hermes-admin/hermes-agent
1
0
Fork 0
Code Issues Pull Requests Actions 28 Packages Projects Releases Wiki Activity

feat(release): gate stable promotion through the full release pipeline

Browse Source 
Run the entire CI workflow before Docker build and tests. Require Nix,
native payload smoke tests, install/update E2E and signed-package upgrade
acceptance before publishing. Keep Desktop Playwright E2E deferred.

Archive tested Docker images and signed bundle candidates with provenance
and hashes. Publishers consume those exact artifacts without rebuilding.
Advance stable channels only after all required publications succeed.
Keep canaries on their separate path and reject direct stable-builder
publication that bypasses the gate.

Move shared release transport, manifests and gates to Python. Keep native
Electron adapters in JS and share feed/MIME facts as JSON. Replace the
R2/feed JS implementation and move its protocol tests to Python.

Verified targeted Python and JS tests, real loopback transport and CLI
execution, temporary Git admission, workflow graph lint, and typechecks.
No live stable release was run. Native signing, package upgrades and real
registry/Store promotion still need their release-run receipts. Separate
services cannot promote atomically. A promotion failure keeps the run red.
This commit is contained in:
ethernet
2026-09-07 14:40:10 -04:00
parent 6edee205bd
commit b0ab0162b0
58 changed files with 5099 additions and 1584 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
tests-js/bundle-inputs.test.mjs
View File

@@ -64,7 +64,9 @@ test('staging streams actual bytes, verifies hashes and removes rejected partial
manifest[slot].artifact.sha256 = createHash('sha256').update(bytes[slot]).digest('hex')
}
const out = path.join(directory, 'good')
const filename = await stageBundleInputs({ manifestUrl: `${base}/manifest.json`, platform: 'windows', arch: 'x64', out })
const manifestSha256 = createHash('sha256').update(JSON.stringify(manifest)).digest('hex')
await expect(stageBundleInputs({ manifestUrl: `${base}/manifest.json`, platform: 'windows', arch: 'x64', out, manifestSha256: '0'.repeat(64) })).rejects.toThrow('manifest SHA-256')
const filename = await stageBundleInputs({ manifestUrl: `${base}/manifest.json`, platform: 'windows', arch: 'x64', out, manifestSha256 })
const result = JSON.parse(await readFile(filename, 'utf8'))
for (const slot of ['old', 'new']) expect(await readFile(result[slot].artifact.path)).toEqual(bytes[slot])
manifest.old.artifact.sha256 = 'c'.repeat(64)