chore: publish v2.26.2 from verified merge 12aba20 #134
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # One-shot orchestration; never merged into master. Publish the pinned source | |
| # through the existing publish.yml trusted-publisher identity. | |
| name: Publish v2.26.2 from merged PR 84 | |
| on: | |
| push: | |
| branches: [codex/release-v2.26.2] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: release-react-native-update-cli-v2.26.2 | |
| cancel-in-progress: false | |
| env: | |
| RELEASE_VERSION: '2.26.2' | |
| RELEASE_TAG: v2.26.2 | |
| RELEASE_SHA: 12aba209ebf5c3d693d231273fdbf5edddcefa74 | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| actions: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: 12aba209ebf5c3d693d231273fdbf5edddcefa74 | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Verify source, completed CI, and available version | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| test "$(git rev-parse HEAD)" = "$RELEASE_SHA" | |
| test "$(git rev-parse HEAD^{tree})" = e81c0fe58e2755de06b45f6e91ad8ec744608711 | |
| test "$(git rev-parse v2.26.1^{commit})" = 88b2e66743033c38657b0aa97ab4c3acda6bd3c2 | |
| gh api "repos/$GITHUB_REPOSITORY/actions/runs/34700013898" > "$RUNNER_TEMP/ci.json" | |
| jq -e --arg sha "$RELEASE_SHA" '.head_sha == $sha and .status == "completed" and .conclusion == "success"' "$RUNNER_TEMP/ci.json" | |
| curl --fail --silent --show-error --retry 3 https://registry.npmjs.org/react-native-update-cli/latest > "$RUNNER_TEMP/npm-before.json" | |
| jq -e '.name == "react-native-update-cli" and .version == "2.26.1"' "$RUNNER_TEMP/npm-before.json" | |
| status=$(curl --silent --show-error --retry 3 -o "$RUNNER_TEMP/npm-candidate.json" -w '%{http_code}' "https://registry.npmjs.org/react-native-update-cli/$RELEASE_VERSION") | |
| test "$status" = 404 | |
| if git rev-parse --verify "refs/tags/$RELEASE_TAG" >/dev/null 2>&1; then | |
| echo 'Tag exists; refusing to overwrite it' >&2 | |
| exit 1 | |
| fi | |
| - uses: oven-sh/setup-bun@v2 | |
| - run: bun install --frozen-lockfile | |
| - name: Prepare publish version | |
| env: | |
| PUBLISH_VERSION: v2.26.2 | |
| run: bun scripts/prepublish.ts | |
| - name: Verify package version | |
| run: test "$(node -p "require('./package.json').version")" = "$RELEASE_VERSION" | |
| - name: Build package | |
| run: bun run build | |
| - name: Set up Node.js 18 for runtime verification | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: '18.17.0' | |
| - name: Verify built CLI with Node.js 18 | |
| run: | | |
| set -euo pipefail | |
| node --version | |
| node lib/bin.js -v | |
| node lib/bin-cresc.js -v | |
| node -e "const m = require('./lib/exports.js'); if (!m) process.exit(1)" | |
| node -e "const d = require('./lib/diff.js'); if (!d.diffCommands) process.exit(1)" | |
| timeout 10s node tests/fixtures/hermes-async-check.cjs '{"operation":"abort","modulePath":"./lib/utils/hermes-base.js"}' | |
| - name: Set up Node.js for npm publishing | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: '24.x' | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Verify publishable package contents | |
| run: npm pack --dry-run --ignore-scripts | |
| - name: Publish to npm using the existing trusted publisher | |
| run: npm publish --ignore-scripts --provenance --access public | |
| - name: Verify published version and latest dist-tag | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| for attempt in $(seq 1 12); do | |
| if curl --fail --silent --show-error "https://registry.npmjs.org/react-native-update-cli/$RELEASE_VERSION" -o "$RUNNER_TEMP/npm-published.json" && | |
| curl --fail --silent --show-error https://registry.npmjs.org/react-native-update-cli/latest -o "$RUNNER_TEMP/npm-latest.json" && | |
| jq -e --arg version "$RELEASE_VERSION" --arg sha "$RELEASE_SHA" '.version == $version and .gitHead == $sha and .dist.integrity != null' "$RUNNER_TEMP/npm-published.json" && | |
| jq -e --arg version "$RELEASE_VERSION" '.version == $version' "$RUNNER_TEMP/npm-latest.json"; then | |
| jq '{name,version,gitHead,dist:{integrity:.dist.integrity,tarball:.dist.tarball,attestations:.dist.attestations}}' "$RUNNER_TEMP/npm-published.json" | |
| exit 0 | |
| fi | |
| sleep 5 | |
| done | |
| echo 'Could not verify npm publication' >&2 | |
| exit 1 | |
| release: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| permissions: | |
| contents: write | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| steps: | |
| - name: Publish equivalent English and Chinese release notes | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| cat > "$RUNNER_TEMP/release-notes.md" <<'NOTES' | |
| ## English | |
| ### Fixes and improvements | |
| - Harden Hermes base verification with a second raw-operand audit backed by HBC bytes. Preserve quoted whitespace, full strings, function references, branch/switch destinations, exact double bits, literals and runtime metadata. Unverifiable output falls back to a plain compile. (#84) | |
| - Accept valid zero-length Static Hermes functions while retaining non-empty-function truncation checks. Close debug-output streams after timeout, cancellation or compiler startup failure to prevent hangs with `PUSHY_HERMES_BASE_DEBUG=1`. (#84) | |
| - Handle speculative source-map rejections immediately, reuse successful plain output after failed base compilation or verification, and add configurable subprocess deadlines. Normalize classic `SwitchImm` offsets while retaining real targets, and resolve the string operand of `ThrowIfHasRestrictedGlobalProperty`. (#84) | |
| - Add `https://1.rnupdate.online/api`, `https://2.rnupdate.online/api`, `https://3.rnupdate.online/api` and `https://4.rnupdate.online/api` before the existing Pushy default endpoints. Both previous endpoints remain as fallbacks; Cresc endpoints are unchanged. (a79e3db) | |
| ### Validation and compatibility | |
| - CI covers real HBC96/HBC98 compilers (`react-native@0.77.3`, `hermes-compiler@250829098.0.16` and `hermes-compiler@250829098.0.17`), pinned real Metro bundle self-comparison and base/plain comparison, seeded differential fuzzing, isolated asynchronous-error regressions, exhaustive UTF-16 spacing checks, and Node.js 18.17 debug-output cleanup. The merged release commit passed CI before publication. | |
| - No update-package format or server-protocol migration is required. `--hermesBase auto`, default verification and plain fallback remain available. Node.js 18.17 remains the minimum supported runtime. | |
| - Default deadlines: `PUSHY_HERMES_PROBE_TIMEOUT_MS=30000`, `PUSHY_HERMES_VERIFY_TIMEOUT_MS=120000`, `PUSHY_HERMES_COMPILE_TIMEOUT_MS=300000`. Verification covers both dump passes; the compile deadline also covers source-map composition. | |
| - The raw audit adds verification time and memory, but no third compile on the successful path. HBC98 function-header parsing is validated against the `250829098` compiler family; compatibility with every other internal HBC98 snapshot is not claimed. | |
| **Full changelog:** https://github.com/reactnativecn/react-native-update-cli/compare/v2.26.1...v2.26.2 | |
| ## 中文 | |
| ### 修复与改进 | |
| - 增强 Hermes base 校验，增加基于 HBC 二进制的原始操作数核对。保留引号内空白、完整字符串、函数引用、分支/switch 目的地、浮点数精确位值、字面量和运行时元数据。无法验证的产物回退到普通编译。 (#84) | |
| - 允许合法的零长度 Static Hermes 函数，同时继续检查非空函数是否被截断。超时、取消或编译器启动失败时结束调试输出流，避免 `PUSHY_HERMES_BASE_DEBUG=1` 下挂死。 (#84) | |
| - 立即处理预先启动的 source map 合成任务的拒绝；base 编译或校验失败时复用已成功的普通编译产物，并增加可配置的子进程期限。归一化经典 `SwitchImm` 偏移但仍核对真实目的地，补齐 `ThrowIfHasRestrictedGlobalProperty` 的字符串操作数解析。 (#84) | |
| - 在已有 Pushy 默认端点前新增 `https://1.rnupdate.online/api`、`https://2.rnupdate.online/api`、`https://3.rnupdate.online/api` 和 `https://4.rnupdate.online/api`。原有两个端点仍作为备用，Cresc 端点不变。 (a79e3db) | |
| ### 验证与兼容性 | |
| - CI 覆盖真实 HBC96/HBC98 编译器（`react-native@0.77.3`、`hermes-compiler@250829098.0.16` 和 `hermes-compiler@250829098.0.17`）、固定版本真实 Metro bundle 自比及 base/plain 比较、带种子的差分模糊测试、独立进程异步错误回归、完整 UTF-16 码元范围的空白处理检查，以及 Node.js 18.17 调试输出清理。合并后的发布提交已在发布前通过 CI。 | |
| - 无需迁移更新包格式或服务端协议。保留 `--hermesBase auto`、默认开启的校验和普通编译回退。最低支持运行时仍为 Node.js 18.17。 | |
| - 默认期限：`PUSHY_HERMES_PROBE_TIMEOUT_MS=30000`、`PUSHY_HERMES_VERIFY_TIMEOUT_MS=120000`、`PUSHY_HERMES_COMPILE_TIMEOUT_MS=300000`。校验期限涵盖两轮 dump，编译期限也用于 source map 合成。 | |
| - 原始操作数核对会增加验证耗时和内存，但不会在正常成功路径增加第三次编译。HBC98 函数头解析已在 `250829098` 编译器系列验证，不宣称兼容所有其他内部 HBC98 快照。 | |
| **完整变更：** https://github.com/reactnativecn/react-native-update-cli/compare/v2.26.1...v2.26.2 | |
| NOTES | |
| gh release create "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --target "$RELEASE_SHA" --title "$RELEASE_TAG" --notes-file "$RUNNER_TEMP/release-notes.md" --latest | |
| gh api "repos/$GITHUB_REPOSITORY/releases/tags/$RELEASE_TAG" > "$RUNNER_TEMP/release.json" | |
| jq -e --arg tag "$RELEASE_TAG" --arg sha "$RELEASE_SHA" '.tag_name == $tag and .target_commitish == $sha and .draft == false and .prerelease == false and (.body | contains("## English")) and (.body | contains("## 中文"))' "$RUNNER_TEMP/release.json" | |
| test "$(gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$RELEASE_TAG" --jq '.object.sha')" = "$RELEASE_SHA" | |
| jq '{html_url,tag_name,target_commitish,published_at,draft,prerelease}' "$RUNNER_TEMP/release.json" | |
| - name: Remove only the temporary release branch | |
| shell: bash | |
| run: gh api --method DELETE "repos/$GITHUB_REPOSITORY/git/refs/heads/codex/release-v2.26.2" |