Repository navigation
chore(packaging): sync v0.3.0 release manifests - #534
Conversation
Auto-generated by .github/workflows/release.yml after publishing v0.3.0. Pulls SHA256SUMS.txt from the release and rewrites cask / scoop / winget / flatpak manifests to match. [skip ci]
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Findings
- [Minor] Public Scoop and winget install channels stay behind while the repo moves to 0.3.0 — in-repo manifests now advertise 0.3.0 (
packaging/scoop/bucket/open-codesign.json:2,packaging/winget/manifests/o/OpenCoworkAI/OpenCoDesign/0.3.0/OpenCoworkAI.OpenCoDesign.installer.yaml:3), but the liveOpenCoworkAI/scoop-bucketmanifest is still0.2.0(hashes9d126967…/2e7e3688…, which matchv0.2.0SHA256SUMS.txt) andmicrosoft/winget-pkgsonly carries the 0.2.0 submission referenced inpackaging/README.md. Both of those buckets are self-consistent, so there is no checksum-failure risk, but users following the documented install commands get an older build thanmainclaims. The PR body already notes the skipped submissions, so this is a follow-up gap rather than a defect in the diff.
Suggested fix / next action: after merge, push the generated manifest to the bucket directly (cp packaging/scoop/bucket/open-codesign.json /tmp/scoop-bucket/bucket/ && commit "open-codesign 0.3.0" && push), and either submit 0.3.0 to winget once microsoft/winget-pkgs#372310 is accepted or add a note inpackaging/README.mdthat in-repo winget manifests can lead the published package. WireSCOOP_BUCKET_TOKENso the next release does not need a manual backfill.
Questions
- The review context only includes the v0.2.0
SHA256SUMS.txt; the v0.3.0 checksum file is not in the public checkout. Can you confirm the four new values (56385717…/894aa01c…dmg,3dd2d00d…/13e7bef2…zip,B74399CF…/3FC99BEC…setup.exe) were read from the published v0.3.0SHA256SUMS.txt, and that the Flatpaksize: 119293739was taken from the actual AppImage? packaging/winget/manifests/o/OpenCoworkAI/OpenCoDesign/0.3.0/OpenCoworkAI.OpenCoDesign.installer.yaml:8setsReleaseDate: 2026-10-31.packaging/update-shas.shfalls back todate -u +%F(the run date) when the GitHub releases API lookup fails. Was the release published on that date, or is this the fallback?
Summary
Review mode: initial
The in-repo changes are internally consistent and match the published-channel state where it can be checked: the Homebrew cask in this PR is byte-identical to the live OpenCoworkAI/homebrew-tap cask (version 0.3.0, 56385717… / 894aa01c…), the Scoop manifest keeps both zip architectures with the autoupdate block intact, and the new winget version directory follows the existing 0.2.0 layout (nullsoft, Scope: user, ManifestVersion: 1.12.0, ReleaseDate present). The Flatpak template was updated only in the extra-data source, which matches its documented manual-submission flow.
Residual risk: the v0.3.0 artifact checksums and AppImage size could not be verified in this run because the v0.3.0 SHA256SUMS.txt is not part of the provided context (only v0.2.0 is). Treat the manifest hashes as unverified until someone runs sha256sum -c SHA256SUMS.txt against the downloaded v0.3.0 assets. The Scoop/winget channel drift above is acknowledged in the PR description and does not block merging, but it should be tracked so the two public channels do not fall further behind.
No dependency, license, or packages/ui token concerns — this diff is packaging metadata only.
Testing
Not run (automation). Suggested manual validation before or right after merge:
# verify every manifest hash against the real release assets
mkdir -p /tmp/v030 && cd /tmp/v030
gh release download v0.3.0 -R OpenCoworkAI/open-codesign
sha256sum -c SHA256SUMS.txt
ls -l open-codesign-0.3.0-x64.AppImage # compare to flatpak `size`
# winget schema validation
wingetcreate validate packaging/winget/manifests/o/OpenCoworkAI/OpenCoDesign/0.3.0Open-CoDesign Bot
…ion (#542) Release manifest synchronization pushes a `[skip ci]` commit to protected main, then silently succeeds when the fallback PR cannot be created. Intel verification targets the retired macos-13 runner and does not gate publishing. - Generate a dedicated manifest PR without skipping CI or pushing main. Use a lease when refreshing its branch, reuse an open PR, and fail on credential, PR creation, or auto-merge errors. - Require RELEASE_BOT_TOKEN instead of GITHUB_TOKEN so PR events trigger required checks. Document minimum permissions and recovery of existing skipped-CI PRs. - Move native Intel packaging to macos-15-intel, verify runner architecture, run it on related PRs, and reuse it as a publication gate. Suppress the additional DMG artifact during release calls. - Add local-Git integration tests with mocked gh calls to CI, covering no-op, missing credentials, creation, reruns and denied PR creation. Validation: actionlint 1.7.12 on all three changed workflows; bash syntax; local and CI manifest integration tests; git diff --check. Cloud CI (lint/typecheck/tests/Electron build), Linux packaging smoke, CodeQL, Dependency Review and automated PR review passed for 79dc6ab. Native Intel validation also passed on attempt 2 (3m37s): https://github.com/OpenCoworkAI/open-codesign/actions/runs/41869077136/job/126721621301 . Verified x86_64 runner architecture, x64 DMG packaging, packaged app architecture, native application smoke test, and artifact upload. Attempt 1 failed because no hosted runner acquired the job; it executed no steps. Rerunning the failed job passed without code changes. All 8 current PR checks pass for 79dc6ab. Maintainer setup: configure repository secret RELEASE_BOT_TOKEN using a repository-scoped fine-grained PAT with Contents and Pull requests read/write, with organization approval if required. Keep required checks and auto-merge enabled; no protection bypass is needed. No settings or secrets were changed. Actual release publication and token-backed manifest PR creation are not exercised by this PR. Leaves #541 and #534 untouched. Co-authored-by: Sun-sunshine06 <Sun-sunshine06@users.noreply.github.com>
There was a problem hiding this comment.
Findings
No new findings. The PR's net diff against main is still the same six packaging manifest files; the compare diff since the last review only contains unrelated repository changes already on main. The prior Minor observation (external Scoop/winget channels lagging at 0.2.0) is unchanged and already acknowledged in the PR body, so it remains a follow-up item rather than a defect in this diff.
Summary
Review mode: follow-up after new commits
The manifests remain internally consistent, and the one public-channel check available in this context passes: the Homebrew cask is byte-identical to the live OpenCoworkAI/homebrew-tap cask (packaging/homebrew/Casks/open-codesign.rb:2, :7, :12). The Scoop manifest keeps both Windows zip architectures and the autoupdate block (packaging/scoop/bucket/open-codesign.json:2, :7, :11). The new winget 0.3.0 directory follows the accepted 0.2.0 layout (nullsoft, Scope: user, UpgradeBehavior: install, ReleaseDate, ManifestVersion: 1.12.0) and lists separate x64/arm64 installers (packaging/winget/manifests/o/OpenCoworkAI/OpenCoDesign/0.3.0/OpenCoworkAI.OpenCoDesign.installer.yaml:3). The Flatpak template updates only the extra-data AppImage source, matching its documented manual-submission flow (packaging/flatpak/ai.opencowork.codesign.yaml:38).
Residual risk:
- The v0.3.0
SHA256SUMS.txtis not in the provided public context (only v0.2.0 is), so the dmg/zip/setup.exe hashes and the Flatpaksize: 119293739could not be independently confirmed in this run. The cask hashes do match the live tap, which is generated from the same release, but the Windows and Flatpak values should still be checked withsha256sum -c. ReleaseDate: 2026-10-31remains unverified against the actual publish timestamp. The previous review's checksum/date questions were not answered in the thread.- The public
OpenCoworkAI/scoop-bucketis still at 0.2.0 and the winget package is still the 0.2.0 submission; the PR body says both submissions were skipped. This is a known follow-up, not a blocker for this metadata sync.
No dependency, license, or UI-token concerns — this diff is packaging metadata only.
Testing
Not run (automation). Suggested verification:
mkdir -p /tmp/v030 && cd /tmp/v030
gh release download v0.3.0 -R OpenCoworkAI/open-codesign
sha256sum -c SHA256SUMS.txt
stat -c '%s' open-codesign-0.3.0-x64.AppImage # compare to Flatpak sizecd /path/to/open-codesign
wingetcreate validate packaging/winget/manifests/o/OpenCoworkAI/OpenCoDesign/0.3.0Open-CoDesign Bot
Sync Homebrew, Scoop, winget and Flatpak packaging metadata to the published v0.3.0 release. Generated by successful release run 41182966001 and updated against main to run current required checks.
Validation: compared manifest SHA-256 values against the published v0.3.0 SHA256SUMS.txt and GitHub release asset digest metadata; checked asset names, AppImage size and release date (2026-10-31). No application code changes.
External distribution status: the release workflow reports the Homebrew tap update succeeded. Scoop and winget submissions were skipped because the workflow lacked the required token access. The external Scoop bucket still reports 0.2.0; the existing winget submission #372310 is for 0.2.0. Merging this PR updates repository manifests, but does not publish those external channel updates.