[codex] Add GitHub release asset pipeline mode (#21)

* feat: add GitHub release asset pipeline mode

* test: simplify Azure e2e workflow

* fix: tighten Azure e2e pipeline behavior

* test: cover tar gz release assets

* docs: update agent plan follow-through [skip ci]

* fix: disable Azure PR validation trigger

Author: favoyang

.github/workflows/ci.yml

@@ -28,6 +28,9 @@ jobs:
       ${{
         github.event_name == 'pull_request' || startsWith(github.ref, 'refs/heads/')
       }}
+    env:
+      AZURE_DEVOPS_TOKEN_OPENUPM_PIPELINE: ${{ secrets.AZURE_DEVOPS_TOKEN_OPENUPM_PIPELINE }}
+      SOURCE_BRANCH: ${{ github.event_name == 'pull_request' && github.head_ref || github.ref_name }}
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v5
@@ -38,20 +41,30 @@ jobs:
       - name: npm ci
         run: npm ci
       - name: Check Azure PAT
-        env:
-          AZURE_DEVOPS_TOKEN_OPENUPM_PIPELINE: ${{ secrets.AZURE_DEVOPS_TOKEN_OPENUPM_PIPELINE }}
         run: |
           if [ -z "${AZURE_DEVOPS_TOKEN_OPENUPM_PIPELINE:-}" ]; then
-            echo "AZURE_DEVOPS_TOKEN_OPENUPM_PIPELINE is not configured; skipping Azure E2E."
-            exit 0
+            echo "AZURE_DEVOPS_TOKEN_OPENUPM_PIPELINE is required for Azure E2E."
+            exit 1
           fi
-      - name: Run Azure e2e fixture
+      - name: Run Azure git e2e fixture
+        run: |
+          node scripts/runAzureFixture.js \
+            --source-branch "$SOURCE_BRANCH" \
+            --repo-url "https://github.com/favoyang/com.example.nuget-consumer" \
+            --repo-branch "1.0.1" \
+            --package-name "com.example.nuget-consumer" \
+            --package-version "1.0.1" \
+            --package-source "git"
+      - name: Run Azure GitHub Release asset e2e fixture
         env:
-          AZURE_DEVOPS_TOKEN_OPENUPM_PIPELINE: ${{ secrets.AZURE_DEVOPS_TOKEN_OPENUPM_PIPELINE }}
-          SOURCE_BRANCH: ${{ github.event_name == 'pull_request' && github.head_ref || github.ref_name }}
+          ASSET_URL: https://raw.githubusercontent.com/${{ github.repository }}/${{ github.sha }}/test/fixtures/assets/com.example.release-asset-1.0.0.tgz
         run: |
-          if [ -z "${AZURE_DEVOPS_TOKEN_OPENUPM_PIPELINE:-}" ]; then
-            echo "AZURE_DEVOPS_TOKEN_OPENUPM_PIPELINE is not configured; skipping Azure E2E."
-            exit 0
-          fi
-          node scripts/runAzureFixture.js --source-branch "$SOURCE_BRANCH"
+          node scripts/runAzureFixture.js \
+            --source-branch "$SOURCE_BRANCH" \
+            --repo-url "https://github.com/${{ github.repository }}" \
+            --repo-branch "${{ github.sha }}" \
+            --package-name "com.example.release-asset" \
+            --package-version "1.0.0" \
+            --package-source "githubRelease" \
+            --package-asset-url "$ASSET_URL" \
+            --package-asset-name "com.example.release-asset-1.0.0.tgz"

AGENTS.md

@@ -32,6 +32,9 @@
 - Before committing, run `npm run format:check`.
 - Run `npm run typecheck` when type-related changes are made (JSDoc/tsconfig).
 - When changing `azure-pipelines.yml`, preserve end-to-end behavior for Git submodules, Git LFS fetches, and log visibility for clone/LFS failures because OpenUPM parses those logs.
+- When working from a plan, after finishing any item, always state the next
+  concrete step. Continue doing this until the plan is genuinely complete so
+  the user does not need to ask "what's next?".
 
 ## Pipeline Guardrails
 

README.md

@@ -29,14 +29,37 @@ Prepare an npm service connection:
 
 ## Build with REST API
 
-Required `parameters` payload:
+Required `parameters` payload for the default git source mode:
 
 ```json
 {
   "repoUrl": "https://...",
   "repoBranch": "master",
   "packageName": "com.yourcompany.package...",
   "packageVersion": "1.2.3",
+  "packageSource": "git",
+  "e2eTest": "false"
+}
+```
+
+`packageSource` is optional and defaults to `"git"`. In git mode the pipeline
+clones `repoUrl` at `repoBranch`, finds `packageName`, packs it, and publishes
+the generated tarball.
+
+For GitHub Release asset mode, OpenUPM queue resolves the release and asset
+before queueing Azure. The pipeline receives the exact public asset URL and
+filename, downloads that file without GitHub authentication, validates it, and
+publishes it unchanged:
+
+```json
+{
+  "repoUrl": "https://github.com/owner/repo",
+  "repoBranch": "v1.2.3",
+  "packageName": "com.yourcompany.package",
+  "packageVersion": "1.2.3",
+  "packageSource": "githubRelease",
+  "packageAssetUrl": "https://github.com/owner/repo/releases/download/v1.2.3/com.yourcompany.package-1.2.3.tgz",
+  "packageAssetName": "com.yourcompany.package-1.2.3.tgz",
   "e2eTest": "false"
 }
 ```
@@ -65,7 +88,7 @@ curl --verbose \
   "https://dev.azure.com/openupm/openupm/_apis/build/builds?api-version=5.1" \
   --json '{
     "definition": { "id": 1 },
-    "parameters": "{\"repoUrl\":\"https://...\",\"repoBranch\":\"master\",\"packageName\":\"com.yourcompany.package...\",\"packageVersion\":\"1.2.3\",\"e2eTest\":\"false\"}"
+    "parameters": "{\"repoUrl\":\"https://...\",\"repoBranch\":\"master\",\"packageName\":\"com.yourcompany.package...\",\"packageVersion\":\"1.2.3\",\"packageSource\":\"git\",\"e2eTest\":\"false\"}"
   }'
 ```
 
@@ -79,7 +102,7 @@ testing changes from a non-default branch of `openupm-pipelines`:
 {
   "definition": { "id": 1 },
   "sourceBranch": "refs/heads/your-branch-name",
-  "parameters": "{\"repoUrl\":\"https://...\",\"repoBranch\":\"master\",\"packageName\":\"com.yourcompany.package...\",\"packageVersion\":\"1.2.3\",\"e2eTest\":\"false\"}"
+  "parameters": "{\"repoUrl\":\"https://...\",\"repoBranch\":\"master\",\"packageName\":\"com.yourcompany.package...\",\"packageVersion\":\"1.2.3\",\"packageSource\":\"git\",\"e2eTest\":\"false\"}"
 }
 ```
 

azure-pipelines.yml

@@ -2,13 +2,17 @@
 name: $(Build.BuildId)
 
 trigger: none
+pr: none
 
 variables:
   ### context variables
   # repoUrl: https://github.com/owner/reponame
   # repoBranch: master
   # packageName: com.namespace.pkgname
   # packageVersion: semver
+  # packageSource: git|githubRelease
+  # packageAssetUrl: https://github.com/owner/repo/releases/download/tag/file.tgz
+  # packageAssetName: file.tgz
   # e2eTest: true|false
 
   ### pre-defined variables
@@ -43,12 +47,28 @@ stages:
               echo repoBranch: $REPOBRANCH
               echo packageName: $PACKAGENAME
               echo packageVersion: $PACKAGEVERSION
+              echo packageSource: ${PACKAGESOURCE:-git}
+              echo packageAssetName: ${PACKAGEASSETNAME:-}
               echo e2eTest: ${E2ETEST:-false}
-              [[ -z "$REPOURL" ]] && echo 'variable repoUrl not found' && exit 1
-              [[ -z "$REPOBRANCH" ]] && echo 'variable repoBranch not found' && exit 1
               [[ -z "$PACKAGENAME" ]] && echo 'variable packageName not found' && exit 1
               [[ -z "$PACKAGEVERSION" ]] && echo 'variable packageVersion not found' && exit 1
-              echo "##vso[build.updatebuildnumber]$(packageName)-$(packageVersion)-$(Build.BuildId)"
+              if [ "${PACKAGESOURCE:-git}" = "git" ]; then
+                [[ -z "$REPOURL" ]] && echo 'variable repoUrl not found' && exit 1
+                [[ -z "$REPOBRANCH" ]] && echo 'variable repoBranch not found' && exit 1
+              elif [ "${PACKAGESOURCE:-git}" = "githubRelease" ]; then
+                [[ -z "${PACKAGEASSETURL:-}" ]] && echo 'variable packageAssetUrl not found' && exit 1
+                [[ -z "${PACKAGEASSETNAME:-}" ]] && echo 'variable packageAssetName not found' && exit 1
+              else
+                echo "unsupported packageSource: ${PACKAGESOURCE:-}"
+                exit 1
+              fi
+              PACKAGE_SOURCE_MODE="${PACKAGESOURCE:-git}"
+              RUN_MODE="publish"
+              if [ "${E2ETEST:-false}" = "true" ]; then
+                RUN_MODE="e2e"
+              fi
+              echo "##vso[task.setvariable variable=packageSourceMode;]$PACKAGE_SOURCE_MODE"
+              echo "##vso[build.updatebuildnumber]$RUN_MODE-$PACKAGE_SOURCE_MODE-$(packageName)-$(packageVersion)-$(Build.BuildId)"
             displayName: "Prepare context variables"
 
           - script: |
@@ -83,6 +103,7 @@ stages:
               sudo apt-get install -y git git-lfs
               sudo git lfs install --system
             displayName: "Install Git tooling"
+            condition: eq(variables['packageSourceMode'], 'git')
 
           - script: |
               set -euo pipefail
@@ -103,6 +124,7 @@ stages:
             inputs:
               contents: $(repoDir)
             displayName: "Clean $(repoDir) folder"
+            condition: eq(variables['packageSourceMode'], 'git')
 
           - script: |
               set -euo pipefail
@@ -111,6 +133,7 @@ stages:
               git config --global url."https://github.com/".insteadOf git@github.com:
               git config --global url."https://".insteadOf git://
             displayName: "Prepare isolated Git config"
+            condition: eq(variables['packageSourceMode'], 'git')
             env:
               HOME: $(gitHomeDir)
               XDG_CONFIG_HOME: $(gitConfigDir)
@@ -124,6 +147,7 @@ stages:
                 clone --recursive --shallow-submodules --depth 1 --branch "$(repoBranch)" "$(repoUrl)" "$(repoDir)"
               git -C "$(repoDir)" config --local core.hooksPath /dev/null
             displayName: "Clone repository"
+            condition: eq(variables['packageSourceMode'], 'git')
             env:
               HOME: $(gitHomeDir)
               XDG_CONFIG_HOME: $(gitConfigDir)
@@ -134,6 +158,7 @@ stages:
               echo "Fetching Git LFS objects for $(repoDir)"
               git lfs pull
             displayName: "Fetch Git LFS"
+            condition: eq(variables['packageSourceMode'], 'git')
             env:
               HOME: $(gitHomeDir)
               XDG_CONFIG_HOME: $(gitConfigDir)
@@ -144,21 +169,33 @@ stages:
               echo "Fetching Git LFS objects for submodules in $(repoDir)"
               git submodule foreach --recursive 'git lfs pull'
             displayName: "Fetch submodule Git LFS"
+            condition: eq(variables['packageSourceMode'], 'git')
             env:
               HOME: $(gitHomeDir)
               XDG_CONFIG_HOME: $(gitConfigDir)
 
           - script: |
               set -euo pipefail
               echo "Computing dist-tag for $(packageName) against $(publishRegistryUrl)"
-              LATEST_VERSION=$(npm --registry="$(publishRegistryUrl)" show "$(packageName)" version) || LATEST_VERSION=0.0.0
+              NPM_SHOW_LOG="$(Agent.TempDirectory)/npm-show-version.log"
+              if npm --registry="$(publishRegistryUrl)" show "$(packageName)" version >"$NPM_SHOW_LOG" 2>&1; then
+                LATEST_VERSION=$(cat "$NPM_SHOW_LOG")
+              elif grep -Eq "(E404|404 Not Found)" "$NPM_SHOW_LOG"; then
+                cat "$NPM_SHOW_LOG"
+                LATEST_VERSION=0.0.0
+              else
+                cat "$NPM_SHOW_LOG"
+                echo "Failed to read package version from $(publishRegistryUrl)"
+                exit 1
+              fi
               [[ -z "$LATEST_VERSION" ]] && LATEST_VERSION=0.0.0
               echo LATEST_VERSION: $LATEST_VERSION
               echo packageVersion: $(packageVersion)
               DIST_TAG=$(node getDistTag.js "$(packageVersion)" "$LATEST_VERSION")
               echo DIST_TAG: $DIST_TAG
               echo "##vso[task.setvariable variable=distTag;]$DIST_TAG"
             displayName: "Set distTag variable"
+            condition: ne(variables['e2eTest'], 'true')
 
           - script: |
               set -euo pipefail
@@ -169,6 +206,7 @@ stages:
               echo "PACKAGEFOLDER: $PACKAGEFOLDER"
               echo "##vso[task.setvariable variable=packageFolder;]$PACKAGEFOLDER"
             displayName: "Detect package.json location"
+            condition: eq(variables['packageSourceMode'], 'git')
 
           - script: |
               set -euo pipefail
@@ -177,6 +215,7 @@ stages:
               npm pkg set publishConfig.registry="$(publishRegistryUrl)"
               cat package.json
             displayName: "Override publishConfig"
+            condition: eq(variables['packageSourceMode'], 'git')
 
           - script: |
               set -euo pipefail
@@ -199,6 +238,47 @@ stages:
                 "$ARTIFACT_DIR/metadata.json"
               cat "$ARTIFACT_DIR/metadata.json"
             displayName: "Pack package tarball"
+            condition: eq(variables['packageSourceMode'], 'git')
+
+          - script: |
+              set -euo pipefail
+              ARTIFACT_DIR="$(Build.ArtifactStagingDirectory)/$(artifactName)"
+              mkdir -p "$ARTIFACT_DIR"
+              TARBALL_FILE="$(basename "$(packageAssetName)")"
+              if [ "$TARBALL_FILE" != "$(packageAssetName)" ]; then
+                echo "packageAssetName must be a filename, not a path"
+                exit 1
+              fi
+              TARBALL_PATH="$ARTIFACT_DIR/$TARBALL_FILE"
+              TEMP_TARBALL_PATH="$TARBALL_PATH.download"
+              echo "Downloading GitHub Release asset: $(packageAssetName)"
+              HTTP_STATUS=$(curl --location --silent --show-error --write-out "%{http_code}" --output "$TEMP_TARBALL_PATH" "$(packageAssetUrl)") || {
+                echo "GITHUB_RELEASE_ASSET_DOWNLOAD_FAILED"
+                rm -f "$TEMP_TARBALL_PATH"
+                exit 1
+              }
+              if [ "$HTTP_STATUS" = "404" ]; then
+                echo "GITHUB_RELEASE_ASSET_DOWNLOAD_NOT_FOUND"
+                rm -f "$TEMP_TARBALL_PATH"
+                exit 1
+              fi
+              if ! [[ "$HTTP_STATUS" =~ ^2[0-9][0-9]$ ]]; then
+                echo "GITHUB_RELEASE_ASSET_DOWNLOAD_FAILED"
+                echo "HTTP status: $HTTP_STATUS"
+                rm -f "$TEMP_TARBALL_PATH"
+                exit 1
+              fi
+              mv "$TEMP_TARBALL_PATH" "$TARBALL_PATH"
+              echo "Validating downloaded asset extension, archive structure, package/package.json, name, and version"
+              node "$(Build.SourcesDirectory)/createPackageArtifactMetadataFromTarball.js" \
+                "$TARBALL_PATH" \
+                "$(packageName)" \
+                "$(packageVersion)" \
+                "$(distTag)" \
+                "$ARTIFACT_DIR/metadata.json"
+              cat "$ARTIFACT_DIR/metadata.json"
+            displayName: "Download GitHub Release asset"
+            condition: eq(variables['packageSourceMode'], 'githubRelease')
 
           - publish: $(Build.ArtifactStagingDirectory)/$(artifactName)
             artifact: $(artifactName)