Fix the install commands, and gate them against goreleaser - #51
Merged
Conversation
Every documented download URL 404'd. The README named
`cloudgov_Darwin_arm64.tar.gz` and `checksums.txt`; the live v2.0.0 release
carries `cloudgov_2.0.0_darwin_arm64.tar.gz` and
`cloudgov_2.0.0_checksums.txt`.
Wrong twice over. `.goreleaser.yaml` names archives
`{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}`, which lowercases the
OS — so `Darwin` was never right — and embeds the version, which means
`releases/latest/download/<static-name>` resolves to nothing at all: there is
no substitution for GitHub to perform.
Five call sites: the human install snippet, its checksum verification, two
GitHub Actions recipes, and a GitLab CI recipe. The Homebrew and `go install`
paths were unaffected and still work.
─── Fix ───
The human snippet resolves the tag first and builds the versioned filename from
it, so it follows releases without a static name to rot.
The three CI recipes take an explicit pinned version instead. That is the
better shape for CI regardless of this bug: a scan whose verdict changes
because a release landed mid-week is a scan nobody can act on.
─── Gate ───
`scripts/check-release-urls.sh` compares the README's URLs against
`.goreleaser.yaml`'s name templates and fails on the three ways they can
disagree: a `latest/download` URL where the template embeds a version, an asset
name with no version where the template has one, and a title-cased OS segment.
Offline against the committed config, so it holds on a laptop and needs no
release to exist. It runs in CI beside the context-awareness check.
Verified failing against the shipped README — it flags all five URLs and names
which of the three defects each one has.
The two sides never met before this: goreleaser decides the names, the README
repeated them from memory, and no job read both.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every documented download URL 404'd. The README named
cloudgov_Darwin_arm64.tar.gzandchecksums.txt; the live v2.0.0 release carriescloudgov_2.0.0_darwin_arm64.tar.gzandcloudgov_2.0.0_checksums.txt.Wrong twice over.
.goreleaser.yamlnames archives{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}, which lowercases the OS — soDarwinwas never right — and embeds the version, which meansreleases/latest/download/<static-name>resolves to nothing at all: there's no substitution for GitHub to perform.Five call sites: the human install snippet, its checksum verification, two GitHub Actions recipes, and a GitLab CI recipe. The Homebrew and
go installpaths were unaffected and still work.Fix
The human snippet resolves the tag first and builds the versioned filename from it, so it follows releases without a static name to rot.
The three CI recipes take an explicit pinned version instead. That's the better shape for CI regardless of this bug: a scan whose verdict changes because a release landed mid-week is a scan nobody can act on.
Gate
scripts/check-release-urls.shcompares the README's URLs against.goreleaser.yaml's name templates and fails on the three ways they can disagree:latest/downloadURL where the template embeds a versionOffline against the committed config, so it holds on a laptop and needs no release to exist. Runs in CI beside the context-awareness check.
Verified failing against the shipped README — it flags all five URLs and names which of the three defects each one has.
The two sides never met before this: goreleaser decides the names, the README repeated them from memory, and no job read both.