Repository navigation
ci(kiro-extension): publish from a job that can read environment secrets - #39
Merged
Merged
Conversation
The PAT lives under a GitHub environment, and an environment secret is only injected into a job that declares `environment:`. The build matrix does not and should not: it runs on every pull request, so an environment carrying protection rules would gate ordinary PR builds behind manual approval. Uploading to a registry is an HTTP request, not a build, so it does not need the platform it targets. Publishing therefore moves into its own job that declares the environment, is gated on a release tag, and fans out over the four targets on ubuntu with fail-fast disabled, so one failed upload cannot strand the other three. BEHAVIOUR CHANGE: publishing no longer starts the moment a single platform finishes; it now waits for all four builds. That is a deliberate reversal. Open VSX treats a version as immutable, so if darwin had already published 0.1.0 when win32 failed to build, that gap could never be filled, only superseded by 0.1.1. Waiting is the difference between retrying a release and burning a version number. The environment name defaults to `open-vsx` and can be redirected with an OVSX_ENVIRONMENT repository variable, since `vars` is one of the few contexts available to the `environment` key. Adds scripts/publish.mjs for the upload half, carrying the same guards release.mjs had: refuse without a token, refuse when the tag disagrees with package.json, and create the namespace idempotently, treating "already exists" as success because four jobs race to create it. Verified: YAML parses, every run: block parses under bash -n, the build matrix no longer references the publish path, and all three publish.mjs refusals were executed (no token, tag mismatch, missing VSIX). The upload itself is unexercised until a real tag with a real token.
The environment holding the token is named OVSX_PAT, the same name as the secret inside it, so the previous default of `open-vsx` would not have matched and the secret would have resolved to an empty string. Names it directly and drops the vars.OVSX_ENVIRONMENT indirection, which only existed because the environment name was unknown. Confirmed against the repository settings: no required reviewers and no wait timer, so declaring this environment introduces no approval gate, and deployment branches and tags is set to no restriction, so a release tag is permitted to access it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The PAT lives under a GitHub environment, and an environment secret is only injected into a job that declares
environment:. The build matrix does not and should not: it runs on every pull request, so an environment carrying protection rules would gate ordinary PR builds behind manual approval.Uploading to a registry is an HTTP request, not a build, so it does not need the platform it targets. Publishing therefore moves into its own job that declares the environment, is gated on a release tag, and fans out over the four targets on ubuntu with fail-fast disabled, so one failed upload cannot strand the other three.
BEHAVIOUR CHANGE: publishing no longer starts the moment a single platform finishes; it now waits for all four builds. That is a deliberate reversal. Open VSX treats a version as immutable, so if darwin had already published 0.1.0 when win32 failed to build, that gap could never be filled, only superseded by 0.1.1. Waiting is the difference between retrying a release and burning a version number.
The environment name defaults to
open-vsxand can be redirected with an OVSX_ENVIRONMENT repository variable, sincevarsis one of the few contexts available to theenvironmentkey.Adds scripts/publish.mjs for the upload half, carrying the same guards release.mjs had: refuse without a token, refuse when the tag disagrees with package.json, and create the namespace idempotently, treating "already exists" as success because four jobs race to create it.
Verified: YAML parses, every run: block parses under bash -n, the build matrix no longer references the publish path, and all three publish.mjs refusals were executed (no token, tag mismatch, missing VSIX). The upload itself is unexercised until a real tag with a real token.