ci: harden installer canary and add pre-merge Bash 3.2 gate - #575
Conversation
Canary (installer-smoke.yml): - Trigger on scripts/install.ps1 pushes too — the raw URL serves main, so merge == deploy for the PowerShell installer as well. - New Windows job running the documented irm | iex shape under both Windows PowerShell 5.1 and pwsh 7 (matrix), against scratch USERPROFILE/BASECAMP_BIN_DIR under RUNNER_TEMP. - New notify job: on any leg's failure, file or update an "Installer canary failure" issue (exact-title dedupe, best-effort gh calls, ::error:: annotation). Skipped entirely on green runs. Pre-merge (test.yml): new installer-bash32 job on macos-latest — plain steps, not bats (bats 1.11 execs `env bash` at every layer, so the interpreter is not pinnable through it). Asserts /bin/bash is exactly 3.2, syntax-checks install.sh, and runs it piped with curl off PATH, asserting the guard's clean failure message and the absence of unbound-variable errors (the #558 regression class). Path-filtered to installer files plus test.yml itself so the job proves itself on the PR that introduces or edits it; skipped filters still report success, so the job is safe to mark required. Refs #558 #568 #569
This reverts commit 37cf5f7.
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
There was a problem hiding this comment.
Pull request overview
This PR hardens the post-deploy installer canary by adding Windows coverage plus failure alerting, and adds a pre-merge “real Bash 3.2” CI gate to prevent scripts/install.sh regressions that only reproduce under macOS’s stock /bin/bash.
Changes:
- Add
installer-bash32job to PR CI to runinstall.shunder macOS/bin/bash(3.2) with syntax-checking and a piped execution regression assertion. - Expand the installer smoke canary triggers to include
scripts/install.ps1and add a Windows matrix job exercising the documentedirm | iexinstall shape in both Windows PowerShell 5.1 and PowerShell 7. - Add a notify-on-failure job that files or updates a deduped “Installer canary failure” issue with per-leg results.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/test.yml | Adds a PR-only macOS Bash 3.2 gate to catch installer regressions in the documented curl … | bash path. |
| .github/workflows/installer-smoke.yml | Extends the post-deploy installer canary with Windows coverage, path triggers for install.ps1, and failure alerting via a deduped GitHub issue. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dc68c3db5a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
The piped-execution step stops at the curl prerequisite, and `bash -n` only checks grammar — neither catches Bash-4-only constructs in the download, checksum, extract, or post-install code. Add a step that runs one complete install path under real /bin/bash 3.2 using a fixture curl serving a local release (stub binary, real sha256 checksums) with PATH restricted to fixture + system dirs, then asserts the installed stub runs. Review feedback on #575.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1d390d7d95
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
dorny/paths-filter enumerates changed PR files via the REST API and documents a pull-requests: read requirement; the job-level permissions block zeroes everything unlisted. Review feedback on #575.
Follow-on to the #558/#568 installer incident and the #569 canary: the canary had no Windows coverage, no alerting, and pre-merge CI had no real Bash 3.2 coverage.
Canary (installer-smoke.yml)
scripts/install.ps1— the raw URL serves main, so merge == deploy for the PowerShell installer too.irm | iexshape under both Windows PowerShell 5.1 (the stock interpreter, exercising install.ps1's 5.1-specific branches) and pwsh 7, in a fail-fast-off matrix. Fetch and execution both happen inside the matrix interpreter (GitHub Actions doesn't evaluate expressions insteps[*].shell, so a pwsh launcher invokes it explicitly). Writes are contained under a scratchUSERPROFILE/BASECAMP_BIN_DIRinRUNNER_TEMP;?sha=cache-busts the raw URL (it varies its cache key on unknown query params). No basecamp.com endpoint exists for install.ps1, so the raw URL is the documented shape.ghcalls,::error::annotation — same idiom as release.yml's skills-sync alert). Skipped entirely on green runs.Pre-merge (test.yml):
installer-bash32Plain steps on
macos-latest, not bats — bats 1.11execsenv bashat every layer, so the interpreter isn't pinnable through it. Asserts/bin/bashis exactly 3.2, syntax-checks install.sh, then runs it piped with curl off PATH and asserts the guard's clean failure message with no unbound-variable errors (the #558 regression class). Path-filtered toscripts/install.sh,e2e/installer.bats, and test.yml itself, so the job proves itself on this PR. Skipped filters still report job success, so it's safe to mark as a required check later (branch-protection change, out of repo).Verification
Branch dispatches run the branch's workflow file against the published main installer — that validates the Windows matrix and notify mechanics, which is the correct scope for a post-deploy canary (PR-head script changes are covered pre-merge by bats + the new 3.2 gate, and post-merge by the push-triggered canary).
bin/cigreen (actionlint + zizmor included).The workflow-level
BASECAMP_NO_KEYRINGstays in place for now: the published v0.7.2 binary probes the keyring eagerly on startup and would hang the macOS leg without it. The follow-up PR (lazy store construction + installer belts) removes it.Refs #558 #568 #569
Summary by cubic
Hardens the installer canary with Windows coverage and alerting, and adds a pre-merge Bash 3.2 gate with a full offline install to catch regressions early.
New Features
scripts/install.ps1.pwsh7) running the documentedirm | iex, with isolated HOME/bin and?sha=cache-busting.installer-bash32(PRs only, path-filtered) onmacos-latest./bin/bashis 3.2,bash -noninstall.sh, piped run fails cleanly withoutcurl(no unbound vars).curland local release + checksums; assert expected output and that the installed stub runs.Bug Fixes
pull-requests: readsodorny/paths-filtercan enumerate changed files.Written for commit 2421186. Summary will update on new commits.