KAN-65: Fix Hetzner feed ETags and resume published releases #161

Merged

Twyco merged 2 commits from fix/KAN-65-hetzner-feed-etag into main 2026-09-28 05:27:37 +00:00

Conversation 0 Commits 2 Files Changed 5

+341 -14

Twyco commented 2026-09-28 05:24:34 +00:00

Owner

Copy Link

Copy Source

The 0.1.4 release uploaded all immutable artifacts but failed to replace latest.json. A real Hetzner test confirmed that GetObject returns a quoted ETag while conditional PutObject requires its bare value: passing the quotes returns PreconditionFailed, which AWS CLI hides behind a NoneType formatting error.

Normalize and validate the ETag before the conditional write. Wildcards, weak/malformed tags and missing values remain rejected; stale writers still fail. Add an opt-in integration test that creates a unique object in a configured test bucket, reproduces the quoted failure, verifies a successful replacement through the production normalization function, rejects a stale replacement, and removes the test object.

Add the manual workflow mode resume and node native/publish-macos.mjs resume to finish a release using its already uploaded artifacts. The resume job uses current publishing tools from the workflow commit, metadata from the validated release tag, and the existing CI release credentials. It skips rebuilding and importing Apple signing credentials. It downloads the exact version's DMG, updater, checksums and signature, then reuses the existing signature, checksum, immutable-content and feed-concurrency checks. RELEASE_TAG and storage/signing identity settings must match the configured version as for upload. No new build or version bump is required for the existing 0.1.4 artifacts.

Validation: 157 JavaScript tests initially passed; after adding the workflow mode, all 79 affected publisher/workflow tests passed; the opt-in Hetzner integration test passed separately against the existing development bucket. ESLint and diff checks passed. Public 0.1.4 DMG checksum and updater checksum/signature verified before attempting recovery.

Recovery status: public 0.1.4 artifacts are complete and verified. A local recovery attempt stopped at GetBucketVersioning before any writes because the local application credentials lack the required release-bucket permissions. After merge, manually dispatch macOS release to Hetzner on main, tag macos-v0.1.4, mode resume. The production feed has not yet been changed by this fix.

Base and PR target: main, pulled before branch creation at dc9f400f34ba41f208acf7588a52487264aa6599.

The 0.1.4 release uploaded all immutable artifacts but failed to replace latest.json. A real Hetzner test confirmed that GetObject returns a quoted ETag while conditional PutObject requires its bare value: passing the quotes returns PreconditionFailed, which AWS CLI hides behind a NoneType formatting error. Normalize and validate the ETag before the conditional write. Wildcards, weak/malformed tags and missing values remain rejected; stale writers still fail. Add an opt-in integration test that creates a unique object in a configured test bucket, reproduces the quoted failure, verifies a successful replacement through the production normalization function, rejects a stale replacement, and removes the test object. Add the manual workflow mode **resume** and `node native/publish-macos.mjs resume` to finish a release using its already uploaded artifacts. The resume job uses current publishing tools from the workflow commit, metadata from the validated release tag, and the existing CI release credentials. It skips rebuilding and importing Apple signing credentials. It downloads the exact version's DMG, updater, checksums and signature, then reuses the existing signature, checksum, immutable-content and feed-concurrency checks. RELEASE_TAG and storage/signing identity settings must match the configured version as for upload. No new build or version bump is required for the existing 0.1.4 artifacts. Validation: 157 JavaScript tests initially passed; after adding the workflow mode, all 79 affected publisher/workflow tests passed; the opt-in Hetzner integration test passed separately against the existing development bucket. ESLint and diff checks passed. Public 0.1.4 DMG checksum and updater checksum/signature verified before attempting recovery. Recovery status: public 0.1.4 artifacts are complete and verified. A local recovery attempt stopped at GetBucketVersioning before any writes because the local application credentials lack the required release-bucket permissions. After merge, manually dispatch **macOS release to Hetzner** on **main**, tag **macos-v0.1.4**, mode **resume**. The production feed has not yet been changed by this fix. Base and PR target: main, pulled before branch creation at `dc9f400f34ba41f208acf7588a52487264aa6599`.

Twyco added 1 commit 2026-09-28 05:24:35 +00:00

fix(KAN-65): normalize Hetzner conditional write ETags 40b66bf7ce

Twyco added 1 commit 2026-09-28 05:27:08 +00:00

fix(KAN-65): resume release publication with CI credentials 9dbb491dc9

Twyco merged commit 3d5ee223e8 into main 2026-09-28 05:27:37 +00:00

Twyco deleted branch fix/KAN-65-hetzner-feed-etag 2026-09-28 05:27:37 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

Eric Twyco flux-image-automation (Flux Image Automation)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: PetschStudios/KanbanGit#161