Austin McKinley
c5093818ae
Rewire OTA publishing off the legacy ota1 box onto the S3-backed denis service, in two places: - Prod path (bundle-deploy-eas-update.yml): dual-write the exported bundle to denis via `denis publish` alongside the existing ota1 upload, under the identical `!includes-changes && !version-changed` gate. Assumes the main-only `denis-ci-publish` role via OIDC (id-token: write). Both paths must succeed; they are removed together once denis is the sole origin. - Per-PR previews (pull-request-commit.yml): replace the `@github-actions ota` comment trigger (pull-request-comment.yml, deleted) with an automatic job that fires on pull_request. Gated to same-repo PRs (head.repo.full_name == github.repository) authored by a MEMBER/OWNER/COLLABORATOR, so a fork or external contributor can never run with the publish role or repo secrets in scope. Publishes to the `pull-request-<N>` channel under the PR-scoped `denis-ci-publish-pr` role, further narrowed by an inline session policy to `pr/<N>/*`. - setup-denis composite action: mint a short-lived github-app token (contents:read on private tango), download + verify the pinned denis release binary, put it on PATH. denis release tag is a single `DENIS_RELEASE_TAG` env per workflow. ROAST_SKIP: pre-commit roast flags setup-denis verifying the binary against a checksum from the same tango release (no independent digest anchor). Reviewed and accepted: exploitation requires compromising the private tango release itself, and the marginal integrity gain is not worth pinning a digest that must be bumped on every denis roll. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
46 lines
1.5 KiB
Bash
Executable File
46 lines
1.5 KiB
Bash
Executable File
#!/bin/bash
|
|
set -o errexit
|
|
set -o pipefail
|
|
set -o nounset
|
|
|
|
# Publishes the just-exported Expo bundle to the denis OTA service (S3) via the
|
|
# `denis publish` CLI. Mirrors bundleUpdate.sh's inputs (runtime version, bundle
|
|
# version, build numbers) but targets denis instead of the legacy ota1 upload.
|
|
# Expects: the `denis` binary on PATH (setup-denis action), ambient AWS creds
|
|
# (configure-aws-credentials OIDC), and BSKY_IOS_BUILD_NUMBER /
|
|
# BSKY_ANDROID_VERSION_CODE from the use-build-number wrapper.
|
|
|
|
rm -rf bundleTempDir
|
|
|
|
echo "Assembling bundle directory..."
|
|
node scripts/bundleUpdate.js
|
|
|
|
if [ -z "$RUNTIME_VERSION" ]; then
|
|
RUNTIME_VERSION=$(cat package.json | jq '.version' -r)
|
|
fi
|
|
|
|
BUNDLE_VERSION=$(date +%s)
|
|
DENIS_CDN_DOMAIN="${DENIS_CDN_DOMAIN:-updates.bsky.app}"
|
|
DENIS_S3_BUCKET="${DENIS_S3_BUCKET:-bsky-denis-ota-prod}"
|
|
|
|
echo "Publishing to denis..."
|
|
echo " runtime-version: $RUNTIME_VERSION"
|
|
echo " bundle-version: $BUNDLE_VERSION"
|
|
echo " channel: $CHANNEL_NAME"
|
|
echo " ios-build-number: $BSKY_IOS_BUILD_NUMBER"
|
|
echo " android-build-number: $BSKY_ANDROID_VERSION_CODE"
|
|
echo " cdn-domain: $DENIS_CDN_DOMAIN"
|
|
echo " s3-bucket: $DENIS_S3_BUCKET"
|
|
|
|
denis publish \
|
|
--bundle-dir bundleTempDir \
|
|
--runtime-version "$RUNTIME_VERSION" \
|
|
--bundle-version "$BUNDLE_VERSION" \
|
|
--channel "$CHANNEL_NAME" \
|
|
--ios-build-number "$BSKY_IOS_BUILD_NUMBER" \
|
|
--android-build-number "$BSKY_ANDROID_VERSION_CODE" \
|
|
--cdn-domain "$DENIS_CDN_DOMAIN" \
|
|
--s3-bucket "$DENIS_S3_BUCKET"
|
|
|
|
rm -rf bundleTempDir
|