From 898fb10bbe483f73039873541c9d83b01081c91c Mon Sep 17 00:00:00 2001 From: yeasy Date: Thu, 23 Jul 2026 13:47:03 -0700 Subject: [PATCH] ci: track the latest mdPress release instead of a per-repo pinned version MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Per the author: mdPress should default to the latest release. The cluster had drifted to three versions (0.7.10 x4, 0.7.11 x9, 0.7.14 x1), and nine of those were pinned to bytes upstream had rebuilt under an existing tag — the exact thing the harness move to 0.7.14 refused to do on principle. Pinning also took CI down cluster-wide twice when a tag was rebuilt, because the digest no longer matched. Latest is now 0.7.15; nothing was on it. Each of the 43 install sites now resolves the newest release at build time by following the /releases/latest redirect (no api.github.com call, so no unauthenticated rate limit on shared runner IPs) and exports the version via GITHUB_ENV. Integrity is kept, not dropped: the archive is verified against that same release's published checksums.txt, and a missing entry aborts the step rather than passing silently. The honest trade-off is that this verifies the download rather than pinning an immutable artifact — a rebuilt release is now followed instead of failing the build. That is the intended behaviour here, since the rebuild breakage was the problem being solved and upstream is the same author. Tests updated in step: 12 suites asserted the literal MDPRESS_SHA256 as a proxy for "this download is checksum-verified". They now assert checksums.txt, which is where that guarantee lives. --- .github/workflows/auto-release.yml | 17 ++++++++++++----- .github/workflows/ci.yaml | 17 ++++++++++++----- .github/workflows/pages.yml | 17 ++++++++++++----- .github/workflows/preview-pdf.yml | 17 ++++++++++++----- tests/test_pages_workflow.py | 2 +- 5 files changed, 49 insertions(+), 21 deletions(-) diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml index 9e0c593..ef36c41 100644 --- a/.github/workflows/auto-release.yml +++ b/.github/workflows/auto-release.yml @@ -41,16 +41,23 @@ jobs: sudo apt-get update sudo apt-get install -y fonts-noto-cjk fonts-noto-cjk-extra poppler-utils - - name: Install mdPress 0.7.10 - env: - MDPRESS_VERSION: "0.7.10" - MDPRESS_SHA256: "17e53e455996940bbbce64c69c43b3fb543f1501e03b74cf0434074efebd2db4" + - name: Resolve latest mdPress release + run: | + url="$(curl -fsSL --retry 3 -o /dev/null -w '%{url_effective}' https://github.com/yeasy/mdPress/releases/latest)" + version="${url##*/v}" + test -n "$version" || { echo "could not resolve latest mdPress release"; exit 1; } + echo "MDPRESS_VERSION=$version" >> "$GITHUB_ENV" + echo "resolved mdPress $version" + - name: Install mdPress (checksum-verified) run: | archive="$RUNNER_TEMP/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" curl -fsSL --retry 3 \ "https://github.com/yeasy/mdPress/releases/download/v${MDPRESS_VERSION}/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" \ -o "$archive" - echo "${MDPRESS_SHA256} $archive" | sha256sum -c - + expected="$(curl -fsSL --retry 3 "https://github.com/yeasy/mdPress/releases/download/v${MDPRESS_VERSION}/checksums.txt" \ + | awk -v f="mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" '$2==f {print $1}')" + test -n "$expected" || { echo "no published checksum for mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz"; exit 1; } + echo "${expected} $archive" | sha256sum -c - tar xzf "$archive" -C "$RUNNER_TEMP" mdpress mkdir -p "$RUNNER_TEMP/bin" install -m 0755 "$RUNNER_TEMP/mdpress" "$RUNNER_TEMP/bin/mdpress" diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index de734e5..fd91639 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -65,16 +65,23 @@ jobs: sudo apt-get update sudo apt-get install -y fonts-noto-cjk fonts-noto-cjk-extra poppler-utils - - name: Install mdPress 0.7.10 - env: - MDPRESS_VERSION: "0.7.10" - MDPRESS_SHA256: "17e53e455996940bbbce64c69c43b3fb543f1501e03b74cf0434074efebd2db4" + - name: Resolve latest mdPress release + run: | + url="$(curl -fsSL --retry 3 -o /dev/null -w '%{url_effective}' https://github.com/yeasy/mdPress/releases/latest)" + version="${url##*/v}" + test -n "$version" || { echo "could not resolve latest mdPress release"; exit 1; } + echo "MDPRESS_VERSION=$version" >> "$GITHUB_ENV" + echo "resolved mdPress $version" + - name: Install mdPress (checksum-verified) run: | archive="$RUNNER_TEMP/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" curl -fsSL --retry 3 \ "https://github.com/yeasy/mdPress/releases/download/v${MDPRESS_VERSION}/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" \ -o "$archive" - echo "${MDPRESS_SHA256} $archive" | sha256sum -c - + expected="$(curl -fsSL --retry 3 "https://github.com/yeasy/mdPress/releases/download/v${MDPRESS_VERSION}/checksums.txt" \ + | awk -v f="mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" '$2==f {print $1}')" + test -n "$expected" || { echo "no published checksum for mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz"; exit 1; } + echo "${expected} $archive" | sha256sum -c - tar xzf "$archive" -C "$RUNNER_TEMP" mdpress mkdir -p "$RUNNER_TEMP/bin" install -m 0755 "$RUNNER_TEMP/mdpress" "$RUNNER_TEMP/bin/mdpress" diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 4ea11dc..bdbf0a5 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -36,16 +36,23 @@ jobs: python3 check_project_rules.py npm test - - name: Install mdPress 0.7.10 - env: - MDPRESS_VERSION: "0.7.10" - MDPRESS_SHA256: "17e53e455996940bbbce64c69c43b3fb543f1501e03b74cf0434074efebd2db4" + - name: Resolve latest mdPress release + run: | + url="$(curl -fsSL --retry 3 -o /dev/null -w '%{url_effective}' https://github.com/yeasy/mdPress/releases/latest)" + version="${url##*/v}" + test -n "$version" || { echo "could not resolve latest mdPress release"; exit 1; } + echo "MDPRESS_VERSION=$version" >> "$GITHUB_ENV" + echo "resolved mdPress $version" + - name: Install mdPress (checksum-verified) run: | archive="$RUNNER_TEMP/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" curl -fsSL --retry 3 \ "https://github.com/yeasy/mdPress/releases/download/v${MDPRESS_VERSION}/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" \ -o "$archive" - echo "${MDPRESS_SHA256} $archive" | sha256sum -c - + expected="$(curl -fsSL --retry 3 "https://github.com/yeasy/mdPress/releases/download/v${MDPRESS_VERSION}/checksums.txt" \ + | awk -v f="mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" '$2==f {print $1}')" + test -n "$expected" || { echo "no published checksum for mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz"; exit 1; } + echo "${expected} $archive" | sha256sum -c - tar xzf "$archive" -C "$RUNNER_TEMP" mdpress mkdir -p "$RUNNER_TEMP/bin" install -m 0755 "$RUNNER_TEMP/mdpress" "$RUNNER_TEMP/bin/mdpress" diff --git a/.github/workflows/preview-pdf.yml b/.github/workflows/preview-pdf.yml index 91592be..8eca4d2 100644 --- a/.github/workflows/preview-pdf.yml +++ b/.github/workflows/preview-pdf.yml @@ -44,16 +44,23 @@ jobs: sudo apt-get update sudo apt-get install -y fonts-noto-cjk fonts-noto-cjk-extra poppler-utils - - name: Install mdPress 0.7.10 - env: - MDPRESS_VERSION: "0.7.10" - MDPRESS_SHA256: "17e53e455996940bbbce64c69c43b3fb543f1501e03b74cf0434074efebd2db4" + - name: Resolve latest mdPress release + run: | + url="$(curl -fsSL --retry 3 -o /dev/null -w '%{url_effective}' https://github.com/yeasy/mdPress/releases/latest)" + version="${url##*/v}" + test -n "$version" || { echo "could not resolve latest mdPress release"; exit 1; } + echo "MDPRESS_VERSION=$version" >> "$GITHUB_ENV" + echo "resolved mdPress $version" + - name: Install mdPress (checksum-verified) run: | archive="$RUNNER_TEMP/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" curl -fsSL --retry 3 \ "https://github.com/yeasy/mdPress/releases/download/v${MDPRESS_VERSION}/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" \ -o "$archive" - echo "${MDPRESS_SHA256} $archive" | sha256sum -c - + expected="$(curl -fsSL --retry 3 "https://github.com/yeasy/mdPress/releases/download/v${MDPRESS_VERSION}/checksums.txt" \ + | awk -v f="mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" '$2==f {print $1}')" + test -n "$expected" || { echo "no published checksum for mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz"; exit 1; } + echo "${expected} $archive" | sha256sum -c - tar xzf "$archive" -C "$RUNNER_TEMP" mdpress mkdir -p "$RUNNER_TEMP/bin" install -m 0755 "$RUNNER_TEMP/mdpress" "$RUNNER_TEMP/bin/mdpress" diff --git a/tests/test_pages_workflow.py b/tests/test_pages_workflow.py index f181989..08a170d 100644 --- a/tests/test_pages_workflow.py +++ b/tests/test_pages_workflow.py @@ -20,7 +20,7 @@ class PagesWorkflowTests(unittest.TestCase): text = self.workflow_text() self.assertIn("npm run build", text) - self.assertIn("MDPRESS_SHA256", text) + self.assertIn("checksums.txt", text) self.assertIn('install -m 0755 "$RUNNER_TEMP/mdpress" "$RUNNER_TEMP/bin/mdpress"', text) self.assertIn('echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"', text) self.assertRegex(text, r"path:\s*_site\b")