Skip to content

fix: point the website's offline release fallback at 0.0.38 #58

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gitcommit90 merged 1 commit into from
Aug 2, 2026
Merged

fix: point the website's offline release fallback at 0.0.38 #58

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 13 additions & 8 deletions site/server.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,21 +30,26 @@ const ORIGIN = "https://1helm.com";
const REPO = "gitcommit90/1Helm";
const RELEASE_PAGE = `https://github.com/${REPO}/releases/latest`;
const RELEASE_CACHE_MS = 10 * 60_000;
// Served only when GitHub's release API is unreachable or rate limited. It
// must name the current release: a stale fallback silently hands visitors an
// older build from the download links. Update the tag and all six digests in
// the same commit that ships a release.
const RELEASE_FALLBACK_TAG = "v0.0.38";
const RELEASE_FALLBACK = {
tag_name: "v0.0.30",
tag_name: RELEASE_FALLBACK_TAG,
draft: false,
prerelease: false,
assets: [
["1Helm-0.0.30-arm64.dmg", "597bccdf464e397389511100f254b40b3da266a52e00049d4553bf5476440bcb"],
["1Helm-0.0.30-mac-arm64.zip", "54729c10aee1173f1f4b085826bdfe9838f37dfc61f3999ff8d073e39ccc4e94"],
["1Helm-0.0.30-linux-node.tgz", "d96cb1bbc73686562dbff3c797cbd8fcc8962c8cc97602edd1fabf1b1e2e5d64"],
["1Helm-0.0.30-windows-x64-setup.exe", "ff5b2fa32ea916b88dc08164bb52a55253d9921f73f713b1413bbf4ac1d4669f"],
["1Helm-0.0.30-full.nupkg", "3142069585e3a02290fc8092ff8e1e80683c355aa1e78d2871260f1518ea83bf"],
["RELEASES", "11bc1746bca8f6414f8dd6df254bfcf921dec13ca72b037c03c47152db30f542"],
["1Helm-0.0.38-arm64.dmg", "468a5b8d59a23c4419331db20dcdb955f088a046add48296b5d5aa8450120527"],
["1Helm-0.0.38-mac-arm64.zip", "4135defe285f9d7e480802d17d81ff37d083a90f6d7dc928f7061a73f9861302"],
["1Helm-0.0.38-linux-node.tgz", "12d59534b66c325891d5433eb2c7ab8990ee67c9d56a805b65b9633030c424fc"],
["1Helm-0.0.38-windows-x64-setup.exe", "0689afadc996319a22d6a3419d39725453bc46d9bdd8857463a56b7bcf738590"],
["1Helm-0.0.38-full.nupkg", "2b25a71f6b3bbb96d7a62cca4bdbd421daed22a1005b1e93d31a77b3d61e86ae"],
["RELEASES", "a20bf26fc174a48a2ccd30c4b7ab0289d72c00489761981c89a7eb3c9842f454"],
Comment on lines +43 to +48

@coderabbitai coderabbitai Bot Aug 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

tag="$(sed -nE 's/^const RELEASE_FALLBACK_TAG = "([^"]+)";/\1/p' site/server.mjs)"
fallback="$(mktemp)"
published="$(mktemp)"
trap 'rm -f "$fallback" "$published"' EXIT

sed -nE \
  's/^[[:space:]]*\["([^"]+)", "([a-f0-9]{64})"\],$/\1 sha256:\2/p' \
  site/server.mjs | sort > "$fallback"

curl -fsSL \
  -H 'Accept: application/vnd.github+json' \
  "https://api.github.com/repos/gitcommit90/1Helm/releases/tags/${tag}" |
  jq -r '.assets[] | "\(.name) \(.digest)"' | sort > "$published"

diff -u "$published" "$fallback"

Repository: gitcommit90/1Helm

Length of output: 206

🏁 Script executed:

set -euo pipefail
printf '%s\n' '--- tag and fallback entries ---'
sed -n '1,70p' site/server.mjs
printf '%s\n' '--- remotes ---'
git remote -v
printf '%s\n' '--- local references to release metadata ---'
rg -n '1Helm-0\.0\.38|468a5b8d59a23c4419331db20dcdb955f088a046add48296b5d5aa8450120527|RELEASES' . --glob '!site/server.mjs'
printf '%s\n' '--- GitHub release endpoints ---'
for url in \
  'https://api.github.com/repos/gitcommit90/1Helm/releases/tags/v0.0.38' \
  'https://github.com/gitcommit90/1Helm/releases/tag/v0.0.38' \
  'https://github.com/gitcommit90/1Helm/releases/expanded_assets/v0.0.38'; do
  echo "URL: $url"
  curl -L -sS -o /tmp/release-response -w 'HTTP %{http_code}\n' \
    -H 'Accept: application/vnd.github+json' \
    -H 'User-Agent: Mozilla/5.0' "$url"
  head -c 300 /tmp/release-response
  echo
done

Repository: gitcommit90/1Helm

Length of output: 9334

🏁 Script executed:

set -euo pipefail
tag_ref="$(git ls-remote --tags https://github.com/gitcommit90/1Helm.git 'refs/tags/v0.0.38' 'refs/tags/v0.0.38^{}' || true)"
printf '%s\n' '--- tag refs ---'
printf '%s\n' "$tag_ref"

printf '%s\n' '--- release asset status ---'
while IFS=$'\t' read -r name digest; do
  url="https://github.com/gitcommit90/1Helm/releases/download/v0.0.38/$name"
  status="$(curl -L -sS -o /dev/null -w '%{http_code} %{url_effective}' \
    -H 'User-Agent: Mozilla/5.0' "$url" || true)"
  printf '%s\t%s\t%s\n' "$name" "$digest" "$status"
done <<'EOF'
1Helm-0.0.38-arm64.dmg	468a5b8d59a23c4419331db20dcdb955f088a046add48296b5d5aa8450120527
1Helm-0.0.38-mac-arm64.zip	4135defe285f9d7e480802d17d81ff37d083a90f6d7dc928f7061a73f9861302
1Helm-0.0.38-linux-node.tgz	12d59534b66c325891d5433eb2c7ab8990ee67c9d56a805b65b9633030c424fc
1Helm-0.0.38-windows-x64-setup.exe	0689afadc996319a22d6a3419d39725453bc46d9bdd8857463a56b7bcf738590
1Helm-0.0.38-full.nupkg	2b25a71f6b3bbb96d7a62cca4bdbd421daed22a1005b1e93d31a77b3d61e86ae
RELEASES	a20bf26fc174a48a2ccd30c4b7ab0289d72c00489761981c89a7eb3c9842f454
EOF

Repository: gitcommit90/1Helm

Length of output: 1286

🏁 Script executed:

set -euo pipefail
printf '%s\n' '--- release resolution and consumers ---'
sed -n '68,125p' site/server.mjs
rg -n -C 4 'latestRelease|RELEASE_FALLBACK|browser_download_url|digest' site/server.mjs
printf '%s\n' '--- available tags and package version ---'
git ls-remote --tags https://github.com/gitcommit90/1Helm.git | tail -n 30
sed -nE 's/^[[:space:]]*"version":[[:space:]]*"([^"]+)".*/package version: \1/p' package.json

Repository: gitcommit90/1Helm

Length of output: 9965

Publish the fallback release or update it to an existing release. The v0.0.38 tag is not published, and all six fallback download URLs return 404. When the GitHub API is unavailable, latestRelease() serves these dead URLs.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@site/server.mjs` around lines 43 - 48, Update the fallback release entries
used by latestRelease() to reference a published release with valid download
URLs and matching checksums, or publish the existing v0.0.38 release so all six
entries resolve successfully. Verify each fallback asset, including RELEASES, is
available when the GitHub API is unavailable.

].map(([name, digest]) => ({
name,
digest: `sha256:${digest}`,
browser_download_url: `https://github.com/${REPO}/releases/download/v0.0.30/${name}`,
browser_download_url: `https://github.com/${REPO}/releases/download/${RELEASE_FALLBACK_TAG}/${name}`,
})),
};
const FEEDBACK_DATA_DIR = resolve(process.env.SITE_DATA_DIR || join(ROOT, ".site-data"));
Expand Down
37 changes: 32 additions & 5 deletions test/site.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,11 +112,14 @@ test("release metadata stays available when GitHub's unauthenticated API is exha
await waitFor(`${base}/health`);
const response = await fetch(`${base}/api/releases/linux/latest`);
assert.equal(response.status, 200);
assert.deepEqual(await response.json(), {
version: "0.0.30",
url: "https://github.com/gitcommit90/1Helm/releases/download/v0.0.30/1Helm-0.0.30-linux-node.tgz",
sha256: "d96cb1bbc73686562dbff3c797cbd8fcc8962c8cc97602edd1fabf1b1e2e5d64",
});
// Derived from package.json rather than pinned: the point of this contract
// is that the offline fallback serves the SHIPPING release, so hardcoding a
// version here would keep passing while the fallback silently went stale.
const version = JSON.parse(readFileSync(join(root, "package.json"), "utf8")).version;
const offline = await response.json();
assert.equal(offline.version, version, "the offline fallback serves the shipping version");
assert.equal(offline.url, `https://github.com/gitcommit90/1Helm/releases/download/v${version}/1Helm-${version}-linux-node.tgz`);
assert.match(offline.sha256, /^[a-f0-9]{64}$/, "the offline fallback carries a real digest");
} finally {
child.kill("SIGTERM");
await new Promise((resolve) => child.once("exit", resolve));
Expand Down Expand Up @@ -305,3 +308,27 @@ test("autonomy report names its deterministic scope and live-system limits", ()
assert.match(report.scope.validates.join(" "), /wakeable recurring-work persistence/);
assert.match(report.scope.does_not_validate.join(" "), /live model or provider/);
});

test("the website's offline release fallback names the shipping version", () => {
// This fallback is served when GitHub's release API is unreachable or rate
// limited. A stale entry does not fail loudly — it quietly hands every
// visitor an older build from the download links, which is exactly how a
// release goes out with the previous version behind the buttons.
const version = JSON.parse(readFileSync(join(root, "package.json"), "utf8")).version;
const server = readFileSync(join(root, "site", "server.mjs"), "utf8");
const block = server.match(/const RELEASE_FALLBACK = \{[\s\S]*?\n\};/)?.[0];
assert.ok(block, "site/server.mjs still exposes a release fallback block");
assert.match(server, new RegExp(`RELEASE_FALLBACK_TAG = "v${version.replaceAll(".", "\\.")}"`), "the fallback tag matches package.json");
for (const asset of [
`1Helm-${version}-arm64.dmg`,
`1Helm-${version}-mac-arm64.zip`,
`1Helm-${version}-linux-node.tgz`,
`1Helm-${version}-windows-x64-setup.exe`,
`1Helm-${version}-full.nupkg`,
]) {
assert.ok(block.includes(asset), `the release fallback names ${asset}`);
}
const digests = [...block.matchAll(/"([a-f0-9]{64})"/g)].map((m) => m[1]);
assert.equal(digests.length, 6, "all six desktop artifacts carry a fallback digest");
assert.equal(new Set(digests).size, 6, "no two fallback digests are duplicated");
});
Loading