Merge pull request 'KAN-58: Retry public S3 downloads and prepare macOS 0.1.1' (#157) from fix/KAN-58-retry-public-downloads into main

Reviewed-on: #157

.github/workflows/macos-release.yml

@@ -37,7 +37,6 @@ jobs:
     outputs:
       commit: ${{ steps.ref.outputs.commit }}
       tag: ${{ steps.ref.outputs.tag }}
-      runner: ${{ steps.ref.outputs.runner }}
     steps:
       - name: Check out repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -64,7 +63,7 @@ jobs:
           commit="$(git rev-parse --verify "refs/tags/$tag^{commit}")"
           git merge-base --is-ancestor "$commit" origin/main || { echo 'Release tag must belong to main.' >&2; exit 1; }
           git checkout --detach "$commit"
-          printf 'commit=%s\ntag=%s\nrunner=%s\n' "$commit" "$tag" "$MACOS_RUNNER" >> "$GITHUB_OUTPUT"
+          printf 'commit=%s\ntag=%s\n' "$commit" "$tag" >> "$GITHUB_OUTPUT"
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -81,7 +80,8 @@ jobs:
   release:
     name: Sign, notarize, verify and publish macOS
     needs: prepare
-    runs-on: ${{ needs.prepare.outputs.runner }}
+    # Gitea resolves runner labels before outputs from prepare are available.
+    runs-on: ${{ vars.MACOS_RUNNER }}
     timeout-minutes: 120
     env:
       RELEASE_TAG: ${{ needs.prepare.outputs.tag }}

native/package.json

@@ -1,6 +1,6 @@
 {
     "name": "kanbangit-native",
-    "version": "0.1.0",
+    "version": "0.1.1",
     "private": true,
     "type": "module",
     "scripts": {

native/publish-macos.mjs

@@ -10,6 +10,7 @@ import {
 import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import process from 'node:process';
+import { setTimeout } from 'node:timers/promises';
 import { pathToFileURL } from 'node:url';
 import { execute, releaseMetadata } from './macos-ci.mjs';
 
@@ -62,6 +63,7 @@ export async function publishMacos({
     metadata,
     run = execute,
     fetchPublic = fetch,
+    wait = setTimeout,
 } = {}) {
     const storage = storageConfiguration(env);
     if (!env.AWS_ACCESS_KEY_ID || !env.AWS_SECRET_ACCESS_KEY) {
@@ -94,7 +96,26 @@ export async function publishMacos({
             ...args,
         ]);
     }
-    const versioning = JSON.parse(s3('get-bucket-versioning', []));
+    const versioningOutput = s3('get-bucket-versioning', [
+        '--output',
+        'json',
+    ]).trim();
+    let versioning;
+    try {
+        // AWS CLI prints nothing for a successful empty VersioningConfiguration.
+        versioning = JSON.parse(versioningOutput || '{}');
+    } catch {
+        throw new Error('Invalid JSON from S3 bucket versioning check.');
+    }
+    if (
+        !versioning ||
+        typeof versioning !== 'object' ||
+        Array.isArray(versioning)
+    ) {
+        throw new Error(
+            'Invalid S3 bucket versioning response: expected an object.',
+        );
+    }
     if (versioning.Status) {
         throw new Error(
             'Use an unversioned release bucket: Hetzner does not support conditional writes on versioned buckets.',
@@ -104,16 +125,43 @@ export async function publishMacos({
     const keyPrefix = `${storage.prefix}/${metadata.target}/${metadata.version}`;
     const publicPrefix = `${storage.publicBase}/${keyPrefix}`;
     async function verifyPublic(name, contents) {
-        const response = await fetchPublic(`${publicPrefix}/${name}`, {
-            redirect: 'error',
-            signal: AbortSignal.timeout(60000),
-        });
-        if (
-            !response.ok ||
-            sha256(Buffer.from(await response.arrayBuffer())) !==
-                sha256(contents)
-        ) {
-            throw new Error(`Public download verification failed for ${name}.`);
+        for (let attempt = 1; attempt <= 5; attempt++) {
+            let response;
+            try {
+                response = await fetchPublic(`${publicPrefix}/${name}`, {
+                    redirect: 'error',
+                    signal: AbortSignal.timeout(60000),
+                });
+            } catch (error) {
+                if (attempt === 5) {
+                    throw new Error(
+                        `Public download request failed for ${name}: ${error.message}`,
+                    );
+                }
+                await wait(2000);
+                continue;
+            }
+            if (response.ok) {
+                if (
+                    sha256(Buffer.from(await response.arrayBuffer())) !==
+                    sha256(contents)
+                ) {
+                    throw new Error(
+                        `Public download verification failed for ${name}: SHA-256 mismatch.`,
+                    );
+                }
+                return;
+            }
+            await response.body?.cancel();
+            const retryable = [403, 404, 408, 429, 500, 502, 503, 504].includes(
+                response.status,
+            );
+            if (!retryable || attempt === 5) {
+                throw new Error(
+                    `Public download verification failed for ${name}: HTTP ${response.status}.`,
+                );
+            }
+            await wait(2000);
         }
     }
     function putImmutable(name, contents, contentType) {

native/src-tauri/Cargo.lock

@@ -1673,7 +1673,7 @@ dependencies = [
 
 [[package]]
 name = "kanbangit-native"
-version = "0.1.0"
+version = "0.1.1"
 dependencies = [
  "serde_json",
  "tauri",

native/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "kanbangit-native"
-version = "0.1.0"
+version = "0.1.1"
 description = "KanbanGit native application"
 edition = "2021"
 publish = false

native/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
     "$schema": "https://schema.tauri.app/config/2",
     "productName": "KanbanGit",
-    "version": "0.1.0",
+    "version": "0.1.1",
     "identifier": "de.kanbangit.desktop",
     "build": {
         "frontendDist": "../ui"

native/tests/macos-workflow.test.js

@@ -86,13 +86,22 @@ test('release selection succeeds using Git alone without an administrative API t
         GITHUB_API_URL: 'http://127.0.0.1:1',
     });
     assert.equal(result.status, 0, result.stderr);
-    assert.equal(
-        result.output,
-        `commit=${f.commit}\ntag=macos-v1.2.3\nrunner=macos-local\n`,
-    );
+    assert.equal(result.output, `commit=${f.commit}\ntag=macos-v1.2.3\n`);
     assert.equal(f.git(f.checkout, 'rev-parse', 'HEAD'), f.commit);
 });
 
+test('macOS scheduling uses a repository variable while release steps remain gated by preparation', () => {
+    const release = workflow.split('\n  release:\n')[1];
+    const runner = release.match(/^ {4}runs-on: (.+)$/m)?.[1];
+    assert.equal(runner, '${{ vars.MACOS_RUNNER }}');
+    assert.match(release, /^ {4}needs: prepare$/m);
+    assert.match(release, /ref: \$\{\{ needs\.prepare\.outputs\.commit \}\}/);
+    assert.match(
+        release,
+        /RELEASE_TAG: \$\{\{ needs\.prepare\.outputs\.tag \}\}/,
+    );
+});
+
 test('manual release on main accepts an existing tag without moving it', (t) => {
     const f = fixture(t);
     const result = f.run({

native/tests/publish-macos.test.js

@@ -38,7 +38,8 @@ function fixture(t) {
         const key = value('--key');
         events.push({ operation, key });
         if (operation === 'get-bucket-versioning') {
-            return '{}';
+            assert.equal(value('--output'), 'json');
+            return '';
         }
         if (operation === 'put-object') {
             assert.equal(value('--if-none-match'), '*');
@@ -69,7 +70,16 @@ function fixture(t) {
             arrayBuffer: async () => objects.get(key),
         };
     };
-    return { directory, metadata, env, objects, events, run, fetchPublic };
+    return {
+        directory,
+        metadata,
+        env,
+        objects,
+        events,
+        run,
+        fetchPublic,
+        wait: async () => {},
+    };
 }
 
 test('uploads immutable files and writes completion record after public verification', async (t) => {
@@ -103,6 +113,33 @@ test('uploads immutable files and writes completion record after public verifica
     });
 });
 
+for (const response of ['', ' \n\t', '{}']) {
+    test(`unversioned bucket response ${JSON.stringify(response)} permits a verified upload`, async (t) => {
+        const f = fixture(t);
+        const run = f.run;
+        f.run = (command, args) => {
+            const result = run(command, args);
+            return args.includes('get-bucket-versioning') ? response : result;
+        };
+        await publishMacos(f);
+        assert.equal(f.objects.size, 3);
+        assert.equal(f.events.at(-1).operation, 'public-get');
+        assert(f.events.at(-1).key.endsWith('/release.json'));
+    });
+}
+
+for (const response of ['{', 'null', '[]', '"Enabled"', 'false']) {
+    test(`invalid versioning response ${response} aborts before any upload`, async (t) => {
+        const f = fixture(t);
+        f.run = (_command, args) => {
+            assert(args.includes('get-bucket-versioning'));
+            return response;
+        };
+        await assert.rejects(publishMacos(f), /Invalid .*versioning/);
+        assert.equal(f.objects.size, 0);
+    });
+}
+
 test('retry accepts byte-identical objects without replacing them', async (t) => {
     const f = fixture(t);
     await publishMacos(f);
@@ -166,6 +203,7 @@ for (const failure of ['private', 'wrong-content', 'network']) {
             }
             return {
                 ok: failure !== 'private',
+                status: failure === 'private' ? 403 : 200,
                 arrayBuffer: async () => Buffer.from('wrong'),
             };
         };
@@ -195,6 +233,77 @@ test('a partial upload can resume with the same files', async (t) => {
     assert.equal(f.objects.size, 3);
 });
 
+for (const status of [403, 404, 408, 429, 500, 502, 503, 504, 'network']) {
+    test(`temporary public download failure ${status} recovers before completion`, async (t) => {
+        const f = fixture(t);
+        const fetchPublic = f.fetchPublic;
+        let attempts = 0;
+        let cancelled = 0;
+        const waits = [];
+        f.wait = async (ms) => waits.push(ms);
+        f.fetchPublic = async (...args) => {
+            if (++attempts <= 2) {
+                if (status === 'network') {
+                    throw new Error('temporary network failure');
+                }
+                return {
+                    ok: false,
+                    status,
+                    body: { cancel: async () => cancelled++ },
+                };
+            }
+            return fetchPublic(...args);
+        };
+        await publishMacos(f);
+        assert.deepEqual(waits, [2000, 2000]);
+        assert.equal(cancelled, status === 'network' ? 0 : 2);
+        assert.equal(f.objects.size, 3);
+        assert(f.events.at(-1).key.endsWith('/release.json'));
+    });
+}
+
+test('persistent public access denial stops after five attempts with HTTP status', async (t) => {
+    const f = fixture(t);
+    let attempts = 0;
+    const waits = [];
+    f.wait = async (ms) => waits.push(ms);
+    f.fetchPublic = async () => {
+        attempts++;
+        return { ok: false, status: 403 };
+    };
+    await assert.rejects(publishMacos(f), /HTTP 403/);
+    assert.equal(attempts, 5);
+    assert.equal(waits.length, 4);
+    assert.equal(f.objects.size, 1);
+});
+
+test('incorrect public bytes fail immediately without retry or completion record', async (t) => {
+    const f = fixture(t);
+    f.wait = async () => assert.fail('Do not retry mismatched content');
+    f.fetchPublic = async () => ({
+        ok: true,
+        arrayBuffer: async () => Buffer.from('incorrect'),
+    });
+    await assert.rejects(publishMacos(f), /SHA-256 mismatch/);
+    assert.equal(f.objects.size, 1);
+});
+
+test('checksum access retries finish before publishing the completion record', async (t) => {
+    const f = fixture(t);
+    const fetchPublic = f.fetchPublic;
+    let failures = 0;
+    f.fetchPublic = async (url, options) => {
+        if (url.endsWith('.sha256') && ++failures <= 2) {
+            assert.equal(f.objects.size, 2);
+            return { ok: false, status: 403 };
+        }
+        return fetchPublic(url, options);
+    };
+    await publishMacos(f);
+    assert.equal(failures, 3);
+    assert.equal(f.objects.size, 3);
+});
+
 for (const overrides of [
     { S3_REGION: '' },
     { S3_REGION: 'eu-central-1' },