ba3db7c35d
Review follow-ups of PR #416. The check that release.yml runs before deleting the published manifest moves from an inline jq program to scripts/check-latest-json.jq, which release.yml applies with `jq -e --arg version ... -f`. scripts/build-latest-json.test.mjs now runs that same filter on every pull request: on the script's output, on a wrong version, on nine broken manifests and on the shape published up to v0.17.1. It also compares the key lists of the script, of the filter and of verify-release.sh, so a list left behind shows before the tag. Two new cases pin the version argument: 0.18.0 must come out as 0.18.0 (the other fixtures pass 0.17.1, the version the bundle names carry, so a script that ignored its argument passed them all), and an empty version must fail. Both mutations survived the review's pass. No change to what the manifest holds: still four keys. Refs #320 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
27 lines
1.6 KiB
Text
27 lines
1.6 KiB
Text
# Check of latest.json, the updater manifest, before release.yml deletes the
|
|
# published one from the package registry (#320). Once that version is
|
|
# deleted, installed apps find no update until a valid one is uploaded, so a
|
|
# manifest that fails this check stops the job and leaves the registry as is.
|
|
#
|
|
# Run as: jq -e --arg version <X.Y.Z> -f scripts/check-latest-json.jq latest.json
|
|
# -e turns false, null and any jq error (missing field, wrong type, invalid
|
|
# JSON) into a non-zero exit status: the check fails closed.
|
|
#
|
|
# The key set must stay the one scripts/build-latest-json.sh writes and
|
|
# .claude/skills/release/scripts/verify-release.sh expects.
|
|
# scripts/build-latest-json.test.mjs runs this file on the script's output and
|
|
# on broken manifests, and compares the three lists, on every pull request
|
|
# through check-frontend: a misaligned list shows before the tag, not at it.
|
|
# Written for jq 1.6, the version ubuntu:22.04 ships.
|
|
#
|
|
# Not checked here: that each signature belongs to its own file. The script's
|
|
# test checks it before the merge, and verify-release.sh after publication
|
|
# (the file: field of the minisign trusted comment).
|
|
|
|
.version == $version
|
|
and (.platforms | keys) == ["linux-x86_64", "linux-x86_64-deb", "linux-x86_64-rpm", "windows-x86_64"]
|
|
and all(.platforms[]; (.signature | type) == "string" and (.signature | length) > 0)
|
|
and (.platforms["linux-x86_64"].url | endswith(".deb"))
|
|
and (.platforms["linux-x86_64-deb"].url | endswith(".deb"))
|
|
and (.platforms["linux-x86_64-rpm"].url | endswith(".rpm"))
|
|
and (.platforms["windows-x86_64"].url | endswith(".exe"))
|