bakery distribution for breadboard-cli and breadboard-desktop #47
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The plan calls for the CLI and desktop app to be published through bakery / dl.breadway.dev like bos-settings. bakery.toml exists but the release CI is not wired.
Scope (blocked on release secrets in Forgejo Actions for this repo, same gap other split-out repos hit):
Blocked on release secrets (REGISTRY_TOKEN / dl upload credentials) not being provisioned as Forgejo Actions secrets on Breadway/breadboard yet, plus depends on BB-56. Leaving in backlog, needs the user to mint and add the secret first.
Rechecked the blockers: BB-56 is now done (PR #53), and bakery.toml includes the breadboard CLI executable (
breadboard) plus server binary. Breadway/breadboard currently has no Forgejo Actions secrets (GET /actions/secretsreturned an empty list), so the REGISTRY_TOKEN and dl upload credentials required by the release workflow are still missing. Leaving this in backlog until those secrets are provisioned.Reviewable implementation: #62. Separate CLI/desktop manifests, all three gated track workflows, exact-commit builds, checked immutable artifact staging and signed-index publishing are implemented. Registry dependency ECO-48: Breadway/bread-ecosystem#50.
Workspace build/tests/clippy, docs check, npm build and Svelte check pass. Headless Tauri deb build succeeded with a dev-version override; both real binaries staged and checksummed. Signed-index integration passed in a temporary root with a fixture key. Existing optional fmt drift is outside these changed files.
Live activation remains explicit: merge ECO-48, provision BAKERY_MINISIGN_SEC_KEY_PATH and any signing password, confirm Hestia runner prerequisites/download-root access, then set BREADBOARD_BAKERY_ENABLED=true. Direct host publication needs no REGISTRY_TOKEN/upload token. No releases or artifacts were published and no desktop/personal configs were changed.
Independent review: rework required
Acceptance interpretation: (1) separate CLI and desktop bakery manifests; (2) gated dev, RC and stable workflows building the triggering revision and publishing native artifacts; (3) signed index entries for both products; (4) activation waits for the registry dependency and signing credentials. The manifests at
packaging/bakery/cli.toml:1-10anddesktop.toml:1-11, checkout steps in the three workflows, andscripts/ci-bakery-release.sh:54-80cover these paths. CI is green atae1f01135bb070656b633ec619cdec452633695e.scripts/ci-bakery-release.sh:68-80holds only a breadboard-specific lock while moving both product directories and updating bothlatestlinks. The shared generator acquires.gen-index.lockonly when it starts. Another repository's generator can therefore sign an index between the two moves, or after the moves but before this job's generator. If this generator then fails, the live latest links and index can disagree. Coordinate the publication mutations with the shared index lock and define recovery when index signing fails. Add an isolated concurrency/failure check that asserts both products and the signed index advance together or remain at the prior published state.Please rework on the existing branch
feature/bb-60-bakery-distribution; keep PR #62 open and do not open another PR for BB-60. The workflow must remain disabled until the signing path and runner access are provisioned.Updated the existing PR #62 at
00cfdf8ce3. The publisher now builds and signs the complete track index from an isolated snapshot before touching live paths, then holds the shared per-track.gen-index.lockwhile installing both products, latest links, index, and signature. Final publication errors restore the prior links and index/signature and remove the new version directories. Added isolated checks for signer failure, signature-install rollback, and a competing generator waiting until both products are published. Local bash syntax, these checks, andgit diff --checkpass. Waiting on Forgejo CI and independent review.Follow-up for the existing PR #62: commit
38f720ae31adds the isolated publication rollback/concurrency regression script to.forgejo/workflows/check.yml. Local bash syntax, transaction check, andgit diff --checkpass. Waiting for CI and independent review on this head.Independent re-review of PR #62
At the latest head
38f720ae31c9a181397753d6bac0f45eb371c821, the publication rework covers the prior cross-product index race:.gen-index.lockwhile generating from a staged snapshot, installing both product versions and latest links, and publishing the signed index:scripts/publish-bakery-stage.sh:14-18,35-81,150-166.scripts/publish-bakery-stage.sh:87-148.scripts/test-publish-bakery-stage.sh:78-146. CI runs the test from.forgejo/workflows/check.yml:28-29.No source issue found in the rework. CI for this exact head is pending, so I am leaving BB-60 in TODO until the check completes. The workflow remains activation-gated as documented; no signing secret or live publication was changed.
PR #62 rework now includes a staged full-track index, shared generator lock, rollback handling, and isolated concurrency/signing-failure regression coverage. Local checks pass; the exact-head Forgejo CI check was pending at last report. Moving implementation to REVIEW for the requested pipeline handoff. If CI fails, return to TODO with the failure recorded. No publication or live activation was performed.
Board cleanup 2026-10-08: PR #62 (feature/bb-60-bakery-distribution) merged 2026-10-02, including the shared-lock publication rework and its regression test. Workflows remain activation-gated: provision BAKERY_MINISIGN_SEC_KEY_PATH (plus signing password if any), confirm Hestia runner download-root access, then set BREADBOARD_BAKERY_ENABLED=true. Closing the card since nothing is left to review.