fix(release): restore release binaries — immutable-release draft flow + portable BSD sed#641
Merged
Merged
Conversation
…D sed
v0.2.0 shipped SOURCE-ONLY (regression from v0.1.1). Two bugs in the release
workflow, both confirmed from the failed v0.2.0 run (26694097435):
1. Immutable releases. `prepare` created a *published* release, then the build
matrix uploaded assets to it. The repo enabled immutable releases between
v0.1.1 (immutable:false) and v0.2.0 (immutable:true); immutable *published*
releases reject asset uploads — the linux leg died with "HTTP 422: Cannot
upload assets to an immutable release". Fix: create the release as a DRAFT,
upload all binaries + SHA256SUMS into the draft, then publish (--draft=false)
last so it seals atomically with all four assets.
2. BSD sed. The version-bake step (added in v0.2.0) used `sed -i "s/..."`, which
BSD sed on the macOS runners rejects ("extra characters at the end of l
command") — so macos-x64 and macos-arm64 failed before building. Fix:
`sed -i.bak ...` (portable across GNU + BSD) and remove the backups.
Verified locally: the compiler builds in release mode (ELF x86-64); `--version`
and `check` work; the bake substitutions match lib/version.ml + .build/dune-project.
v0.2.0 is immutable and cannot be amended, so the binaries are published via a
fresh v0.2.1 tag built with this fixed workflow. Refs ADR-019, #260 S2.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Lz7pRcec2Z3tVtaAhvB3M8
🔍 Hypatia Security ScanFindings: 41 issues detected
View findings[
{
"reason": "Action denoland/setup-deno@v2 needs attention",
"type": "unpinned_action",
"file": "publish-jsr.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in instant-sync.yml",
"type": "secret_action_without_presence_gate",
"file": "instant-sync.yml",
"action": "peter-evans/repository-dispatch",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
"type": "js_exec_sync",
"file": "/home/runner/work/affinescript/affinescript/packages/affinescript-cli/mod.js",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "Shell execution -- validate input before passing to shell (2 occurrences, CWE-78)",
"type": "js_exec_sync",
"file": "/home/runner/work/affinescript/affinescript/packages/affine-vscode/mod.js",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
"type": "js_exec_sync",
"file": "/home/runner/work/affinescript/affinescript/affinescript-vite/src/affine-plugin-improved.js",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "expect() in hot path (32 occurrences, CWE-754)",
"type": "expect_in_hot_path",
"file": "/home/runner/work/affinescript/affinescript/affinescriptiser/src/codegen/wasm_gen.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "medium"
},
{
"reason": "expect() in hot path (29 occurrences, CWE-754)",
"type": "expect_in_hot_path",
"file": "/home/runner/work/affinescript/affinescript/affinescriptiser/src/codegen/affine_gen.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "medium"
},
{
"reason": "unsafe block -- requires SAFETY comment (2 occurrences, CWE-676)",
"type": "unsafe_block",
"file": "/home/runner/work/affinescript/affinescript/runtime/src/panic.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "medium"
},
{
"reason": "unsafe block -- requires SAFETY comment (1 occurrences, CWE-676)",
"type": "unsafe_block",
"file": "/home/runner/work/affinescript/affinescript/runtime/src/alloc.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "medium"
},
{
"reason": "unsafe block -- requires SAFETY comment (3 occurrences, CWE-676)",
"type": "unsafe_block",
"file": "/home/runner/work/affinescript/affinescript/runtime/src/ffi.rs",
"action": "flag",
"rule_module": "code_safety",
"severity": "medium"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
This was referenced Jun 21, 2026
hyperpolymath
added a commit
that referenced
this pull request
Jun 21, 2026
…E.a2ml refresh (#649) The three quick wind-down items from the close-out triage. The larger docs consolidation (unifying the two learning tracks, wiki-sync audit) stays tracked in **#647**. ## 1. `docs/tutorial/lesson-01-hello.adoc` (new) The `docs/tutorial/` track started at **lesson-02** — the intro lived only under `docs/guides/`, so a reader opening the tutorial began at lesson 2. Adds a concise, self-contained first lesson with a lessons 1–10 map and the `check`/`eval`/`compile` workflow. The hello-world is **verified against the built compiler**: `fn main() -> Int { println(…); return 0; }` passes `check`, prints under `eval`, and `compile`s to WASM. (Note: the *bare* top-level `println(…)` form shown in `docs/guides/lessons/01-hello-affinescript.adoc` is a **parse error** on the current compiler — folded into #647 rather than fixed here.) ## 2. README + NAVIGATION — "Start here — by audience" A top-level router so each audience has a clear entry point: - **New users** → tutorial → runnable warm-ups → language reference - **Developers** → repository map → `wiki/compiler/architecture` → ADRs → capability matrix - **Maintainers** → `MAINTAINERS` → contributing → ops playbook → soundness ledger (Also adds a `SOUNDNESS.adoc` back-link in `NAVIGATION.adoc`.) ## 3. `.machine_readable/6a2/STATE.a2ml` Adds a `2026-06-21` session note (release fix #641, the already-landed #602 ctor fix, filed gaps #642–#644/#646/#647) and bumps `last-updated`. It was self-flagged stale; it still **mirrors** the authoritative docs, it does not lead. ## Verification All three doc guards pass locally: `check-doc-truthing`, `check-soundness-ledger`, `check-capability-anchors`. No over-claim phrases introduced; no compiler/code changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Lz7pRcec2Z3tVtaAhvB3M8 --- _Generated by [Claude Code](https://claude.ai/code/session_01Lz7pRcec2Z3tVtaAhvB3M8)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
v0.2.0shipped source-only (regression fromv0.1.1, which hadaffinescript-linux-x64,affinescript-macos-x64,affinescript-macos-arm64,SHA256SUMS). Downstream consumers on locked-down networks rely on the prebuilt binary (building from source needs opam + ~15 packages, blocked whenopam.ocaml.org403s), and thev0.1.1binary can't parsev0.2.0-only syntax — e.g. quandledb'squandle_gui.affine→Parse error(quandledb PR #60 had to pinv0.1.1).Root cause — two bugs, both confirmed from the failed v0.2.0 run (26694097435)
preparecreated a published release, then the build matrix uploaded assets to it. The repo enabled immutable releases betweenv0.1.1(immutable:false) andv0.2.0(immutable:true); immutable published releases reject asset uploads — the linux leg died with:sed -i "s/…", which BSD sed on the macOS runners rejects (sed: 1: "lib/version.ml": extra characters at the end of l command) — somacos-x64andmacos-arm64failed before building anything.Fix (
.github/workflows/release.ymlonly)--draft(mutable), let the build legs upload binaries into it, andgh release edit --draft=false --latestlast in the checksums job — so it seals atomically with all four assets attached, compatible with immutable releases.sed -i.bak …(accepted by both GNU and BSD sed) + remove the backups.Verification
dune build --release→ ELF x86-64);--versionandcheck <file>work.lib/version.ml(let value = "0.2.1") and.build/dune-project((version 0.2.1)).Publishing
v0.2.0is immutable and cannot be amended, so binaries are published via a freshv0.2.1tag built with this fixed workflow (per the task: "otherwise cut v0.2.1"). This PR lands the same fix onmainfor all future releases.Refs ADR-019, #260 S2.
🤖 Generated with Claude Code
https://claude.ai/code/session_01Lz7pRcec2Z3tVtaAhvB3M8
Generated by Claude Code