From b2fe1cb1e0156c6f61700f0c7b990b78c0103da4 Mon Sep 17 00:00:00 2001 From: Logan Date: Tue, 18 Aug 2026 22:25:11 -0400 Subject: [PATCH] ci: skip a prerelease tag in all four publishers Their trigger is `v*`, which matches `v0.4.0-beta.1`. They guarded `v0.0.0` -- the version floor -- and nothing else, so the first prerelease tag would have published a beta everywhere. Nothing produces one today. The guard is here because the thing that would is `prerelease: true` in .releaserc.yml, a one-line change whose blast radius is four public channels and which nothing in those four files mentions. That is the same argument release.yml's `chore(release):` guard is kept on: cheap, against something a future edit turns on somewhere else entirely. android-apk is the worst of the four twice over. Its APK goes to the *generic* registry, which is readable without credentials so Obtainium can poll a plain URL, so a beta would be offered to every device on it. And its versionCode maths splits on dots: it would read "1" out of "0-beta" and produce a wrong number rather than a failed build, which matters because Android orders releases by that integer and refuses anything not greater than what is installed. Each is a clean skip rather than a failure, matching the v0.0.0 guard beside it: a red run against a tag that was never meant to ship is noise. --- .gitea/workflows/android-apk.yml | 17 +++++++++++++++++ .gitea/workflows/arch-package.yml | 16 ++++++++++++++++ .gitea/workflows/desktop-assets.yml | 13 +++++++++++++ .gitea/workflows/homebrew-formula.yml | 12 ++++++++++++ 4 files changed, 58 insertions(+) diff --git a/.gitea/workflows/android-apk.yml b/.gitea/workflows/android-apk.yml index 93165d4..94e6c06 100644 --- a/.gitea/workflows/android-apk.yml +++ b/.gitea/workflows/android-apk.yml @@ -139,6 +139,23 @@ jobs: echo "skip=true" >> "$GITHUB_OUTPUT" exit 0 fi + + # Nor is a prerelease, and this trigger is `v*`, which matches + # `v0.4.0-beta.1`. Two reasons it is worst here. The APK goes + # to the *generic* registry, which is readable without + # credentials so Obtainium can poll a plain URL — a beta would + # be offered to every device on it. And the versionCode maths + # below splits on dots and would read "1" out of "0-beta", + # producing a code that is wrong rather than a build that + # fails: Android orders releases by that integer and refuses + # anything not greater than what is installed. + case "$v" in + *-*) + echo "v$v is a prerelease; not publishing an APK for it" + echo "skip=true" >> "$GITHUB_OUTPUT" + exit 0 + ;; + esac echo "skip=false" >> "$GITHUB_OUTPUT" # Android orders releases by an integer and refuses anything diff --git a/.gitea/workflows/arch-package.yml b/.gitea/workflows/arch-package.yml index 701d386..82070d4 100644 --- a/.gitea/workflows/arch-package.yml +++ b/.gitea/workflows/arch-package.yml @@ -72,6 +72,22 @@ jobs: exit 0 fi + # A prerelease is not a shipment either, and this trigger is + # `v*` — which matches `v0.4.0-beta.1`. Nothing produces one + # today; the guard is here because the thing that would is + # semantic-release's `prerelease: true` channel, a one-line + # change in .releaserc.yml whose blast radius is four public + # package channels. Same argument as release.yml's + # `chore(release):` guard: cheap, against something a future + # edit turns on somewhere else entirely. + case "$v" in + *-*) + echo "$v is a prerelease; not packaging it for pacman" + echo "skip=true" >> "$GITHUB_OUTPUT" + exit 0 + ;; + esac + echo "skip=false" >> "$GITHUB_OUTPUT" echo "tag=$v" >> "$GITHUB_OUTPUT" echo "building $v" diff --git a/.gitea/workflows/desktop-assets.yml b/.gitea/workflows/desktop-assets.yml index 34db86e..a993830 100644 --- a/.gitea/workflows/desktop-assets.yml +++ b/.gitea/workflows/desktop-assets.yml @@ -95,6 +95,19 @@ jobs: exit 0 fi + # Nor is a prerelease, and this trigger is `v*`, which matches + # `v0.4.0-beta.1`. The mildest of the four — assets attach to + # the prerelease's own Gitea release and no package manager + # reads them — but four workflows sharing one trigger should + # share one answer about what a shipment is. + case "$v" in + *-*) + echo "$v is a prerelease; not attaching desktop assets" + echo "skip=true" >> "$GITHUB_OUTPUT" + exit 0 + ;; + esac + echo "skip=false" >> "$GITHUB_OUTPUT" echo "tag=$v" >> "$GITHUB_OUTPUT" echo "version=${v#v}" >> "$GITHUB_OUTPUT" diff --git a/.gitea/workflows/homebrew-formula.yml b/.gitea/workflows/homebrew-formula.yml index c19d14e..1bb698b 100644 --- a/.gitea/workflows/homebrew-formula.yml +++ b/.gitea/workflows/homebrew-formula.yml @@ -56,6 +56,18 @@ jobs: echo "skip=true" >> "$GITHUB_OUTPUT" exit 0 fi + + # Nor is a prerelease, and this trigger is `v*`, which matches + # `v0.4.0-beta.1`. It matters most here of the four: the tap + # is public, and `brew upgrade` would offer a beta to everyone + # on it. + case "$VERSION" in + *-*) + echo "$TAG is a prerelease; not syncing it to a public tap" + echo "skip=true" >> "$GITHUB_OUTPUT" + exit 0 + ;; + esac echo "skip=false" >> "$GITHUB_OUTPUT" TARBALL="${SOURCE_TARBALL_BASE}/${TAG}.tar.gz"