ci(shared-core): resolve the framework over the unauthenticated download URL - #1391
Merged
Conversation
…oad URL
KMMBridge writes the release asset's API URL into `Package.swift`, and
`api.github.com` rate limits unauthenticated callers to 60 requests an hour per
IP. The 0.4.0 publish failed its own verify step on that limit:
failed downloading '.../releases/assets/540211749.zip' which is required by
binary target 'SharedCore': badResponseStatusCode(403)
The repo is public, so `github.com/.../releases/download/<tag>/...` serves the
same bytes with no limit and no credentials. Rewrite the variable to that form
after the upload, then check the URL is in the file and that it resolves.
This step was written for the 0.3.1 publish but was only ever run from an
unmerged branch, so `code/cash` has never had it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The 0.4.0 publish run failed at its own verify step:
KMMBridge points the binary target at the release asset's API URL. That endpoint serves private repos, but it rate limits unauthenticated callers to 60 requests an hour per IP — which is what a shared macOS runner, or a developer resolving the package, hits.
flipcash-shared-core-spmis public, sogithub.com/<repo>/releases/download/<tag>/SharedCore.xcframework.zipserves the same bytes with no limit and no credentials.This step already existed: it was written for the 0.3.1 publish, which was dispatched from
feat/shared-badge-cgpath. That branch never opened a PR, socode/cashhas never carried the fix and the next publish fromcode/cashwas the first to hit it. The workflow file here is byte-identical to the one 0.3.1 published from.After the rewrite the step greps the URL back out of
Package.swiftandcurl -Is it, so a wrong tag or a missing asset fails before the tag moves.Fallout to clean up separately
Tag
0.4.0and release0.4.0exist inflipcash-shared-core-spm— the release upload creates them before the verify step runs. Because "Commit and tag the Swift Package" was skipped, the tag still points at5b1a6e83("SharedCore 0.3.1"), so0.4.0currently resolves to the 0.3.1 binary. It has to be deleted and re-cut, or skipped in favour of0.4.1, before anything depends on it.