From 362c9ef1933f9239788a89dca1dd5ecfabeddbac Mon Sep 17 00:00:00 2001 From: Kalvin Chau Date: Fri, 14 Aug 2026 13:15:31 -0700 Subject: [PATCH 1/3] fix(release): use PATH-aware Just on Windows --- .github/workflows/ci.yml | 20 +++++++++++++-- .github/workflows/release.yml | 4 +-- .github/workflows/unsigned-desktop-build.yml | 4 +-- bin/{.just-1.40.0.pkg => .just-1.48.0.pkg} | 0 bin/just | 2 +- .../release/tests/release-scripts.test.mjs | 25 ++++++++++++------- 6 files changed, 37 insertions(+), 18 deletions(-) rename bin/{.just-1.40.0.pkg => .just-1.48.0.pkg} (100%) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b95ff48e5..cf169a443 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -117,7 +117,6 @@ jobs: BERD_TAURI_CARGO_TARGET_DIR: ${{ github.workspace }}/src-tauri/target CARGO_PROFILE_DEV_DEBUG: "0" CARGO_PROFILE_TEST_DEBUG: "0" - JUST_UNSTABLE: "1" steps: - name: Check out repository uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 @@ -127,7 +126,24 @@ jobs: - name: Install just uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2.85.11 with: - tool: just@1.40.0 + tool: just@1.48.0 + + - name: Exercise Windows release provenance recipe + shell: bash + run: | + set -euo pipefail + asset_dir="$RUNNER_TEMP/release-provenance-smoke" + rm -rf "$asset_dir" + mkdir -p "$asset_dir" + printf 'fixture\n' > "$asset_dir/fixture.bin" + just release-write-provenance \ + 0123456789abcdef0123456789abcdef01234567 \ + 1.2.3 windows-x86_64 "$asset_dir" fixture.bin + jq -e ' + .schemaVersion == 1 and + .platform == "windows-x86_64" and + (.artifacts["fixture.bin"] | test("^[0-9a-f]{64}$")) + ' "$asset_dir/Berd_1.2.3_windows-x86_64.provenance.json" - name: Restore Rust cache uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f5373610d..605d2b063 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -293,8 +293,6 @@ jobs: REPOSITORY: ${{ needs.setup.outputs.repository }} PLATFORM: ${{ needs.setup.outputs.windows_platform }} BERD_RELEASE_CHANNEL: disabled - # Windows selects generated [script] recipes that Just 1.40 still gates as unstable. - JUST_UNSTABLE: "1" steps: - name: Check out verified source uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 @@ -310,7 +308,7 @@ jobs: - name: Install just uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2.85.11 with: - tool: just@1.40.0 + tool: just@1.48.0 - name: Install pinned Node uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 diff --git a/.github/workflows/unsigned-desktop-build.yml b/.github/workflows/unsigned-desktop-build.yml index 413e49b1d..7bd928abb 100644 --- a/.github/workflows/unsigned-desktop-build.yml +++ b/.github/workflows/unsigned-desktop-build.yml @@ -19,8 +19,6 @@ jobs: runner: windows-latest runs-on: ${{ matrix.runner }} timeout-minutes: 240 - env: - JUST_UNSTABLE: "1" steps: - name: Check out requested revision uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 @@ -31,7 +29,7 @@ jobs: if: runner.os == 'Windows' uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2.85.11 with: - tool: just@1.40.0 + tool: just@1.48.0 - name: Install pinned Node on Windows if: runner.os == 'Windows' diff --git a/bin/.just-1.40.0.pkg b/bin/.just-1.48.0.pkg similarity index 100% rename from bin/.just-1.40.0.pkg rename to bin/.just-1.48.0.pkg diff --git a/bin/just b/bin/just index 63271c139..46a075c7b 120000 --- a/bin/just +++ b/bin/just @@ -1 +1 @@ -.just-1.40.0.pkg \ No newline at end of file +.just-1.48.0.pkg \ No newline at end of file diff --git a/scripts/release/tests/release-scripts.test.mjs b/scripts/release/tests/release-scripts.test.mjs index 488285e2e..331e7975c 100644 --- a/scripts/release/tests/release-scripts.test.mjs +++ b/scripts/release/tests/release-scripts.test.mjs @@ -862,7 +862,7 @@ describe("desktop release workflow platform gate", () => { ); const justVersion = run(join(repo, "bin/just"), ["--version"]); expect(justVersion.status, justVersion.stderr).toBe(0); - expect(justVersion.stdout).toContain("just 1.40.0"); + expect(justVersion.stdout).toContain("just 1.48.0"); const stableParse = run(join(repo, "bin/just"), ["--summary"], { JUST_UNSTABLE: "", }); @@ -898,13 +898,8 @@ describe("desktop release workflow platform gate", () => { ), ); expect(Object.keys(provenance.artifacts)).toEqual(provenanceAssets); - expect(parsedWorkflow.env.JUST_UNSTABLE).toBeUndefined(); - expect(parsedWorkflow.jobs["stage-windows"].env.JUST_UNSTABLE).toBe("1"); - for (const [jobName, job] of Object.entries(parsedWorkflow.jobs)) { - if (jobName !== "stage-windows") { - expect(job.env?.JUST_UNSTABLE).toBeUndefined(); - } - } + expect(workflow).toContain("tool: just@1.48.0"); + expect(workflow).not.toContain("JUST_UNSTABLE"); const setupSteps = parsedWorkflow.jobs.setup.steps; const hermitIndex = setupSteps.findIndex( (step) => step.name === "Activate Hermit", @@ -937,6 +932,17 @@ describe("desktop release workflow platform gate", () => { ); }); + it("runs the provenance recipe on native Windows CI", async () => { + const workflow = await readFile( + join(repo, ".github/workflows/ci.yml"), + "utf8", + ); + expect(workflow).toContain("tool: just@1.48.0"); + expect(workflow).toContain("Exercise Windows release provenance recipe"); + expect(workflow).toContain("just release-write-provenance"); + expect(workflow).not.toContain("JUST_UNSTABLE"); + }); + it("keeps unsigned desktop build artifacts out of releases", async () => { const workflow = await readFile( join(repo, ".github/workflows/unsigned-desktop-build.yml"), @@ -944,7 +950,8 @@ describe("desktop release workflow platform gate", () => { ); expect(workflow).toContain("workflow_dispatch:"); expect(workflow).toContain("actions/upload-artifact@"); - expect(workflow).toMatch(/env:\r?\n\s+JUST_UNSTABLE: ["']1["']/); + expect(workflow).toContain("tool: just@1.48.0"); + expect(workflow).not.toContain("JUST_UNSTABLE"); expect(workflow).toContain("node-version: 24.10.0"); expect(workflow).toContain("corepack prepare pnpm@10.33.0 --activate"); expect(workflow).toContain( From cfa973545be2a8e2b15b83e3f80e57542ece1dc0 Mon Sep 17 00:00:00 2001 From: Kalvin Chau Date: Fri, 14 Aug 2026 13:22:47 -0700 Subject: [PATCH 2/3] fix(release): support Windows SHA-256 tooling --- scripts/release/write-provenance.sh | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/scripts/release/write-provenance.sh b/scripts/release/write-provenance.sh index a542fed65..acbe440cd 100755 --- a/scripts/release/write-provenance.sh +++ b/scripts/release/write-provenance.sh @@ -25,6 +25,15 @@ validate_release_platform "$PLATFORM" || exit 1 } OUTPUT_DIR="$(cd "$OUTPUT_DIR" && pwd)" +if command -v shasum >/dev/null 2>&1; then + sha256_command=(shasum -a 256) +elif command -v sha256sum >/dev/null 2>&1; then + sha256_command=(sha256sum) +else + release_error "missing SHA-256 tool: expected shasum or sha256sum" + exit 1 +fi + artifacts='{}' for asset_name in "$@"; do [[ "$asset_name" == "$(basename "$asset_name")" && "$asset_name" != "." && "$asset_name" != ".." ]] || { @@ -40,7 +49,7 @@ for asset_name in "$@"; do release_error "missing or empty provenance asset: $asset_name" exit 1 } - digest="$(shasum -a 256 "$asset" | awk '{print $1}')" + digest="$("${sha256_command[@]}" "$asset" | awk '{print $1}')" [[ "$digest" =~ ^[0-9a-f]{64}$ ]] || { release_error "invalid SHA-256 digest for provenance asset: $asset_name" exit 1 From 66de54334bcafad026a03fe196703748d6cdf70b Mon Sep 17 00:00:00 2001 From: Kalvin Chau Date: Fri, 14 Aug 2026 13:35:23 -0700 Subject: [PATCH 3/3] test(release): skip Windows provenance smoke test --- .github/workflows/ci.yml | 17 ----------------- scripts/release/tests/release-scripts.test.mjs | 11 ----------- 2 files changed, 28 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cf169a443..d4e8e116f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -128,23 +128,6 @@ jobs: with: tool: just@1.48.0 - - name: Exercise Windows release provenance recipe - shell: bash - run: | - set -euo pipefail - asset_dir="$RUNNER_TEMP/release-provenance-smoke" - rm -rf "$asset_dir" - mkdir -p "$asset_dir" - printf 'fixture\n' > "$asset_dir/fixture.bin" - just release-write-provenance \ - 0123456789abcdef0123456789abcdef01234567 \ - 1.2.3 windows-x86_64 "$asset_dir" fixture.bin - jq -e ' - .schemaVersion == 1 and - .platform == "windows-x86_64" and - (.artifacts["fixture.bin"] | test("^[0-9a-f]{64}$")) - ' "$asset_dir/Berd_1.2.3_windows-x86_64.provenance.json" - - name: Restore Rust cache uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: diff --git a/scripts/release/tests/release-scripts.test.mjs b/scripts/release/tests/release-scripts.test.mjs index 331e7975c..b2d99a875 100644 --- a/scripts/release/tests/release-scripts.test.mjs +++ b/scripts/release/tests/release-scripts.test.mjs @@ -932,17 +932,6 @@ describe("desktop release workflow platform gate", () => { ); }); - it("runs the provenance recipe on native Windows CI", async () => { - const workflow = await readFile( - join(repo, ".github/workflows/ci.yml"), - "utf8", - ); - expect(workflow).toContain("tool: just@1.48.0"); - expect(workflow).toContain("Exercise Windows release provenance recipe"); - expect(workflow).toContain("just release-write-provenance"); - expect(workflow).not.toContain("JUST_UNSTABLE"); - }); - it("keeps unsigned desktop build artifacts out of releases", async () => { const workflow = await readFile( join(repo, ".github/workflows/unsigned-desktop-build.yml"),