Fix manifest field extraction and add artifact retention - #121
Merged
Conversation
Bundle native runtime into compiler pack and require exactly one compiler and one toolchain per host in release manifest schema 2. Replace 24-job component release with six host-local pipelines that each fetch their immutable toolchain once, build compiler and runtime, package one host pack, and verify fresh installation before upload. Collapse sign, checksum, and draft publication into one protected finalization job and remove SBOM and provenance attestation. Add POSIX and PowerShell bootstrap installers that detect the platform, verify the native installer against SHA256SUMS, run it, and persist user PATH idempotently. Remove completed lock-path migration from the toolchain planner without changing fingerprints.
Component downloads now run concurrently so total install time tracks the largest pack instead of the sum, with one aggregate throttled progress line on stderr. Progress counts bytes on the write side of the copy so streamed data is reported accurately. README drops compiler pipeline and repository layout sections and the stale no-binary-release note.
The installer binary download is large enough to need feedback; curl now uses a stderr progress bar and PowerShell keeps its default progress for that step only. The tiny SHA256SUMS fetch stays silent.
Bootstrap scripts now perform the full installation: download the release manifest, verify it against SHA256SUMS, read pack URLs and SHA-256 digests for the detected host, download compiler and toolchain packs, verify every digest, extract into staging on the destination filesystem, and activate atomically. Removes cmd/peeper-installer and internal/installer, dropping six installer builds and assets per release; release assets drop to 11. Manifest signing stays for out-of-band audit.
component_field now strips the field prefix and quotes robustly instead of fragile substring arithmetic that left a leading quote on extracted URLs. Release workflow artifacts get retention-days: 1 since they are only needed within the run, and draft release notes no longer mention installers.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation