From 89373a977cb8198932c45967e50cebbf2bb2d3da Mon Sep 17 00:00:00 2001 From: John Preston Date: Fri, 21 Aug 2026 16:15:21 +0400 Subject: [PATCH] Rename canary branches. --- .github/workflows/canary.yml | 41 ++++++++++++++++++++---------- .github/workflows/linux.yml | 5 ++-- .github/workflows/mac.yml | 5 ++-- .github/workflows/mac_packaged.yml | 5 ++-- .github/workflows/snap.yml | 5 ++-- .github/workflows/win.yml | 5 ++-- 6 files changed, 42 insertions(+), 24 deletions(-) diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml index ac52553cc4..3db105339a 100644 --- a/.github/workflows/canary.yml +++ b/.github/workflows/canary.yml @@ -2,12 +2,16 @@ # universal macOS, Linux x64 through docker), signed, packed as v2 # updates and published via a local Bot API server. # -# Each repository builds exactly ONE lane. The lane follows repository -# visibility (public repo -> canary-public, private repo -> -# canary-private) and can be overridden with the repository variable -# CANARY_CHANNEL ("public" or "private"); the private lane refuses to -# run from a public repository no matter what. A repository holds only -# its own lane's secrets. +# Each repository builds exactly ONE lane from its own branch: the +# public repository builds canary-public from 'public-canary', the +# private one builds canary-private from 'private-canary'. The lane +# follows repository visibility and can be overridden with the +# repository variable CANARY_CHANNEL ("public" or "private"); the branch +# name must then be '-canary', so a branch pushed to the wrong +# repository is refused, and the private lane refuses to run from a +# public repository no matter what. A repository holds only its own +# lane's secrets, and its 'canary' environment admits only its own +# branch. # # Infrastructure this workflow needs before its first real run, all under # the 'canary' environment unless noted. Placeholders, do not invent values: @@ -93,7 +97,8 @@ name: Canary. on: push: branches: - - canary + - public-canary + - private-canary concurrency: group: canary-publish @@ -111,8 +116,12 @@ jobs: runs-on: depot-ubuntu-latest environment: canary # Belt and braces next to the environment branch policy: the secrets - # are never even requested from a run that is not a push to canary. - if: github.event_name == 'push' && github.ref == 'refs/heads/canary' + # are never even requested from a run that is not a push to a canary + # branch (the lane check below then pins the branch to the lane). + if: >- + github.event_name == 'push' + && (github.ref == 'refs/heads/public-canary' + || github.ref == 'refs/heads/private-canary') permissions: contents: read @@ -135,7 +144,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: # Full history: the changelog walks commits and the pipeline - # must survive force-pushes and rebases of the canary branch. + # must survive force-pushes and rebases of the lane's branch. fetch-depth: 0 - name: Compute canary version. @@ -155,9 +164,9 @@ jobs: run: | # A re-run of an older run would read the live counter and # republish old code as a newer version: only the current tip - # of the canary branch may become a canary. - if [ "$GITHUB_SHA" != "$(git rev-parse origin/canary)" ]; then - echo "::error::$GITHUB_SHA is not the tip of canary, refusing to publish old code as a new version." + # of the lane's branch may become a canary. + if [ "$GITHUB_SHA" != "$(git rev-parse "origin/$GITHUB_REF_NAME")" ]; then + echo "::error::$GITHUB_SHA is not the tip of $GITHUB_REF_NAME, refusing to publish old code as a new version." exit 1 fi @@ -180,6 +189,10 @@ jobs: echo "::error::The private canary lane only builds from the private repository." exit 1 fi + if [ "$GITHUB_REF_NAME" != "$CHANNEL-canary" ]; then + echo "::error::Branch '$GITHUB_REF_NAME' is not this repository's $CHANNEL lane branch ('$CHANNEL-canary'), refusing to build it here." + exit 1 + fi echo "channel=$CHANNEL" >> $GITHUB_OUTPUT if [ "$CHANNEL" = "public" ]; then CHAT_ID="$PUBLIC_CHANNEL" @@ -254,7 +267,7 @@ jobs: PREVIOUS=$(curl -sf \ -H "Authorization: Bearer $GITHUB_TOKEN" \ -H "Accept: application/vnd.github+json" \ - "https://api.github.com/repos/$GITHUB_REPOSITORY/actions/workflows/canary.yml/runs?branch=canary&status=completed&per_page=5" \ + "https://api.github.com/repos/$GITHUB_REPOSITORY/actions/workflows/canary.yml/runs?branch=$GITHUB_REF_NAME&status=completed&per_page=5" \ | jq -r --argjson id "$GITHUB_RUN_ID" \ '[.workflow_runs[] | select(.id != $id)][0].head_sha // empty' \ || true) diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml index a9e240248f..7d8034eac9 100644 --- a/.github/workflows/linux.yml +++ b/.github/workflows/linux.yml @@ -2,9 +2,10 @@ name: Linux. on: push: - # Pushes to canary run only canary.yml, see there. + # Pushes to the canary branches run only canary.yml, see there. branches-ignore: - - canary + - public-canary + - private-canary paths-ignore: - 'docs/**' - '**.md' diff --git a/.github/workflows/mac.yml b/.github/workflows/mac.yml index 7755eb7170..184a94b091 100644 --- a/.github/workflows/mac.yml +++ b/.github/workflows/mac.yml @@ -2,9 +2,10 @@ name: MacOS. on: push: - # Pushes to canary run only canary.yml, see there. + # Pushes to the canary branches run only canary.yml, see there. branches-ignore: - - canary + - public-canary + - private-canary paths-ignore: - 'docs/**' - '**.md' diff --git a/.github/workflows/mac_packaged.yml b/.github/workflows/mac_packaged.yml index 489971241f..24d2f2c4b6 100644 --- a/.github/workflows/mac_packaged.yml +++ b/.github/workflows/mac_packaged.yml @@ -2,9 +2,10 @@ name: MacOS Packaged. on: push: - # Pushes to canary run only canary.yml, see there. + # Pushes to the canary branches run only canary.yml, see there. branches-ignore: - - canary + - public-canary + - private-canary paths-ignore: - 'docs/**' - '**.md' diff --git a/.github/workflows/snap.yml b/.github/workflows/snap.yml index d0943a3c1c..82f85ae906 100644 --- a/.github/workflows/snap.yml +++ b/.github/workflows/snap.yml @@ -2,9 +2,10 @@ name: Snap. on: push: - # Pushes to canary run only canary.yml, see there. + # Pushes to the canary branches run only canary.yml, see there. branches-ignore: - - canary + - public-canary + - private-canary paths-ignore: - 'docs/**' - '**.md' diff --git a/.github/workflows/win.yml b/.github/workflows/win.yml index a3842fcb10..219c42ebf6 100644 --- a/.github/workflows/win.yml +++ b/.github/workflows/win.yml @@ -2,9 +2,10 @@ name: Windows. on: push: - # Pushes to canary run only canary.yml, see there. + # Pushes to the canary branches run only canary.yml, see there. branches-ignore: - - canary + - public-canary + - private-canary paths-ignore: - 'docs/**' - '**.md'