openvibers/openvibe.link Commits

Verify the release carries the installer asset OpenVibe.Bot serves (#20)

OP OpenVibers committed 3 Oct 2026 · dcdd95387f · 3 files, +12 −0

checks run by GitHub CI (vet, test) · CI ✓ 9/9 · review SHIP by Codex GPT-6 Sol · 1 fix round

https://github.com/OpenVibers/OpenVibe.Node/pull/20

Changes

ddiff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
iindex 1afae82..13c0a39 100644
---- a/.github/workflows/ci.yml
++++ b/.github/workflows/ci.yml
@@@ -40,6 +40,8 @@ jobs:
          with:
            go-version-file: go.mod
        - run: scripts/dist.sh ci
++      # OpenVibe.Bot's /install route and BOT_INSTALLER_SOURCE_URL are documented to serve this exact release asset.
++      - run: test -s dist/install.sh && cmp -s install/install.sh dist/install.sh
        - run: ls -l dist && cat dist/SHA256SUMS
  
    go-other-os:
ddiff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
iindex ccb4014..509fd2f 100644
---- a/.github/workflows/release.yml
++++ b/.github/workflows/release.yml
@@@ -23,6 +23,14 @@ jobs:
        - run: |
            for p in sdk dryrun adeept_adr036 cozmo; do python -m pytest -q plugins/$p/tests; done
        - run: scripts/dist.sh "${GITHUB_REF_NAME}"
++      # Every release must carry the installer OpenVibe.Bot's GET /install route and BOT_INSTALLER_SOURCE_URL are
++      # documented to serve (releases/latest/download/install.sh), the plugin bundle the installer downloads, and the
++      # checksums it verifies them against.
++      - name: the release carries the assets the installer and OpenVibe.Bot depend on
++        run: |
++          test -s dist/install.sh
++          test -s dist/openvibe-node-plugins.tar.gz
++          test -s dist/SHA256SUMS
        - name: publish the release
          env:
            GH_TOKEN: ${{ github.token }}
ddiff --git a/scripts/dist.sh b/scripts/dist.sh
iindex bf8f254..a190ceb 100755
---- a/scripts/dist.sh
++++ b/scripts/dist.sh
@@@ -25,6 +25,8 @@ done
  tar -czf dist/openvibe-node-plugins.tar.gz -C plugins \
  	--exclude=tests --exclude=__pycache__ --exclude='*.egg-info' --exclude=.pytest_cache --exclude=build \
  	sdk dryrun adeept_adr036 cozmo
++# OpenVibe.Bot's GET /install route and BOT_INSTALLER_SOURCE_URL are documented to serve this asset name:
++# https://github.com/OpenVibers/OpenVibe.Node/releases/latest/download/install.sh — do not rename it.
  cp install/install.sh dist/install.sh
  (cd dist && if command -v sha256sum >/dev/null 2>&1; then sha256sum -- * >SHA256SUMS; else shasum -a 256 -- * >SHA256SUMS; fi)
  echo "dist/ ready for $VERSION"