CI: release-on-tag workflow — produce binary artifacts + publish to Forgejo package registry #6
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Context
hero_assistanceis the onlylhumina_coderepo without a CI workflow. We have three tagged releases (v0.1.0,v0.2.0,v0.3.0) but they're bare git tags with no attached binaries and no entry in the package registry. Every other hero crate (hero_books, hero_proc, hero_embedder, hero_osis, hero_os, hero_slides, …) ships a.forgejo/workflows/build-linux.yamlthat builds + publishes on tag push.Assessed in session 32 against:
znzfreezone_code/znzfreezone_deploy(different model — OCI containers, not binaries; not applicable here)lhumina_code/hero_books(canonical short pattern; closest analog to our setup)lhumina_code/hero_proc(self-contained variant; ~110 lines)lhumina_code/hero_embedder(cross-arch matrix variant)lhumina_code/hero_osis/hero_os/hero_slides(host-runner variant; package-registry-only)Recommendation — pattern (A):
build_lib.sh-based workflow modelled on hero_booksWe already have
scripts/build_lib.sh(78 KB — the standard hero helper substrate) andbuildenv.sh(declaresPROJECT_NAME=hero_assistance,BINARIES="hero_assistance_server hero_assistance_ui hero_assistance",VERSION=0.3.0). The canonical pattern just adds one workflow YAML on top.What lands
.forgejo/workflows/build-linux.yaml(~50 lines, modelled on hero_books):What it produces on the next tag push
https://forge.ourworld.tf/lhumina_code/hero_assistance/releases/tag/<tag>with the 3 binaries packaged as downloadable assets.https://forge.ourworld.tf/lhumina_code/-/packages/generic/hero_assistance/<version>(consumable viacurl-by-version for downstream automation).Prep / known gotchas
scripts/build_lib.shhelper functions need verification — confirmci_setup_toolchain,build_binaries,forge_config,publish_binaries,bin_dirall exist and handle our 3-binary workspace cleanly. The 78 KB size suggests standard hero helpers, but quickgrepfirst. Add stubs if any are missing.buildenv.shVERSION=0.3.0 is stale post-s31 git-filter-repo work — the workflow extracts the version from the tag name, not from buildenv.sh, so non-blocking. But buildenv.sh should track current tag for tooling consistency. Trivial bump in the same PR.hero_assistance_app(desktop binary) is NOT inBINARIES— intentional (GTK/webkit2gtk deps don't belong in server-deploy artifacts). Workflow won't build it. Document why somewhere visible if anyone wonders.workflow_dispatchmanually after the workflow lands. Otherwise: v0.2.0 stays bare; v0.2.1 (the next L-04+L-03 patch tag) becomes the first artifact-carrying tag. This is the suggested path.Why not the other patterns
hero_proc(~110 lines). Would only be worth it if we wanted to drop thebuild_lib.shdependency, which we don't.x86_64-musl+aarch64-gnulegs à lahero_embedder) — defer until we have an arm64 customer. Singlex86_64-unknown-linux-gnucovers current deploy targets.Acceptance criteria
.forgejo/workflows/build-linux.yamllands ondevelopment.scripts/build_lib.shexposesci_setup_toolchain,build_binaries,forge_config,publish_binaries,bin_dir(verify or add stubs).buildenv.shVERSION matches the latest tag (cosmetic but expected).v0.2.1(orv0.2.0-testfirst to validate the workflow without burning a real version) → workflow runs green →https://forge.ourworld.tf/lhumina_code/hero_assistance/releases/tag/v0.2.1shows binary assets →https://forge.ourworld.tf/lhumina_code/-/packages/generic/hero_assistance/0.2.1exists.test.yamlworkflow that runscargo test --no-fail-faston every push todevelopment(matcheshero_books/hero_proc/hero_embedderconvention). Out of scope for this issue if we want to keep it tight; can be a follow-up.Effort estimate
~30 min in a single session. No source-code changes; pure CI/scaffolding.
Notes
${{ secrets.FORGEJO_TOKEN }}(matches all hero crates' convention;hero_procaliases it as envTOKENbut that's the only outlier).dockerwithghcr.io/despiegk/builder:latest(provides Rust toolchain + musl-tools + buildah). Bare-metalruns-on: hostis the alternative used by hero_osis/hero_os/hero_slides; not preferred here since we already use containers everywhere else.forge-release-workflowClaude skill auto-detects toolchain + scaffolds this YAML in one shot — likely fastest path to the first PR.References
lhumina_code/hero_books/.forgejo/workflows/build-linux.yaml(canonical short pattern)lhumina_code/hero_proc/.forgejo/workflows/build-linux.yaml(self-contained variant)lhumina_code/hero_embedder/.forgejo/workflows/build-linux.yaml(cross-arch matrix)runs/phase16b_findings.md(informally; full reconnaissance in the s32 chat transcript not committed to this repo)Closed by v0.2.1 (
286ae22; session 32 bonus, Phase 21 prep).What landed
.forgejo/workflows/build-linux.yaml— release-on-tag CI per the canonicallhumina_codepattern (modelled onhero_books). Triggers onpush.tags: ['v*']+workflow_dispatch. Runs inghcr.io/despiegk/builder:latestcontainer,x86_64-unknown-linux-gnutarget.buildenv.shVERSION→0.2.1(was0.3.0, aspirational from s31's filter-repo work).scripts/build_lib.shURL fix:/api/crates/...→/api/packages/...(the upstream template carried Forgejo's Cargo Registry path; Generic uploads need/api/packages/). See debugging trail below.FORGEJO_TOKENsecret added to override the org-level secret which lackswrite:packagescope. See "Follow-up" below.What it produces
Verified working — package landed at
lhumina_code/-/packages/generic/hero_assistance/0.2.1:hero_assistance_server-linux-amd64b2612ca5135be34bhero_assistance_ui-linux-amd64417326199190ba79hero_assistance-linux-amd64926041412066b3a6Downloadable via
curl:hero_assistance_app(Dioxus desktop binary) is intentionally NOT in the deploy artifact set — it needs GTK/webkit2gtk system libs not present on server hosts.Debugging trail (3 CI runs)
Run #1 (
task 23791, on287a2ad): Build OK (1m27s), Publish failed atHTTP 404. Direct curl confirmed the bug:PUT /api/crates/{owner}/generic/{pkg}/{version}/{file}→ 404 (Cargo Registry path)PUT /api/packages/{owner}/generic/{pkg}/{version}/{file}→ 201 (correct Generic path)Patched
scripts/build_lib.shlines 1116 + 1584 (commit286ae22).Run #2 (
task 23792, on286ae22, force-re-taggedv0.2.1): Build OK (1m30s), Publish failed atHTTP 401withreqPackageAccess. Token lackedwrite:packagescope. Investigation showed:FORGEJO_TOKENsecret was created2026-04-28, never tested for package writes.hero_booksv0.1.5 was uploaded2026-02-10(predates org secret); creatormik-tf— likely manualcurlnot CI.write:package(verified via PUT probe to a throw-away version → 201, then deleted).Set repo-level
FORGEJO_TOKENsecret = working PAT (overrides org-level).Run #3 (
task 23795,workflow_dispatch-triggered): Full success in 2m07s. Package landed; verified via download.Lessons recorded
The
forge_ciClaude skill was invaluable for the log-fetch dance:/{owner}/{repo}/actions/runs/{run_index}/jobs/{job_index}/attempt/1with{"logCursors":[{"step":N,"cursor":0,"expanded":true}]}body. Public repos only.index_in_repo(the human-readable run number, e.g.,1/2/3) in the log endpoint URL, NOT the internal task ID (23791/...).The
/proc/<pid>/statusdiagnostic from B2 (s32 main work) generalises: always check the actual API response code before assuming a workflow's intent matches its config. The 404→401 progression here was diagnostic gold — each error narrowed the search by an order of magnitude.Follow-up (out of scope for this issue)
FORGEJO_TOKENshould be re-issued withwrite:package+write:repositoryscopes, then the repo-level override can be deleted. This is an ops-level concern across alllhumina_coderepos that adopt the build-linux pattern. Current status: hero_assistance has its own working repo-level token; other repos may have the same issue silently (their build-linux workflows haven't been triggered recently).scripts/build_lib.shURL fix should be back-ported to the upstream template (likely lives in another hero crate'sscripts/or a shared "hero build helpers" repo). Other lhumina_code repos using this template have the same latent bug.test.yamlworkflow for branch-push CI (cargo test --no-fail-fastondevelopmentpushes + PRs) per the canonical pattern. Out of scope for this issue; can be a follow-up.Acceptance criteria
.forgejo/workflows/build-linux.yamllands ondevelopment.scripts/build_lib.shexposes the 5 helpers (verified:ci_setup_toolchain,build_binaries,forge_config,bin_dir,publish_binaries— all present).buildenv.shVERSION matches the latest tag.v0.2.1→ workflow runs green → Generic package exists with all 3 binaries downloadable.Optional: sibling— deferred, follow-up.test.yamlworkflowCloses this issue.