diff --git a/.github/workflows/repair-updater34-acceptance.yml b/.github/workflows/repair-updater34-acceptance.yml deleted file mode 100644 index 0b3ca36..0000000 --- a/.github/workflows/repair-updater34-acceptance.yml +++ /dev/null @@ -1,137 +0,0 @@ -name: Repair Updater 3.4 Acceptance Contract - -on: - push: - branches: - - feature/updater-3.4-lifecycle - -permissions: - contents: write - -concurrency: - group: repair-updater-34-acceptance - cancel-in-progress: true - -jobs: - repair: - if: ${{ github.actor != 'github-actions[bot]' }} - runs-on: ubuntu-latest - timeout-minutes: 10 - steps: - - uses: actions/checkout@v6 - with: - ref: feature/updater-3.4-lifecycle - fetch-depth: 0 - - - uses: actions/setup-node@v4 - with: - node-version: '22.x' - - - name: CI-Vertrag robust aktualisieren - shell: python - run: | - from pathlib import Path - - ci = Path('.github/workflows/ci.yml') - lines = ci.read_text(encoding='utf-8').splitlines() - output = [] - i = 0 - parser_done = False - zip_done = False - - while i < len(lines): - line = lines[i] - if line == ' - name: Alle PowerShell-Dateien mit Windows PowerShell 5.1 parsen': - if i + 2 >= len(lines) or lines[i + 1].strip() != 'shell: powershell': - raise SystemExit('Windows-Parserblock besitzt nicht den erwarteten Vertrag.') - output.extend([ - ' - name: Alle PowerShell-Dateien mit Windows PowerShell 5.1 parsen', - ' shell: powershell', - ' run: .\\tools\\verify-powershell-parser.ps1 -ReportPath "$env:RUNNER_TEMP\\powershell-parser-diagnostics.txt"', - '', - ' - name: Parserdiagnose bei Fehler sichern', - ' if: failure()', - ' uses: actions/upload-artifact@v4', - ' with:', - ' name: powershell-parser-diagnostics-${{ github.event.pull_request.head.sha || github.sha }}', - ' path: ${{ runner.temp }}/powershell-parser-diagnostics.txt', - ' if-no-files-found: error', - ' retention-days: 14', - ]) - i += 3 - parser_done = True - continue - - if ( - line == ' (' - and i + 5 < len(lines) - and 'zip -qr "${release_name}.zip"' in lines[i + 2] - and lines[i + 5] == ' )' - ): - output.extend([ - ' archive="release-output/${release_name}.zip"', - ' python tools/build-deterministic-zip.py "$package_dir" "$archive"', - ' first_hash="$(sha256sum "$archive" | awk \'{print $1}\')"', - ' python tools/build-deterministic-zip.py "$package_dir" "$archive"', - ' second_hash="$(sha256sum "$archive" | awk \'{print $1}\')"', - ' if [[ "$first_hash" != "$second_hash" ]]; then', - ' echo "Der ZIP-Build ist nicht byte-reproduzierbar." >&2', - ' exit 1', - ' fi', - ' python -m zipfile -t "$archive"', - ' (', - ' cd release-output', - ' sha256sum "${release_name}.zip" > "${release_name}.zip.sha256"', - ' sha256sum --check "${release_name}.zip.sha256"', - ' )', - ]) - i += 6 - zip_done = True - continue - - output.append(line) - i += 1 - - if not parser_done: - raise SystemExit('Windows-Parserblock wurde nicht ersetzt.') - if not zip_done: - raise SystemExit('Standard-ZIP-Block wurde nicht ersetzt.') - ci.write_text('\n'.join(output) + '\n', encoding='utf-8', newline='\n') - - verifier = Path('tools/verify-updater-ci-lifecycle-3.4.mjs') - text = verifier.read_text(encoding='utf-8') - anchor = "assert(ci.includes('actions/upload-artifact@v4'), 'Das geprüfte Paket wird nicht als CI-Artefakt bereitgestellt.');" - additions = """ - assert(ci.includes('powershell-parser-diagnostics'), 'Windows-Parserfehler werden nicht als Diagnoseartefakt gesichert.'); - assert(ci.includes('tools/build-deterministic-zip.py'), 'Paketjob verwendet keinen deterministischen ZIP-Build.'); - assert(ci.includes('first_hash') && ci.includes('second_hash'), 'Paketjob weist die Byte-Reproduzierbarkeit des ZIPs nicht nach.'); - assert(!ci.includes('zip -qr'), 'Paketjob verwendet weiterhin den zeitstempelabhängigen Standard-ZIP-Build.'); - const deterministicZip = read('tools/build-deterministic-zip.py'); - assert(deterministicZip.includes('FIXED_TIMESTAMP = (1980, 1, 1, 0, 0, 0)'), 'Deterministischer ZIP-Build besitzt keinen fixierten Zeitstempel.'); - assert(deterministicZip.includes('sorted(source.rglob'), 'Deterministischer ZIP-Build sortiert die Payload nicht.');""" - if 'powershell-parser-diagnostics' not in text: - if text.count(anchor) != 1: - raise SystemExit(f'CI-Gate-Anker nicht eindeutig gefunden: {text.count(anchor)}') - verifier.write_text(text.replace(anchor, anchor + additions), encoding='utf-8', newline='\n') - - - name: Temporäre Dateien entfernen und Manifest erzeugen - shell: bash - run: | - set -euo pipefail - rm -f \ - logs/updater34-acceptance-ci-trigger.txt \ - logs/updater34-final-acceptance-trigger.txt \ - .github/workflows/patch-updater34-deterministic-package.yml \ - .github/workflows/repair-updater34-acceptance.yml - node tools/generate-release-manifest.mjs . - git diff --check - - - name: Bereinigten Vertrag committen - shell: bash - run: | - set -euo pipefail - git config user.name 'vendoo-updater-build' - git config user.email 'vendoo-updater-build@users.noreply.github.com' - git add --all - git commit -m 'ci: harden updater 3.4 acceptance diagnostics' - git push origin HEAD:feature/updater-3.4-lifecycle