mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-21 05:30:35 +00:00
065ebdb276
Across v6 rc.1 → rc.5 the published install.sh asset was the agent installer rather than the server installer, and the README's pinned ed25519 key did not verify what the pipeline actually signed. The first broke `bash install.sh --version` and the in-product Update button; the second silently failed the README's secure-install ssh-keygen step. Neither was caught by CI because every existing gate operated on the local release/ build, the Docker image, or the helm chart — nothing exercised the documented LXC/systemd install commands against the published release URL. scripts/validate-release.sh now catches asset-identity drift at build time. This workflow catches the rest of the regression class — anything that breaks the actual install at runtime — by running the documented flow end-to-end against the published release. What it does: - Downloads install.sh, install.sh.sshsig, and the linux-amd64 tarball from releases/download/<tag>/. - Extracts the README's pinned pulse-installer ed25519 key and runs the exact ssh-keygen -Y verify command from the README's secure-install snippet against the downloaded asset. - Re-checks the server-installer banner, the --version) arg handler, and the absence of the agent banner — same pins as validate-release.sh, but now against what GitHub is actually serving (not just what was built locally). - Boots jrei/systemd-debian:12 privileged, runs `bash install.sh --archive <tarball> --disable-auto-updates` from inside, waits for systemd pulse.service to become active, hits /api/health, and asserts /api/version reports the expected version. --archive mode is used rather than --version so the workflow doesn't depend on install.sh's self-refetch loop (the re-fetched bytes are the ones we already validated). Auto-updates are disabled to avoid the timer unit doing anything during the smoke run. Triggers are workflow_dispatch + workflow_call only. Wire it into create-release.yml after the next RC validates it green. Pinned in build_release_assets_test.go so silent deletion or weakening of any critical assertion (signature verify, banner check, /api/health hit, version match) trips the test. |
||
|---|---|---|
| .. | ||
| dev | ||
| eval | ||
| installtests | ||
| lib | ||
| lint-fixer | ||
| release_control | ||
| systemd | ||
| tests | ||
| .go-version | ||
| audit-private-boundary.sh | ||
| backfill-release-assets.sh | ||
| build-release.sh | ||
| bundle.manifest | ||
| bundle.sh | ||
| check-bench-regression.sh | ||
| check-workflow-dispatch-inputs.py | ||
| clean-mock-alerts.sh | ||
| cleanup.sh | ||
| cloud-backup.sh | ||
| com.pulse.hot-dev.plist.template | ||
| conformance-smoke.sh | ||
| demo_public_browser_smoke.cjs | ||
| dev-check.sh | ||
| dev-deploy-agent.sh | ||
| dev-launchd-setup.sh | ||
| dev-launchd-wrapper.sh | ||
| docker-build.sh | ||
| ensure_test_assets.sh | ||
| exclusive-lock.mjs | ||
| generate-release-notes.sh | ||
| generate-self-hosted-feature-catalog.go | ||
| generate-types.go | ||
| hot-dev-bg.sh | ||
| hot-dev.sh | ||
| install-container-agent.sh | ||
| install-docker.sh | ||
| install-go-toolchain.sh | ||
| install-mcp.ps1 | ||
| install-mcp.sh | ||
| install.ps1 | ||
| install.sh | ||
| package-helm-chart.sh | ||
| patrol_e2e_matrix.sh | ||
| pulse-auto-update.sh | ||
| release_asset_common.sh | ||
| release_ldflags.sh | ||
| release_update_key.go | ||
| remerge-parallel.sh | ||
| render_installers.go | ||
| repo-boundary-paid-surface.allowlist | ||
| run_cloud_public_signup_smoke.sh | ||
| run_demo_public_browser_smoke.sh | ||
| run_hosted_staging_smoke.sh | ||
| session-handoff.sh | ||
| standalone.manifest | ||
| sync-production-config.sh | ||
| sync_chart_release_metadata.py | ||
| telemetry_adoption_report.py | ||
| test-vm-disk.sh | ||
| toggle-mock.sh | ||
| trigger-release-dry-run.sh | ||
| trigger-release.sh | ||
| validate-published-release.sh | ||
| validate-release.sh | ||