From a700565a177cc638a8bf9a5c1827856d40121214 Mon Sep 17 00:00:00 2001 From: Jaifroid Date: Thu, 6 Aug 2026 17:16:29 +0100 Subject: [PATCH 1/3] Document the upload key as per-repository by design rgaudin removed the org-level KIWIX_FILE_UPLOAD_SSH_KEY: since the April 2026 infra change the download server uses per-repository usernames and keys, so an org-wide secret for a single repo served no purpose. The repo-level JAVASCRIPTLIBZIM_FILE_UPLOAD_KEY is the intended answer, not a stopgap. The workflow comments still told a future maintainer to switch back to the org secret once it was re-stored, which would now point at a secret that no longer exists. The script header named it too. No functional change: both workflows already read the repo-level secret. Co-Authored-By: Claude Opus 5 --- .github/workflows/build_libzim_wasm.yml | 5 ++--- .github/workflows/upload_release_assets_to_kiwix.yml | 5 ++--- scripts/Upload-KiwixRelease.ps1 | 4 ++-- 3 files changed, 6 insertions(+), 8 deletions(-) diff --git a/.github/workflows/build_libzim_wasm.yml b/.github/workflows/build_libzim_wasm.yml index 7705c87..9a21399 100644 --- a/.github/workflows/build_libzim_wasm.yml +++ b/.github/workflows/build_libzim_wasm.yml @@ -49,9 +49,8 @@ env: DISPATCH_TYPE: ${{ github.event.inputs.buildtype }} LIBZIM_VERSION: ${{ github.event.inputs.libzim_version }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # Reverted to the repo-level secret: the org-level KIWIX_FILE_UPLOAD_SSH_KEY as currently stored - # fails to parse ("error in libcrypto: unsupported"), so no upload can authenticate with it. - # Switch back to secrets.KIWIX_FILE_UPLOAD_SSH_KEY once the org secret has been re-stored (#101). + # Repo-level by design: since the April 2026 infra change the download server uses a + # per-repository username and key, so there is deliberately no org-wide equivalent (#101). UPLOAD_SSH_KEY: ${{ secrets.JAVASCRIPTLIBZIM_FILE_UPLOAD_KEY }} BUILD_TYPE: ${{ github.event.inputs.buildtype }} diff --git a/.github/workflows/upload_release_assets_to_kiwix.yml b/.github/workflows/upload_release_assets_to_kiwix.yml index 3e49a9e..2779d4a 100644 --- a/.github/workflows/upload_release_assets_to_kiwix.yml +++ b/.github/workflows/upload_release_assets_to_kiwix.yml @@ -21,9 +21,8 @@ env: VERSION: ${{ github.event.release.tag_name }} DISPATCH_VERSION: ${{ github.event.inputs.version }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # Reverted to the repo-level secret: the org-level KIWIX_FILE_UPLOAD_SSH_KEY as currently stored - # fails to parse ("error in libcrypto: unsupported"), so no upload can authenticate with it. - # Switch back to secrets.KIWIX_FILE_UPLOAD_SSH_KEY once the org secret has been re-stored (#101). + # Repo-level by design: since the April 2026 infra change the download server uses a + # per-repository username and key, so there is deliberately no org-wide equivalent (#101). UPLOAD_SSH_KEY: ${{ secrets.JAVASCRIPTLIBZIM_FILE_UPLOAD_KEY }} jobs: diff --git a/scripts/Upload-KiwixRelease.ps1 b/scripts/Upload-KiwixRelease.ps1 index 4e46bf5..f86b81a 100644 --- a/scripts/Upload-KiwixRelease.ps1 +++ b/scripts/Upload-KiwixRelease.ps1 @@ -1,6 +1,6 @@ # A script to find release assets and upload them to the Kiwix release server. -# If run locally, you must ensure that the KIWIX_FILE_UPLOAD_SSH_KEY secret to access the release server is available in -# your File System, as scripts/upload_ssh_key (this is the file the workflow writes the secret to). +# If run locally, you must ensure that the JAVASCRIPTLIBZIM_FILE_UPLOAD_KEY secret to access the release server is +# available in your File System, as scripts/upload_ssh_key (the file the workflow writes the secret to). # You should also provide the tag version as input to this script, or set the $version variable to an existing release tag. param ( From 78a9a69c159401395038d61566b15697d39a8c76 Mon Sep 17 00:00:00 2001 From: Jaifroid Date: Thu, 6 Aug 2026 17:20:19 +0100 Subject: [PATCH 2/3] Record the secret reversion in an Unreleased CHANGELOG section v0.95 shipped with the org-level secret migration and its CHANGELOG entry says so, which is accurate for that tag but confusing now the migration has been undone. An Unreleased section records the reversion so the two entries can be read together, rather than rewriting the history of a published release. Co-Authored-By: Claude Opus 5 --- CHANGELOG.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 96b1918..64e68d5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,11 @@ WASM binary (`libzim.a`) from scratch, but from version 0.1, we have been using ASM applications. Release packages can be obtained from [Releases](https://github.com/openzim/javascript-libzim/releases) or from https://download.openzim.org/release/javascript-libzim/. +## Unreleased + +* Revert the v0.95 migration to the org-level `KIWIX_FILE_UPLOAD_SSH_KEY` secret: openZIM authenticates each project with a per-repository username and key, so that secret has since been removed upstream and uploads use the repo-level `JAVASCRIPTLIBZIM_FILE_UPLOAD_KEY` instead +* Fail the release upload when `scp` does, instead of reporting every file as uploaded regardless of its exit code + ## Javascript Libzim v0.95 (2026-08-06) * Build W/ASM from libzim 9.8.1 souce code (https://download.openzim.org/release/libzim/libzim_wasm-emscripten-9.8.1.tar.gz) From e297ba6c3e7b44316590a8e26a51b0036cd95c2a Mon Sep 17 00:00:00 2001 From: Jaifroid Date: Fri, 7 Aug 2026 08:38:04 +0100 Subject: [PATCH 3/3] Prune changelog --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 64e68d5..4e639cd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,7 +9,7 @@ https://download.openzim.org/release/javascript-libzim/. ## Unreleased -* Revert the v0.95 migration to the org-level `KIWIX_FILE_UPLOAD_SSH_KEY` secret: openZIM authenticates each project with a per-repository username and key, so that secret has since been removed upstream and uploads use the repo-level `JAVASCRIPTLIBZIM_FILE_UPLOAD_KEY` instead +* Revert the v0.95 migration to the org-level `KIWIX_FILE_UPLOAD_SSH_KEY` secret, since openZIM now authenticates each project with a per-repository username and key * Fail the release upload when `scp` does, instead of reporting every file as uploaded regardless of its exit code ## Javascript Libzim v0.95 (2026-08-06)