lfg2025/archy
1
0
Fork 0
Code Issues 11 Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix(release): surface companion build and secure GitWorkshop deps

Browse Source
This commit is contained in:
archipelago
2026-09-11 06:10:59 -04:00
parent ef8c3a76be
commit dac29baf97
10 changed files with 1601 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/1.8.12-RELEASE-PLAN.md
+9 -8
View File
@@ -46,12 +46,19 @@ publication.
- The release-root signer exists locally as a binary, while its mnemonic
remains correctly offline.
- ISO dependencies (`xorriso`, `mksquashfs`, and QEMU) are installed.
- The corrected release gate passed on 2026-09-11: 1,091 frontend tests,
- The corrected release gate passed on 2026-09-11: 1,093 frontend tests,
production UI build, registry candidate/trust checks, Rust check, 114 focused
backend tests plus orchestration, and live dashboard/AIUI/RPC probes. Android
lint and the mobile Chromium signer-handoff regression also pass.
- GitWorkshop's refreshed dependency lock reports zero production or
development npm advisories. Its type-check, all 152 unit tests, and exact
Archipelago subpath production build pass with `fflate` 0.8.3, React Router
7.18.3, and Vitest 5.0.0.
- The locally served Companion candidate is 28,157,847 bytes with SHA-256
`30e0b6257f17bb5e072941ccce6fde04b6c8ae59a49b45169e1920aec1b108cf`.
- The Discover banner and automatic Companion prompt read that artifact's
no-cache metadata, display 0.5.32 build 52, and remember dismissal per build;
the ISO gate derives the same expected version from the Android project.
- The owner accepted the risk of redistributing the pinned, unlicensed
GitWorkshop revision on 2026-09-11. `NOTICE` and `UPSTREAM.md` disclose that
decision without claiming an upstream license.
@@ -70,10 +77,6 @@ publication.
reachable in an existing public Git branch. It provides upgrade continuity,
not production authenticity. A future production Companion must use the
`com.archipelago.app` package with a privately held release key.
- The pinned GitWorkshop revision has 4 high and 6 moderate production npm
advisories. The final image is static nginx, reducing exposure to Node-server
advisories, but browser dependencies remain reachable. Release requires an
owner accept/fix decision.
- The repository is large: this checkout has about 5.4 GiB of packed objects,
and the Gitea repository is about 5 GiB. Public GRASP replication must be
allowed enough time and verified rather than assumed complete.
@@ -93,9 +96,7 @@ committed, placed in shell history, or stored on the node:
nsec on a command line.
2. The 24-word Archipelago release-master mnemonic for three signing actions:
the OTA manifest, the app catalog, and the ISO checksum document.
3. A decision to accept the recorded GitWorkshop dependency advisories for
1.8.12-alpha or pause for a dependency update.
4. A decision to publish 0.5.32 on the existing explicitly non-production
3. A decision to publish 0.5.32 on the existing explicitly non-production
`.debug` Companion channel, omit it, or pause for a secure production-app
signing ceremony.