit v<VERSION> --draft=false` to publish.
492+
Next steps:
493+
1. Review the draft release, then `gh release edit v<VERSION> --draft=false` to publish.
494+
2. Publishing automatically bumps the Homebrew tap (arul28/homebrew-ade) via the
495+
`update-brew-tap.yml` workflow — verify with
496+
`gh run list --workflow update-brew-tap.yml --limit 1` after publishing.
497+
Manual fallback if that run fails: `scripts/update-brew-tap.sh v<VERSION>`.
493498
```
494499
495500
If any phase ended in `blocked`, the summary says `BLOCKED` at the top with the failing phase and the command to resume.

‎.github/workflows/release-core.yml‎

Lines changed: 125 additions & 107 deletions
Original file line numberDiff line numberDiff line change
@@ -175,74 +175,78 @@ jobs:
175175
apps/desktop/release/latest-mac.yml
176176
if-no-files-found: error
177177

178-
build-win-release:
179-
needs:
180-
- verify
181-
- build-runtime-binaries
182-
runs-on: windows-latest
183-
concurrency:
184-
group: release-${{ inputs.release_tag }}-win
185-
cancel-in-progress: true
186-
steps:
187-
- uses: actions/checkout@v4
188-
with:
189-
ref: ${{ inputs.target_ref }}
190-
fetch-depth: 0
191-
192-
- uses: actions/setup-node@v4
193-
with:
194-
node-version: 22
195-
cache: npm
196-
cache-dependency-path: |
197-
apps/desktop/package-lock.json
198-
apps/ade-cli/package-lock.json
199-
200-
- name: Install desktop dependencies
201-
run: cd apps/desktop && npm ci
202-
203-
- name: Install ADE CLI dependencies
204-
run: cd apps/ade-cli && npm ci
205-
206-
- name: Download ADE runtime binaries
207-
uses: actions/download-artifact@v4
208-
with:
209-
pattern: ade-runtime-*
210-
path: apps/desktop/resources/runtime
211-
merge-multiple: true
212-
213-
- name: Materialize ADE runtime resources
214-
env:
215-
ADE_RUNTIME_ARTIFACTS_DIR: ${{ github.workspace }}\apps\desktop\resources\runtime
216-
run: cd apps/desktop && npm run materialize:runtime-resources
217-
218-
- name: Stamp release version
219-
env:
220-
ADE_RELEASE_TAG: ${{ inputs.release_tag }}
221-
run: cd apps/desktop && npm run version:release
222-
223-
- name: Reset release output
224-
shell: pwsh
225-
run: |
226-
Remove-Item -Recurse -Force apps/desktop/release, apps/desktop/.cache -ErrorAction SilentlyContinue
227-
New-Item -ItemType Directory -Path apps/desktop/.cache | Out-Null
228-
229-
- name: Build and validate Windows release
230-
env:
231-
ELECTRON_CACHE: ${{ github.workspace }}\apps\desktop\.cache\electron
232-
ELECTRON_BUILDER_CACHE: ${{ github.workspace }}\apps\desktop\.cache\electron-builder
233-
CSC_LINK: ${{ ((secrets.WINDOWS_CSC_LINK || secrets.WIN_CSC_LINK) && (secrets.WINDOWS_CSC_KEY_PASSWORD || secrets.WIN_CSC_KEY_PASSWORD)) && (secrets.WINDOWS_CSC_LINK || secrets.WIN_CSC_LINK) || '' }}
234-
CSC_KEY_PASSWORD: ${{ ((secrets.WINDOWS_CSC_LINK || secrets.WIN_CSC_LINK) && (secrets.WINDOWS_CSC_KEY_PASSWORD || secrets.WIN_CSC_KEY_PASSWORD)) && (secrets.WINDOWS_CSC_KEY_PASSWORD || secrets.WIN_CSC_KEY_PASSWORD) || '' }}
235-
run: cd apps/desktop && npm run dist:win
236-
237-
- name: Upload validated Windows artifacts to workflow run
238-
uses: actions/upload-artifact@v4
239-
with:
240-
name: ade-win-release-${{ inputs.release_tag }}
241-
path: |
242-
apps/desktop/release/*.exe
243-
apps/desktop/release/*.exe.blockmap
244-
apps/desktop/release/latest.yml
245-
if-no-files-found: error
178+
# Windows release builds are disabled for now — ADE ships macOS-only releases.
179+
# To re-enable: uncomment this job, add `build-win-release` back to
180+
# publish-release `needs`, and restore the win blocks in the publish job
181+
# (artifact download, manifest validation, upload list).
182+
# build-win-release:
183+
# needs:
184+
# - verify
185+
# - build-runtime-binaries
186+
# runs-on: windows-latest
187+
# concurrency:
188+
# group: release-${{ inputs.release_tag }}-win
189+
# cancel-in-progress: true
190+
# steps:
191+
# - uses: actions/checkout@v4
192+
# with:
193+
# ref: ${{ inputs.target_ref }}
194+
# fetch-depth: 0
195+
#
196+
# - uses: actions/setup-node@v4
197+
# with:
198+
# node-version: 22
199+
# cache: npm
200+
# cache-dependency-path: |
201+
# apps/desktop/package-lock.json
202+
# apps/ade-cli/package-lock.json
203+
#
204+
# - name: Install desktop dependencies
205+
# run: cd apps/desktop && npm ci
206+
#
207+
# - name: Install ADE CLI dependencies
208+
# run: cd apps/ade-cli && npm ci
209+
#
210+
# - name: Download ADE runtime binaries
211+
# uses: actions/download-artifact@v4
212+
# with:
213+
# pattern: ade-runtime-*
214+
# path: apps/desktop/resources/runtime
215+
# merge-multiple: true
216+
#
217+
# - name: Materialize ADE runtime resources
218+
# env:
219+
# ADE_RUNTIME_ARTIFACTS_DIR: ${{ github.workspace }}\apps\desktop\resources\runtime
220+
# run: cd apps/desktop && npm run materialize:runtime-resources
221+
#
222+
# - name: Stamp release version
223+
# env:
224+
# ADE_RELEASE_TAG: ${{ inputs.release_tag }}
225+
# run: cd apps/desktop && npm run version:release
226+
#
227+
# - name: Reset release output
228+
# shell: pwsh
229+
# run: |
230+
# Remove-Item -Recurse -Force apps/desktop/release, apps/desktop/.cache -ErrorAction SilentlyContinue
231+
# New-Item -ItemType Directory -Path apps/desktop/.cache | Out-Null
232+
#
233+
# - name: Build and validate Windows release
234+
# env:
235+
# ELECTRON_CACHE: ${{ github.workspace }}\apps\desktop\.cache\electron
236+
# ELECTRON_BUILDER_CACHE: ${{ github.workspace }}\apps\desktop\.cache\electron-builder
237+
# CSC_LINK: ${{ ((secrets.WINDOWS_CSC_LINK || secrets.WIN_CSC_LINK) && (secrets.WINDOWS_CSC_KEY_PASSWORD || secrets.WIN_CSC_KEY_PASSWORD)) && (secrets.WINDOWS_CSC_LINK || secrets.WIN_CSC_LINK) || '' }}
238+
# CSC_KEY_PASSWORD: ${{ ((secrets.WINDOWS_CSC_LINK || secrets.WIN_CSC_LINK) && (secrets.WINDOWS_CSC_KEY_PASSWORD || secrets.WIN_CSC_KEY_PASSWORD)) && (secrets.WINDOWS_CSC_KEY_PASSWORD || secrets.WIN_CSC_KEY_PASSWORD) || '' }}
239+
# run: cd apps/desktop && npm run dist:win
240+
#
241+
# - name: Upload validated Windows artifacts to workflow run
242+
# uses: actions/upload-artifact@v4
243+
# with:
244+
# name: ade-win-release-${{ inputs.release_tag }}
245+
# path: |
246+
# apps/desktop/release/*.exe
247+
# apps/desktop/release/*.exe.blockmap
248+
# apps/desktop/release/latest.yml
249+
# if-no-files-found: error
246250

247251
build-runtime-binaries:
248252
needs: verify
@@ -377,7 +381,6 @@ jobs:
377381
needs:
378382
- build-runtime-binaries
379383
- build-mac-release
380-
- build-win-release
381384
runs-on: ubuntu-latest
382385
steps:
383386
- uses: actions/checkout@v4
@@ -391,23 +394,33 @@ jobs:
391394
name: ade-mac-release-${{ inputs.release_tag }}
392395
path: release-assets/mac
393396

394-
- name: Download Windows release artifacts
395-
uses: actions/download-artifact@v4
396-
with:
397-
name: ade-win-release-${{ inputs.release_tag }}
398-
path: release-assets/win
399-
400-
- name: Download ADE runtime binaries
401-
uses: actions/download-artifact@v4
402-
with:
403-
pattern: ade-runtime-*
404-
path: release-assets/runtime
405-
merge-multiple: true
406-
407-
- name: Add standalone runtime installer
408-
run: |
409-
cp apps/ade-cli/scripts/install-runtime.sh release-assets/runtime/install.sh
410-
chmod 755 release-assets/runtime/install.sh
397+
# Windows artifacts and the standalone runtime assets (ade-* binaries,
398+
# native tarballs, install.sh) are intentionally NOT published right now.
399+
# The release surface is macOS-only and kept minimal: the DMG for humans,
400+
# plus the zip + blockmap + latest-mac.yml that electron-updater requires
401+
# for auto-update (macOS auto-update installs from the zip, NOT the DMG —
402+
# removing those three assets silently bricks updates for every install).
403+
# The runtime binaries are still BUILT above because the macOS app bundles
404+
# them as sidecars (local brain + remote-runtime bootstrap payloads).
405+
# To publish them again, restore the blocks below.
406+
#
407+
# - name: Download Windows release artifacts
408+
# uses: actions/download-artifact@v4
409+
# with:
410+
# name: ade-win-release-${{ inputs.release_tag }}
411+
# path: release-assets/win
412+
#
413+
# - name: Download ADE runtime binaries
414+
# uses: actions/download-artifact@v4
415+
# with:
416+
# pattern: ade-runtime-*
417+
# path: release-assets/runtime
418+
# merge-multiple: true
419+
#
420+
# - name: Add standalone runtime installer
421+
# run: |
422+
# cp apps/ade-cli/scripts/install-runtime.sh release-assets/runtime/install.sh
423+
# chmod 755 release-assets/runtime/install.sh
411424

412425
- name: Validate publish asset manifest
413426
run: |
@@ -440,23 +453,26 @@ jobs:
440453
require_glob 'release-assets/mac/*.zip' 'macOS zip'
441454
require_glob 'release-assets/mac/*-mac.zip.blockmap' 'macOS blockmap'
442455
require_file 'release-assets/mac/latest-mac.yml' 'macOS auto-update metadata'
443-
require_glob 'release-assets/win/*.exe' 'Windows installer'
444-
require_glob 'release-assets/win/*.exe.blockmap' 'Windows blockmap'
445-
require_file 'release-assets/win/latest.yml' 'Windows auto-update metadata'
446-
require_file 'release-assets/runtime/install.sh' 'standalone runtime installer'
447-
if [ ! -x 'release-assets/runtime/install.sh' ]; then
448-
echo "::error::Standalone runtime installer is not executable."
449-
exit 1
450-
fi
451456
452-
for target in darwin-arm64 darwin-x64 linux-arm64 linux-x64; do
453-
require_file "release-assets/runtime/ade-$target" "ADE runtime binary for $target"
454-
require_file "release-assets/runtime/ade-$target.native.tar.gz" "ADE native dependency archive for $target"
455-
tar -tzf "release-assets/runtime/ade-$target.native.tar.gz" | grep -q '^\./node_modules/' || {
456-
echo "::error::ADE native dependency archive for $target is missing node_modules."
457-
exit 1
458-
}
459-
done
457+
# Windows + standalone runtime assets are not published right now.
458+
# Restore these checks together with the publish blocks above.
459+
# require_glob 'release-assets/win/*.exe' 'Windows installer'
460+
# require_glob 'release-assets/win/*.exe.blockmap' 'Windows blockmap'
461+
# require_file 'release-assets/win/latest.yml' 'Windows auto-update metadata'
462+
# require_file 'release-assets/runtime/install.sh' 'standalone runtime installer'
463+
# if [ ! -x 'release-assets/runtime/install.sh' ]; then
464+
# echo "::error::Standalone runtime installer is not executable."
465+
# exit 1
466+
# fi
467+
#
468+
# for target in darwin-arm64 darwin-x64 linux-arm64 linux-x64; do
469+
# require_file "release-assets/runtime/ade-$target" "ADE runtime binary for $target"
470+
# require_file "release-assets/runtime/ade-$target.native.tar.gz" "ADE native dependency archive for $target"
471+
# tar -tzf "release-assets/runtime/ade-$target.native.tar.gz" | grep -q '^\./node_modules/' || {
472+
# echo "::error::ADE native dependency archive for $target is missing node_modules."
473+
# exit 1
474+
# }
475+
# done
460476
461477
- name: Create or update draft GitHub release
462478
env:
@@ -466,16 +482,18 @@ jobs:
466482
GH_REPO: ${{ github.repository }}
467483
run: |
468484
shopt -s nullglob
485+
# macOS-only release surface. The zip + blockmap + latest-mac.yml are
486+
# required by electron-updater; the DMG is the human download.
469487
files=(
470488
release-assets/mac/*.dmg
471489
release-assets/mac/*.zip
472490
release-assets/mac/*-mac.zip.blockmap
473491
release-assets/mac/latest-mac.yml
474-
release-assets/win/*.exe
475-
release-assets/win/*.exe.blockmap
476-
release-assets/win/latest.yml
477-
release-assets/runtime/install.sh
478-
release-assets/runtime/ade-*
492+
# release-assets/win/*.exe
493+
# release-assets/win/*.exe.blockmap
494+
# release-assets/win/latest.yml
495+
# release-assets/runtime/install.sh
496+
# release-assets/runtime/ade-*
479497
)
480498
481499
if [ "${#files[@]}" -eq 0 ]; then

0 commit comments

Comments
 (0)