ci(binaries): never replace an archive that is already published - #68
Merged
Conversation
The upload clobbered, so re-running the artifact build for an existing tag rebuilt and overwrote the archives. Rust builds are not bit-for-bit reproducible, so the replacements had different checksums -- and every checksum anyone had recorded became wrong, including the Homebrew formula's and including one somebody had written down to verify a download with. Found by re-running it: the formula job reported 'tap updated' where nothing should have changed, and the diff was four checksums. A re-run now uploads what is missing and leaves what is there alone, which is the case this workflow was built for -- the Windows archive that failed to build first time was exactly it. Replacing a genuinely corrupt asset means deleting it first, and that friction is deliberate: a published artifact should be immutable. Signed-off-by: Vyncint Ng <115854244+vyncint@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found by re-running
binaries.ymlto test the Homebrew token: the formula job reported "tap updated" where nothing should have changed, and the diff was four checksums.What was wrong
The upload used
--clobber, so re-running the artifact build for an existing tag rebuilt and overwrote the archives. Rust builds are not bit-for-bit reproducible, so the replacements had different checksums:Every checksum anyone had recorded became wrong — including the formula's, and including one somebody had written down to verify a download with. A published artifact should be immutable, and this made it anything but.
The irony is that the re-runnability I added two PRs ago is what made it reachable.
The fix
Upload only what is absent:
…-x86_64-unknown-linux-musl.tar.gz…-x86_64-pc-windows-msvc.zip….tar.gz.sha256That is precisely the case the workflow was built for — the Windows archive that failed to build the first time was exactly a missing asset needing filling in. Replacing a genuinely corrupt one now means deleting it first, and that friction is deliberate.
Current state is consistent
The tap and the release agree right now, verified by installing: