feat: Tisty's pipelines, winget, and a star asked for once - #14
Merged
Merged
Conversation
Everything Tisty learned across three releases, brought over in one branch: concurrency groups and timeouts on every job, the Rust cache written only from main, clippy where the cache is already warm, and six actions pinned by SHA. The job that resolves the version no longer receives the signing secrets, only booleans; publish is the one job that raises permissions. The Windows installer no longer ships unsigned binaries inside it: the bundler is handed a signCommand by thumbprint, and the installer is then opened to check that every exe it carries is signed. A tag only publishes if its commit passed CI on main, verify runs before the Store, Homebrew and winget, and the feed fails loudly instead of going quiet when it exists and cannot be read. New: a cache sweep, Dependabot, the resident's composite action, and winget behind two switches, with its manifests ready for the first submission. About says what the app is in four badges and asks for a star once, after a fortnight and three rules; nothing of this reaches the picker.
The feed no longer listens for published and released: the release edits the draft before it writes the manifest, so every tag left that workflow red. The Mac coverage job gets its own cache back, Sonar is told to ignore the duplicate shape of the two catalogues, and RUSTFLAGS now matches between the job that writes the shared cache and the ones that read it. No signing secret reaches a job environment any more: the jobs carry booleans and each secret lives on the step that uses it, so npm ci no longer runs with the certificate in front of it. Signing goes by thumbprint everywhere, which retires both the password on a command line and the pfx written to disk, and the check on what the installer lays down now demands our own certificate, a signature the system calls valid, and looks at DLLs too. The tap refuses to write a version older than the one it already offers, so a rerun cannot downgrade a Mac through brew upgrade. The overtaken branch in verify is reachable again, a rerun of an older tag no longer trips on the checksum change, and the MSIX carries the resource index the Store asks of a bilingual package. Dismissing the card now survives changing section, the permanent button steps aside while the card is up, a clock that answers nothing writes no mark, and preferences are written under the same lock that protects the rules. PRIVACY names preferences.json and says what the two marks are.
…ches The installer is signed with a self-signed certificate, so Get-AuthenticodeSignature will never call it Valid on a runner that does not trust that root: the check added in the previous commit would have failed every tag. It now asks what is actually verifiable — that the signer is this build's thumbprint and that the signature is timestamped. The MSIX resource index was built with the es qualifier copied from a project that declares es; this manifest declares es-es, and makeappx validates one against the other. RUSTFLAGS in bundle went to a workflow that compiles in the release profile, which can never reuse a debug cache, and in the mac shard of the sweep it changed what a surviving mutant means; both are reverted and those jobs now keep a cache of their own, which is what they can actually use. The feed no longer listens for edited either: marking a release latest is a PATCH, and nothing promises it stays quiet. A release that carries files this run did not build is now reported rather than ignored.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Everything Tisty learned across three releases, brought over in one branch:
concurrency groups and timeouts on every job, the Rust cache written only from
main, clippy where the cache is already warm, and six actions pinned by SHA.
The job that resolves the version no longer receives the signing secrets, only
booleans; publish is the one job that raises permissions.
The Windows installer no longer ships unsigned binaries inside it: the bundler
is handed a signCommand by thumbprint, and the installer is then opened to
check that every exe it carries is signed. A tag only publishes if its commit
passed CI on main, verify runs before the Store, Homebrew and winget, and the
feed fails loudly instead of going quiet when it exists and cannot be read.
New: a cache sweep, Dependabot, the resident's composite action, and winget
behind two switches, with its manifests ready for the first submission.
About says what the app is in four badges and asks for a star once, after a
fortnight and three rules; nothing of this reaches the picker.