Repository navigation
Release action: sign, upload and register each extension build (DUPLOAI-3770) - #27
Merged
aboutte merged 22 commits intoOct 7, 2026
Merged
Conversation
…the built commit, sdkDigest stamp, pinned builder, PR warnings (cherry picked from commit edcfe77)
…nd flag local-root verifications
…an existing release
…kup errors, and assert the unlisted-repo test actually signs
…uild's cleanup and test gaps
… flag non-semver versions and capture their own exit status
…act lookup, and fail an allowlisted extension with no CONSOLE_API_KEY before any write
duplodavid
requested changes
Oct 6, 2026
duplodavid
left a comment
duplodavid
left a comment
There was a problem hiding this comment.
Left three comments, all small. The one that matters is an existing .env with BUILDER_TAG=latest never taking the digest pin.
duplodavid
approved these changes
Oct 7, 2026
duplodavid
left a comment
duplodavid
left a comment
There was a problem hiding this comment.
Looks good. The three items are fixed. Left one comment on the file header, not blocking.
| # that cannot ship. | ||
| # | ||
| # For each extension the PR changes (anything under its directory since the merge base): | ||
| # - manifest.version is unchanged, so the release job will refuse to publish the new content at the old version. |
There was a problem hiding this comment.
An unchanged manifest.version does not by itself make the release job refuse the publish. It refuses when a release tag for that version already exists and the directory changed since that tag. Can you say that here?
Suggested change
| # - manifest.version is unchanged, so the release job will refuse to publish the new content at the old version. | |
| # - manifest.version is unchanged and already has a release tag, so the release job | |
| # refuses when the directory changed since that tag. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ticket: DUPLOAI-3770, part of DUPLOAI-3746. Design: ai-release
docs/plans/2026-10-05-extension-release-action-design.md.Each extension build is signed in Duplo's organizations and released to GitHub with its
.sig. Builds from allowlisted repositories are then uploaded create-only to the channels bucket and registered unpublished with the license server, all from the Release's own assets. A re-run of a finished build is a no-op. Customer copies skip signing, upload and registration.What is in it:
scripts/extension-sign.pyand theextension-signaction. They sign and verify against the console's format and are checked against the console's test vectors..github/extension-publishers.json, the publisher allowlist. It ships empty and gets its entries at rollout.scripts/release-extensions.shandscripts/_publish.sh. They cover the org and allowlist guards, the bundle checks, the digest check, the S3 create-only upload and the console registration.release.ymlruns only on main, with every action pinned by SHA and an OIDC role for the upload.check-extension-pr.shwarns at PR time about anything the release would refuse.docs/releasing-extensions.md.Test plan: every
tests/test-*.shpasses and actionlint is clean. An end-to-end run on the fixtures repository against the dev console follows at rollout.For the ruleset administrator: the design asks for 2 approvals on
.github/extension-publishers.json,.github/workflows/release.yml,scripts/release-extensions.sh,scripts/_publish.sh,scripts/_publishers.sh,scripts/extension-sign.pyandscripts/extension-sign.requirements.txt._publish.shdoes the upload and registration,_publishers.shreads the allowlist, and the requirements file pins the libraries the signer loads the key into. devkit'spull_requestrule takes path-scopedrequired_reviewers, anddevkit-maintainersis the only team. Whether that team's bypass should reach this rule is yours to settle.