Skip to content

Commit 5dc0e36

Browse files
daniel-g-carrascodaniel-g-carrasco
authored
ci: auto-track the baked GNOME-extension pins (close the stale-pin gap) (#142)
* ci: auto-track the baked GNOME-extension pins (close the stale-pin gap) o-tiling sat at v2.8.8 through upstream's 2.8.11 GNOME-50 toggle fix (oliwebd/o-tiling#15) because NOTHING watched its pin: Renovate only had a customManager for WSF_VERSION, and check-upstream-pins.yml only watched the Titanoboa fork. The image auto-updates, but sha-pinned extensions don't track upstream on their own — so a fix can rot in the pin indefinitely. Close the gap for all three baked extensions: - o-tiling (GitHub releases): Renovate customManager on OTILING_VERSION + companion otiling-pin-sha.yml that recomputes OTILING_SHA256 on the Renovate branch (same proven pattern as WSF). Renovate opens the bump PR; a human merges; smoke-boot gates it before :stable. - hide-cursor + smile (EGO-hosted, no Renovate datasource for version_tag): a weekly EGO-API check in check-upstream-pins.yml opens an issue when a newer GNOME-50 upload exists. Extension bumps stay human-reviewed + smoke-gated on purpose (upstream itself can ship regressions — see the search-light saga), but they can no longer sit unnoticed. * ci: align o-tiling customManager to migrated Renovate syntax (managerFilePatterns)
1 parent b7cdfd9 commit 5dc0e36

3 files changed

Lines changed: 117 additions & 4 deletions

File tree

‎.github/renovate.json5‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,5 +48,19 @@
4848
datasourceTemplate: 'github-releases',
4949
extractVersionTemplate: '^v(?<version>.+)$',
5050
},
51+
{
52+
// o-tiling (default tiler) is a sha256-pinned GitHub release. Renovate
53+
// proposes the OTILING_VERSION bump; the companion workflow
54+
// .github/workflows/otiling-pin-sha.yml recomputes OTILING_SHA256 on
55+
// the Renovate branch (hosted Renovate can't hash a release zip).
56+
// Added 2026-06-14 after o-tiling sat at 2.8.8 through the 2.8.11
57+
// GNOME-50 toggle-reentrancy fix (oliwebd/o-tiling#15) — nothing was
58+
// watching this pin.
59+
customType: 'regex',
60+
managerFilePatterns: ['/build_files/build-margine-extensions\\.sh$/'],
61+
matchStrings: ['OTILING_VERSION="(?<currentValue>v\\d+\\.\\d+\\.\\d+)"'],
62+
depNameTemplate: 'oliwebd/o-tiling',
63+
datasourceTemplate: 'github-releases',
64+
},
5165
],
5266
}

‎.github/workflows/check-upstream-pins.yml‎

Lines changed: 45 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,11 @@
1-
# Watch the upstream PRs our forked Titanoboa pin carries. When one
2-
# merges, open (once) an issue reminding us to advance/revert
3-
# TITANOBOA_REF — today that lives only in human memory, which is how
4-
# pins rot. Weekly is plenty; upstream review moves slowly.
1+
# Watch the upstream PRs our forked Titanoboa pin carries AND the
2+
# EGO-hosted GNOME-extension version_tag pins (hide-cursor, smile) that
3+
# Renovate has no datasource for. When a Titanoboa PR merges, or an EGO
4+
# extension has a newer GNOME-50 upload, open (once) an issue — otherwise
5+
# these pins rot in human memory (o-tiling sat at 2.8.8 right through the
6+
# 2.8.11 GNOME-50 toggle fix that way). Weekly is plenty.
7+
# NB: o-tiling itself IS Renovate-tracked now — see renovate.json5 +
8+
# otiling-pin-sha.yml — so it is intentionally NOT re-checked here.
59
name: Check upstream pins
610

711
on:
@@ -64,3 +68,40 @@ jobs:
6468
printf "%b" "$BODY" | gh issue create --repo "${{ github.repository }}" \
6569
--title "$TITLE" --body-file - --label "upstream"
6670
echo "Issue opened."
71+
72+
- name: Check EGO-hosted extension pins (hide-cursor, smile)
73+
# Renovate tracks the GitHub-released o-tiling pin; the EGO-hosted
74+
# extensions are pinned by version_tag, which Renovate has no
75+
# datasource for. Query the EGO API weekly and open an issue when a
76+
# newer GNOME-50 upload exists, so a fix can't sit unnoticed.
77+
run: |
78+
set -euo pipefail
79+
f=build_files/build-margine-extensions.sh
80+
behind=""
81+
check() {
82+
local uuid="$1" pinvar="$2" name="$3"
83+
local pinned info url tag ver
84+
pinned="$(grep -oP "^${pinvar}=\"\K[0-9]+" "$f" || true)"
85+
[ -n "$pinned" ] || { echo "::warning::could not read ${pinvar}"; return; }
86+
info="$(curl -fsSL "https://extensions.gnome.org/extension-info/?uuid=${uuid}&shell_version=50" 2>/dev/null || true)"
87+
[ -n "$info" ] || { echo "::warning::EGO query failed for ${uuid}"; return; }
88+
url="$(printf '%s' "$info" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("download_url",""))' 2>/dev/null || true)"
89+
tag="$(printf '%s' "$url" | grep -oP 'version_tag=\K[0-9]+' || true)"
90+
ver="$(printf '%s' "$info" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("version",""))' 2>/dev/null || true)"
91+
echo "${name}: pinned version_tag=${pinned}, EGO latest=${tag:-?} (v${ver:-?})"
92+
if [ -n "$tag" ] && [ "$tag" != "$pinned" ]; then
93+
behind="${behind}\n- **${name}** (\`${uuid}\`): pinned version_tag \`${pinned}\` → EGO latest \`${tag}\` (v${ver}) for GNOME 50"
94+
fi
95+
}
96+
check "hide-cursor@elcste.com" "HIDECURSOR_VERSION_TAG" "Hide Cursor"
97+
check "smile-extension@mijorus.it" "SMILE_EXT_VERSION_TAG" "Smile extension"
98+
[ -n "$behind" ] || { echo "EGO pins up to date."; exit 0; }
99+
100+
TITLE="EGO extension pin(s) behind upstream — bump version_tag + sha256"
101+
EXISTING=$(gh issue list --repo "${{ github.repository }}" \
102+
--search "in:title \"$TITLE\"" --state open --json number --jq '.[0].number // empty')
103+
[ -z "$EXISTING" ] || { echo "Issue #$EXISTING already open — not duplicating."; exit 0; }
104+
BODY="A newer EGO upload exists for one or more baked extensions (Renovate can't track EGO version_tags, so this weekly check does):\n${behind}\n\nTo update each: set the new \`version_tag\` in \`build_files/build-margine-extensions.sh\`, fetch \`https://extensions.gnome.org/download-extension/<uuid>.shell-extension.zip?version_tag=<tag>\`, recompute its \`sha256\`, bump the SHA pin, and PR. smoke-boot gates it before :stable."
105+
printf "%b" "$BODY" | gh issue create --repo "${{ github.repository }}" \
106+
--title "$TITLE" --body-file - --label "upstream"
107+
echo "Issue opened."

‎.github/workflows/otiling-pin-sha.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: Fix o-tiling sha pin
2+
3+
# Companion to the Renovate custom manager (see .github/renovate.json5).
4+
# Renovate bumps OTILING_VERSION in build_files/build-margine-extensions.sh
5+
# from upstream GitHub releases, but hosted Renovate cannot hash the release
6+
# zip — so OTILING_SHA256 the build verifies would go stale and the build
7+
# would fail its `sha256sum -c`. This recomputes OTILING_SHA256 on the
8+
# Renovate branch right after the version bump, so the PR is mergeable as-is.
9+
#
10+
# Same pattern as wsf-pin-sha.yml. Runs only on Renovate branches that touch
11+
# build-margine-extensions.sh. The commit uses GITHUB_TOKEN (which by design
12+
# does not re-trigger workflows), so there is no loop.
13+
14+
on:
15+
push:
16+
branches:
17+
- "renovate/**"
18+
paths:
19+
- "build_files/build-margine-extensions.sh"
20+
21+
permissions:
22+
contents: write
23+
24+
concurrency:
25+
group: otiling-pin-sha-${{ github.ref }}
26+
cancel-in-progress: true
27+
28+
jobs:
29+
fix-sha:
30+
runs-on: ubuntu-latest
31+
timeout-minutes: 10
32+
steps:
33+
- name: Check out the Renovate branch
34+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
35+
with:
36+
ref: ${{ github.ref_name }}
37+
38+
- name: Recompute OTILING_SHA256 to match OTILING_VERSION
39+
run: |
40+
set -euo pipefail
41+
f=build_files/build-margine-extensions.sh
42+
ver="$(grep -oP '^OTILING_VERSION="\K[^"]+' "$f")"
43+
cur="$(grep -oP '^OTILING_SHA256="\K[0-9a-f]+' "$f")"
44+
[ -n "$ver" ] || { echo "::error::could not read OTILING_VERSION"; exit 1; }
45+
url="https://github.com/oliwebd/o-tiling/releases/download/${ver}/o-tiling@oliwebd.github.qkg1.top-${ver}.zip"
46+
echo "Hashing $url"
47+
new="$(curl -fsSL --retry 3 "$url" | sha256sum | cut -d' ' -f1)"
48+
[ -n "$new" ] || { echo "::error::failed to hash o-tiling zip"; exit 1; }
49+
if [ "$new" = "$cur" ]; then
50+
echo "OTILING_SHA256 already correct for ${ver} — nothing to do."
51+
exit 0
52+
fi
53+
sed -i "s/^OTILING_SHA256=.*/OTILING_SHA256=\"${new}\"/" "$f"
54+
git config user.name "github-actions[bot]"
55+
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
56+
git commit -am "o-tiling: sync OTILING_SHA256 for ${ver}"
57+
git push
58+
echo "Updated OTILING_SHA256 -> ${new} for ${ver}"

0 commit comments

Comments
 (0)