From ed85b0ce8e0ee77e4722f5af6d33f57dc55b629b Mon Sep 17 00:00:00 2001 From: Dave Thompson Date: Wed, 29 Jul 2026 15:45:01 -0400 Subject: [PATCH 1/2] ci: pin install-script smoke to signed N-1 tag Main CI dry-run followed latest and 404'd when a just-tagged release still lacked platform archives. Read SFETCH_VERSION from the Makefile and pass --tag plus --require-minisign so the smoke test only exercises a fully signed published cut. Role: devlead Generated by Grok 4.5 (https://x.ai) running Grok Build (https://x.ai) under supervision of [@3leapsdave](https://github.com/3leapsdave) Co-Authored-By: Grok 4.5 Committer-of-Record: Dave Thompson [@3leapsdave] --- .github/workflows/ci.yml | 10 +++++++++- Makefile | 4 ++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 27caeeb..d472a9a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -54,8 +54,16 @@ jobs: export PATH="$PWD/bin:$PATH" make precommit + # Pin to Makefile SFETCH_VERSION (N-1 fully-signed release), never latest. + # Main CI after a release tag races incomplete asset uploads if dry-run + # follows latest (404 on platform archives still mid-matrix upload). - name: Test install script - run: bash scripts/install-sfetch.sh --dry-run + run: | + set -euo pipefail + TAG=$(awk -F':= *' '/^SFETCH_VERSION[[:space:]]*:?=/{gsub(/[[:space:]]/,"",$2); print $2; exit}' Makefile) + test -n "$TAG" + echo "Install smoke pin: $TAG (from Makefile SFETCH_VERSION)" + bash scripts/install-sfetch.sh --dry-run --tag "$TAG" --require-minisign container-probe: name: Install probe (container) diff --git a/Makefile b/Makefile index 5aac9fb..5ad3a4c 100644 --- a/Makefile +++ b/Makefile @@ -41,6 +41,10 @@ SCOOP_BUCKET_REPO ?= https://github.com/3leaps/scoop-bucket.git BIN_DIR := $(CURDIR)/bin # Pinned tool versions (every gate/release tool is version-pinned; no @latest) +# SFETCH_VERSION is the N-1 self-bootstrap pin AND the CI install-script smoke +# pin (see .github/workflows/ci.yml). Always a fully-signed published release — +# never "latest" and never the in-flight cut — so main CI cannot 404 during the +# tag/upload window. Advance after each release publishes + signs. SFETCH_VERSION := v0.4.8 GONEAT_VERSION ?= v0.5.15 GOVULNCHECK_VERSION ?= v1.6.0 From f3e960f08be215d15c800e316cf59c5da136a653 Mon Sep 17 00:00:00 2001 From: Dave Thompson Date: Wed, 29 Jul 2026 15:46:07 -0400 Subject: [PATCH 2/2] ci: resolve install smoke pin via make, not awk Shell-parsing Makefile assignment is brittle across assignment forms and version shapes. Add print-sfetch-version and have CI call make so the pin is expanded by make for any patch/minor/major tag value. Role: devlead Generated by Grok 4.5 (https://x.ai) running Grok Build (https://x.ai) under supervision of [@3leapsdave](https://github.com/3leapsdave) Co-Authored-By: Grok 4.5 Committer-of-Record: Dave Thompson [@3leapsdave] --- .github/workflows/ci.yml | 5 +++-- Makefile | 7 +++++++ 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d472a9a..53ecb32 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -57,12 +57,13 @@ jobs: # Pin to Makefile SFETCH_VERSION (N-1 fully-signed release), never latest. # Main CI after a release tag races incomplete asset uploads if dry-run # follows latest (404 on platform archives still mid-matrix upload). + # Use `make print-sfetch-version` so make expands the pin (any semver shape). - name: Test install script run: | set -euo pipefail - TAG=$(awk -F':= *' '/^SFETCH_VERSION[[:space:]]*:?=/{gsub(/[[:space:]]/,"",$2); print $2; exit}' Makefile) + TAG=$(make -s print-sfetch-version) test -n "$TAG" - echo "Install smoke pin: $TAG (from Makefile SFETCH_VERSION)" + echo "Install smoke pin: $TAG (make print-sfetch-version)" bash scripts/install-sfetch.sh --dry-run --tag "$TAG" --require-minisign container-probe: diff --git a/Makefile b/Makefile index 5ad3a4c..f6cb595 100644 --- a/Makefile +++ b/Makefile @@ -61,9 +61,16 @@ CORPUS_DEST ?= test-corpus .PHONY: release-verify-key release-verify-minisign-pubkey release-verify-keys release-verify-signatures .PHONY: release-clean bootstrap-script build-all gosec gosec-high update-scoop-manifest .PHONY: version-check version-set version-patch version-minor version-major +.PHONY: print-sfetch-version all: build +# Echo SFETCH_VERSION via make (not shell parsing of Makefile). CI install smoke +# and other tools should use this so patch/minor/major pin values always expand +# correctly regardless of assignment form or version shape. +print-sfetch-version: ## Print bootstrap/CI smoke pin (SFETCH_VERSION) + @echo $(SFETCH_VERSION) + help: ## Show this help @echo "sfetch - secure, verifying binary fetcher for GitHub releases" @echo ""