Add the install and publish actions - #1
Merged
Conversation
Seventeen repositories install the gdam CLI in CI and fourteen of them also publish an addon to the registry. Every one of those steps was copied by hand, and they have drifted: three variants of the install step and three of the publish step across the addon repositories alone, one of which lost its `set -euo pipefail` and so would not fail on a broken download. The three games use a different method again, fetching a release tarball with no checksum verification. install/ delegates to gdam's own scripts/install_cli.sh rather than reimplementing the download, so there stays one definition of how gdam is installed. That brings checksum verification to the games and version pinning to the addon repositories, and it handles "latest", "0.0.7" and "v0.0.7" alike. publish/ derives the addon spec and asset name from GITHUB_REPOSITORY, so a normal addon repository passes only version, tag, and the secret key. It fails with a message naming the cause when the key is missing or the CLI was never installed, rather than surfacing an authorization error or a command-not-found several steps later. CI exercises both on Linux and macOS: latest, a pinned version, both spellings of that version agreeing, and each publish guard actually firing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
17 repos install the gdam CLI in CI; 14 also publish an addon. Every one of those steps was copied by hand and they have drifted — 3 variants of the install step and 3 of the publish step across the addon repos alone, one of which (gd-pocketbase) lost its
set -euo pipefailand so wouldn't fail on a broken download. The 3 games use a different method again: a release tarball with no checksum verification.install/
Delegates to gdam's own
scripts/install_cli.shrather than reimplementing the download, so there stays one definition of how gdam is installed. Consequences: the games gain checksum verification, the addon repos gain version pinning, andlatest/0.0.7/v0.0.7all work.publish/
Derives the addon spec (
@owner/repo) and asset name (@owner_repo.zip) fromGITHUB_REPOSITORY, so a normal addon repo passes onlyversion,tag, andsecret-key. Fails with a message naming the cause when the key is missing or the CLI was never installed.CI
Exercises both actions on Linux and macOS: latest, a pinned version, both spellings of that version agreeing, and each publish guard actually firing.
Once this is green I'll tag
v1so consumers can track the major.🤖 Generated with Claude Code