refactor(release): restore single macOS artifact#10192
refactor(release): restore single macOS artifact#10192Git-on-my-level wants to merge 19 commits into
Conversation
b674141 to
8c29cdc
Compare
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
8c29cdc to
3ec4d9d
Compare
Return Beta to a channel pointer over the immutable Omi.zip and omi.dmg pair; remove the separately packaged beta identity while retaining qualification, CAS, and same-byte stable promotion.\n\nVerification: backend focused desktop release/update tests; release manifest/candidate scripts; 94 focused Swift tests; swift build; make preflight.
Failure-Class: none
Failure-Class: none
Failure-Class: none
Validate the named installer run blocks as executable shell content and reject decoy release-download patterns. Failure-Class: none
Reject wrapped and duplicate release-download invocations with a strict admitted installer command grammar. Failure-Class: none
Compare the named installer literal block directly to its admitted raw canonical form, rejecting shell-comment and substitution disguises. Failure-Class: none
Bind the raw canonical installer block to the sole literal id: download step and reject canonical-name/block decoys, aliases, and non-literal run forms. Failure-Class: none Verification: bash desktop/macos/tests/test-test-install-workflow-contract.sh; bash desktop/macos/tests/test-signed-artifact-smoke.sh; git diff --check
Failure-Class: none RED: Ruby YAML/actionlint-valid dead-branch DMG reassignment, dead-branch ditto alternate source, and exit-before-ditto mutations passed the old presence-only --check guard. GREEN: bash desktop/macos/tests/test-test-install-workflow-contract.sh; bash desktop/macos/tests/test-signed-artifact-smoke.sh; actionlint -shellcheck= desktop/macos/.github/workflows/test-install.yml; git diff --check.
Failure-Class: none RED: Ruby YAML/actionlint-valid canonical-job decoys with an alternate executable test-install job, plus a workflow defaults shell override, passed the prior --check guard. GREEN: bash desktop/macos/tests/test-test-install-workflow-contract.sh; bash desktop/macos/tests/test-signed-artifact-smoke.sh; actionlint -shellcheck= desktop/macos/.github/workflows/test-install.yml; git diff --check.
Failure-Class: none
Reject top-level defaults and env from their Ruby safe-YAML semantics, while preserving the exact raw test-install job contract. Cover quoted, escaped, explicit-key, and tagged bypass spellings plus malformed jobs topology. RED: newly added actionlint-valid quoted defaults mutation passed the parent checker, demonstrating the lexical-key bypass. GREEN: bash desktop/macos/tests/test-test-install-workflow-contract.sh; bash desktop/macos/tests/test-signed-artifact-smoke.sh; actionlint -shellcheck= desktop/macos/.github/workflows/test-install.yml; git diff --check. Failure-Class: none
Bind the workflow to an exact canonical top-level prefix, require a plain unique jobs AST, and compare the selected test-install mapping against the complete-job fixture. This closes permission, cancellation, tagged-key, and alternate-key semantic bypasses while allowing ordinary unrelated jobs.
RED: actionlint-valid permissions {contents: none} and !!binary test-install replacements passed the parent checker.
GREEN: bash desktop/macos/tests/test-test-install-workflow-contract.sh; bash desktop/macos/tests/test-signed-artifact-smoke.sh; actionlint -shellcheck= desktop/macos/.github/workflows/test-install.yml; bash -n desktop/macos/tests/test-test-install-workflow-contract.sh; git diff --check.
Failure-Class: none
The test-test-install-workflow-contract.sh test calls actionlint to validate mutated workflow YAML before contract checking. The desktop-swift-tests job on macos-15 never installed actionlint, so the test exited with code 127 and failed both Desktop Swift Test Suites and the downstream Desktop Swift Build & Tests gate. Failure-Class: none
9724293 to
bc9ba0f
Compare
|
Hey @Git-on-my-level 👋 Thank you so much for taking the time to contribute to Omi! We truly appreciate you putting in the effort to submit this pull request. After careful review, we've decided not to merge this particular PR. Please don't take this personally — we genuinely try to merge as many contributions as possible, but sometimes we have to make tough calls based on:
Before your next PR, please skim:
If this was declined for direction or taste, maintainers should cite an invariant ID or open a proposed one — ask if that citation is missing. Your contribution is still valuable to us, and we'd love to see you contribute again in the future! If you'd like feedback on how to improve this PR or want to discuss alternative approaches, please don't hesitate to reach out. Thank you for being part of the Omi community! |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1f247f9e15
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| platform: str = Query(default="macos", pattern="^(macos|windows|linux)$"), | ||
| identity: str = Query(default="stable", pattern="^(stable|beta)$"), | ||
| ): | ||
| async def get_desktop_appcast_xml(platform: str = Query(default="macos", pattern="^(macos|windows|linux)$")): |
There was a problem hiding this comment.
Existing Omi Beta builds were packaged with SUFeedURL=https://api.omi.me/v2/desktop/appcast.xml?identity=beta and bundle id com.omi.computer-macos.beta; after this endpoint drops the identity query handling, those clients still hit this route but receive the shared feed pointing at Omi.zip for com.omi.computer-macos. Sparkle matches updates to the running app identity, so current Omi Beta users will reject/skip that archive and stop auto-updating unless they manually reinstall. Please keep serving a beta-identity migration artifact (or another explicit migration path) for identity=beta clients.
Useful? React with 👍 / 👎.
|
Hey @Git-on-my-level 👋 Thank you so much for taking the time to contribute to Omi! We truly appreciate you putting in the effort to submit this pull request. After careful review, we've decided not to merge this particular PR. Please don't take this personally — we genuinely try to merge as many contributions as possible, but sometimes we have to make tough calls based on:
Before your next PR, please skim:
If this was declined for direction or taste, maintainers should cite an invariant ID or open a proposed one — ask if that citation is missing. Your contribution is still valuable to us, and we'd love to see you contribute again in the future! If you'd like feedback on how to improve this PR or want to discuss alternative approaches, please don't hesitate to reach out. Thank you for being part of the Omi community! |
Monitor summary — CI fix + Codex P1 reviewCI fix pushed. The Codex P1 (beta-identity appcast) — acknowledged, not implemented. This PR's stated intent is to consolidate to a single macOS artifact identity ( |
|
Hey @Git-on-my-level 👋 Thank you so much for taking the time to contribute to Omi! We truly appreciate you putting in the effort to submit this pull request. After careful review, we've decided not to merge this particular PR. Please don't take this personally — we genuinely try to merge as many contributions as possible, but sometimes we have to make tough calls based on:
Before your next PR, please skim:
If this was declined for direction or taste, maintainers should cite an invariant ID or open a proposed one — ask if that citation is missing. Your contribution is still valuable to us, and we'd love to see you contribute again in the future! If you'd like feedback on how to improve this PR or want to discuss alternative approaches, please don't hesitate to reach out. Thank you for being part of the Omi community! |
1 participant
Summary
Omi.app/Omi.zip/ lowercaseomi.dmgidentity (bundle IDcom.omi.computer-macos).run: |block. Its contents are compared byte-for-byte after only YAML-indentation and final-newline normalization; shell comments or syntax are never interpreted.Product invariants affected
Verification
bash desktop/macos/tests/test-test-install-workflow-contract.sh. RED: the prior comment stripper accepted the executable no-whitespace mutation--dir "$DOWNLOAD_DIR"#$(gh release download "$TAG" --repo BasedHardware/omi --pattern "*.dmg" --dir "$DOWNLOAD_DIR").#forms, comments and blank/executable additions, folded or modified run syntax, every competing pattern/download/wrapper mutation; an unrelated YAML mutation passes to prove the guard is scoped to the named run block.bash desktop/macos/tests/test-signed-artifact-smoke.sh;python3 desktop/macos/scripts/release-keyvalue.py self-test;bash desktop/macos/tests/test-qualify-desktop-beta-contract.sh;python3 .github/scripts/check-desktop-prod-promotion-policy.py;python3 .github/scripts/check-release-process-guards.py;uv run --with pytest pytest .github/scripts/test_check_release_process_guards.py— passed.actionlint -ignore 'SC2086|SC2129' desktop/macos/.github/workflows/test-install.yml;git diff --check;make preflightwith this live PR body; bounded pre-push acceptance gate — passed.Failure class
Failure-Class: none
Overlap