Build the appcast download URL from the release tag - #5
Merged
Conversation
The enclosure URL was hardcoded to releases/download/v<version>, but a workflow_dispatch run publishes under manual-<version>. Checking publish on a manual run would therefore have produced a feed pointing at a URL that does not exist. Worse, that feed would not have stayed contained. GitHub serves releases/latest/download/appcast.xml from whichever release is newest, and the manual release was created as a normal one, so it would have become "latest" and handed a broken feed to every installed copy of the app. The Homebrew step had the same problem from the other direction: the cask URL is built from v<version>, which does not exist under a manual tag. So the tag is now a required argument rather than something derived from the version, and manual publishes are constrained to be prereleases with the tap left alone. Regenerating the live 1.1.0 feed with this change produces a byte-identical result, so tag releases are unaffected. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the workflow_dispatch footgun left open when 1.1.0 shipped.
The problem
The appcast enclosure URL was hardcoded to
releases/download/v{{VERSION}}, while aworkflow_dispatchrun tagsmanual-<version>. Checking publish on a manual run would have published a feed pointing at a URL that does not exist.That would not have stayed contained. GitHub serves
releases/latest/download/appcast.xmlfrom whichever release is newest, and the manual release was created as a normal release, so it would have becomelatestand handed a broken feed to every installed copy of the app. The Homebrew step had the mirror-image problem: the cask URL is built fromv<version>, absent under a manual tag, so it would have pointed brew users at a 404 too.The fix
{{TAG}}replaces the hardcodedv{{VERSION}}in the template, andgenerate-appcast.shtakes the tag as a required fourth argument. It is not defaulted tov<version>, since a silent default is how this got in.--prerelease, so they can never becomereleases/latest.Verification
Tests were written first and confirmed failing for the right reason before the fix. Beyond the suite, the strongest check: regenerating the live 1.1.0 appcast with this change and diffing it against what is actually published is byte-identical apart from the time-based
pubDate, so real tag releases are unaffected.The resolve-version logic was also simulated across all three trigger paths (tag push, manual publish, manual dry run) to confirm the tag and prerelease values come out right.
Made with Cursor