Skip to content

fix: consolidate per-platform SHA512SUMS into single file to avoid upload collisions #120

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shenxianpeng merged 1 commit into from
Jun 28, 2026
Merged

fix: consolidate per-platform SHA512SUMS into single file to avoid upload collisions #120

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 13 additions & 2 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,8 +203,18 @@ jobs:
done
}

# Combine all per-artifact SHA512SUMS into a single file at the workspace root.
# This mirrors the common open-source convention (e.g. Node.js SHASUMS256.txt)
# and avoids GitHub Release asset name collisions.
combined_sha="SHA512SUMS"
find clang-tools-* -name SHA512SUMS -type f -print0 | xargs -0 cat > "$combined_sha"
echo "Created combined $(wc -l < "$combined_sha")-entry $combined_sha"

# Remove the per-artifact SHA512SUMS files so they are not uploaded individually.
find clang-tools-* -name SHA512SUMS -type f -delete
Comment on lines +210 to +214

@coderabbitai coderabbitai Bot Jun 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Fail fast when an artifact is missing its SHA512SUMS.

This currently uploads whatever checksum files happen to exist. If one clang-tools-* artifact is missing its local SHA512SUMS, that asset still gets released but disappears from the consolidated root file, which breaks the documented verification contract for sha512sum -c SHA512SUMS --ignore-missing.

Suggested fix 
           combined_sha="SHA512SUMS"
-          find clang-tools-* -name SHA512SUMS -type f -print0 | xargs -0 cat > "$combined_sha"
+          mapfile -d '' -t checksum_files < <(find "${artifact_dirs[@]}" -name SHA512SUMS -type f -print0)
+          if [[ ${`#checksum_files`[@]} -ne ${`#artifact_dirs`[@]} ]]; then
+            echo "::error::Expected one SHA512SUMS per artifact directory"
+            exit 1
+          fi
+          printf '%s\0' "${checksum_files[@]}" | xargs -0 cat > "$combined_sha"
+          [[ -s "$combined_sha" ]] || { echo "::error::Combined SHA512SUMS is empty"; exit 1; }
           echo "Created combined $(wc -l < "$combined_sha")-entry $combined_sha"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
find clang-tools-* -name SHA512SUMS -type f -print0 | xargs -0 cat > "$combined_sha"
echo "Created combined $(wc -l < "$combined_sha")-entry $combined_sha"
# Remove the per-artifact SHA512SUMS files so they are not uploaded individually.
find clang-tools-* -name SHA512SUMS -type f -delete
combined_sha="SHA512SUMS"
mapfile -d '' -t checksum_files < <(find "${artifact_dirs[@]}" -name SHA512SUMS -type f -print0)
if [[ ${`#checksum_files`[@]} -ne ${`#artifact_dirs`[@]} ]]; then
echo "::error::Expected one SHA512SUMS per artifact directory"
exit 1
fi
printf '%s\0' "${checksum_files[@]}" | xargs -0 cat > "$combined_sha"
[[ -s "$combined_sha" ]] || { echo "::error::Combined SHA512SUMS is empty"; exit 1; }
echo "Created combined $(wc -l < "$combined_sha")-entry $combined_sha"
# Remove the per-artifact SHA512SUMS files so they are not uploaded individually.
find clang-tools-* -name SHA512SUMS -type f -delete
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build.yml around lines 210 - 214, The checksum aggregation
step in the build workflow should fail if any `clang-tools-*` artifact is
missing its local `SHA512SUMS`, rather than silently building a partial
consolidated file. Update the workflow logic around the `find ... SHA512SUMS`
and combined checksum generation so it first verifies every expected artifact
has a checksum file and exits with an error if any are absent, before running
the aggregation and deletion steps.


# Collect all files and upload one-by-one with a small delay
mapfile -t files < <(find clang-* -type f)
mapfile -t files < <(find clang-tools-* -type f)
Comment on lines +210 to +217

@coderabbitai coderabbitai Bot Jun 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Guard the clang-tools-* glob before calling find.

If no artifact directories were downloaded, Bash leaves clang-tools-* unexpanded, find exits non-zero, and the job dies before Line 219’s “No files found” fallback can run.

Suggested fix 
+          shopt -s nullglob
+          artifact_dirs=(clang-tools-*)
+          if [[ ${`#artifact_dirs`[@]} -eq 0 ]]; then
+            echo "::warning::No artifact directories found"
+            exit 0
+          fi
+
           combined_sha="SHA512SUMS"
-          find clang-tools-* -name SHA512SUMS -type f -print0 | xargs -0 cat > "$combined_sha"
+          find "${artifact_dirs[@]}" -name SHA512SUMS -type f -print0 | xargs -0 cat > "$combined_sha"
           echo "Created combined $(wc -l < "$combined_sha")-entry $combined_sha"
 
           # Remove the per-artifact SHA512SUMS files so they are not uploaded individually.
-          find clang-tools-* -name SHA512SUMS -type f -delete
+          find "${artifact_dirs[@]}" -name SHA512SUMS -type f -delete
 
           # Collect all files and upload one-by-one with a small delay
-          mapfile -t files < <(find clang-tools-* -type f)
+          mapfile -t files < <(find "${artifact_dirs[@]}" -type f)
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
find clang-tools-* -name SHA512SUMS -type f -print0 | xargs -0 cat > "$combined_sha"
echo "Created combined $(wc -l < "$combined_sha")-entry $combined_sha"
# Remove the per-artifact SHA512SUMS files so they are not uploaded individually.
find clang-tools-* -name SHA512SUMS -type f -delete
# Collect all files and upload one-by-one with a small delay
mapfile -t files < <(find clang-* -type f)
mapfile -t files < <(find clang-tools-* -type f)
shopt -s nullglob
artifact_dirs=(clang-tools-*)
if [[ ${`#artifact_dirs`[@]} -eq 0 ]]; then
echo "::warning::No artifact directories found"
exit 0
fi
combined_sha="SHA512SUMS"
find "${artifact_dirs[@]}" -name SHA512SUMS -type f -print0 | xargs -0 cat > "$combined_sha"
echo "Created combined $(wc -l < "$combined_sha")-entry $combined_sha"
# Remove the per-artifact SHA512SUMS files so they are not uploaded individually.
find "${artifact_dirs[@]}" -name SHA512SUMS -type f -delete
# Collect all files and upload one-by-one with a small delay
mapfile -t files < <(find "${artifact_dirs[@]}" -type f)
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build.yml around lines 210 - 217, Guard the clang-tools-*
glob in the build workflow before invoking find so the step does not fail when
no artifact directories exist. Update the logic around the combined SHA
generation and file collection block to detect whether clang-tools-* matched any
directories before running find, and if not, skip those commands so the existing
“No files found” fallback can run. Use the surrounding upload setup and the
mapfile/files collection flow to keep the behavior safe when no artifacts are
downloaded.


if [[ ${#files[@]} -eq 0 ]]; then
echo "::warning::No files found to upload"
Expand All @@ -213,8 +223,9 @@ jobs:

echo "Found ${#files[@]} files to upload"
failed=0
# Upload versions.json
# Upload top-level metadata files first (no filename conflicts)
upload_with_retry "versions.json" || failed=1
upload_with_retry "SHA512SUMS" || failed=1
for file in "${files[@]}"; do
upload_with_retry "$file" || failed=1
sleep 1
Expand Down
Loading