claudeandbit
e5d1f9a5bf
fdroid-repo-ci#6's "Superseded" sections change the rule: the candidate is now the committer date of the commit being built, clamped on both sides, rather than whatever minute the runner happened to pick the job up in. Backwards: rebase, amend and cherry-pick can produce a commit older than one already published, so the clamp keys off the committer date, not the author date -- author date survives a rebase unchanged and would replay a stale, already-superseded number. Forwards: a commit's timestamp is attacker- and typo-controlled and the number only ever rises, so a bad one can never be walked back. A value placed just below the int32 ceiling would still publish and then no later build could ever exceed it -- the app becomes permanently un-updatable. TOLERANCE absorbs honest clock skew and the clamp warns loudly rather than rejecting, since rejecting would block a legitimate build over a few minutes of skew while buying nothing the clamp doesn't already cover. next_version_code.py now takes the committer timestamp as a third argument (Unix seconds, what `git log -1 --format=%ct` prints) instead of reading the system clock, keeping it pure and testable without a git checkout. next-version-code.sh, README.md and action.yml updated to match. Granularity stays minutes: concurrency is handled separately (a workflow-level concurrency group, plus publish.sh's refuse-on-existing), so it is now a pure headroom choice. Tests (test_next_version_code.py, test_next_version_code.sh): a normal commit yields its own minute, a commit older than the published maximum still yields published+1, a future-dated commit within tolerance passes through untouched while one beyond it is clamped and warns, a commit dated near the int32 ceiling does not produce a near-int32 result, and a dedicated property test checks the result always strictly exceeds every versionCode in the fixture across all of the above. Each was verified by injecting the corresponding fault (removing the backwards clamp, removing the forwards clamp, and ignoring the commit's date entirely) and confirming the relevant test failed, then reverting. 98 assertions offline (0 failed, 4 skipped -- pre-existing, live-bucket only), up from 91. Co-authored-by: bit <bit@das-labor.org>
43 lines
1.8 KiB
YAML
43 lines
1.8 KiB
YAML
# Makes sign-apk.sh, fdroid-update.sh, publish.sh, next-version-code.sh and
|
|
# with-nixpkgs.sh available to a workflow and reports where they are.
|
|
#
|
|
# Consume it with the **full URL**, the same reason recorded in weblib-ci's
|
|
# README: `uses: owner/repo@main` resolves against the instance's default
|
|
# actions URL rather than this host, and only the full URL form works while
|
|
# the repository being referenced is private -- and the repository holding
|
|
# the signing keys that consumes this one is private on purpose.
|
|
#
|
|
# - uses: actions/checkout@v4
|
|
# - id: ci
|
|
# uses: https://git.chaosbit.de/weblib/fdroid-repo-ci@main
|
|
# - run: bash "${{ steps.ci.outputs.path }}/sign-apk.sh" ...
|
|
#
|
|
# Nothing here reads a secret or names a bucket, a keystore or a consumer
|
|
# repo -- those all stay on the caller's side of this action's output path.
|
|
name: F-Droid repo publishing tools
|
|
description: >-
|
|
Shared, key-free tooling to align-check and sign a prebuilt APK, run
|
|
`fdroid update` over a binary repo, compute the next monotonic versionCode
|
|
for a commit's committer date, and publish the result to an S3-compatible
|
|
bucket. The caller supplies the keys, the bucket, the APK and the commit
|
|
being built; this action supplies the pinned toolchain and the scripts.
|
|
|
|
outputs:
|
|
path:
|
|
description: >-
|
|
Directory holding with-nixpkgs.sh, nixpkgs-pin, sign-apk.sh,
|
|
fdroid-update.sh, next-version-code.sh, next_version_code.py and
|
|
publish.sh.
|
|
value: ${{ github.action_path }}
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- shell: bash
|
|
run: |
|
|
echo "fdroid-repo-ci tools at ${{ github.action_path }}"
|
|
for f in with-nixpkgs.sh nixpkgs-pin sign-apk.sh fdroid-update.sh \
|
|
next-version-code.sh next_version_code.py publish.sh; do
|
|
test -f "${{ github.action_path }}/$f"
|
|
done
|