publish the plugin zip to artifactapi on tag #4

2026-09-19T23:45:46+10:00

unkin-agent commented

2026-09-19 23:45:46 +10:00

Tagged releases had no pipeline, so the plugin zip was built by hand and jellyfin-ha had nothing to pin to. Plugin versions are 4-part, but the bump targets were copied from a 3-part semver project.

add .woodpecker/release.yaml: JPRM build, then probe-then-PUT to artifactapi's jellyfin-plugins repo
run both steps on almalinux9-base, the image that trusts the internal CA
fail the build when the tag and build.yaml version disagree
bump the 4-part version in build.yaml and the csproj; add a hotfix target for the fourth component

Publishes to files/unkin/jellyfin-plugin-sso//sso-authentication_.zip. Requires terraform-artifactapi #48 applied first.

Tagged releases had no pipeline, so the plugin zip was built by hand and jellyfin-ha had nothing to pin to. Plugin versions are 4-part, but the bump targets were copied from a 3-part semver project. - add .woodpecker/release.yaml: JPRM build, then probe-then-PUT to artifactapi's jellyfin-plugins repo - run both steps on almalinux9-base, the image that trusts the internal CA - fail the build when the tag and build.yaml version disagree - bump the 4-part version in build.yaml and the csproj; add a hotfix target for the fourth component Publishes to files/unkin/jellyfin-plugin-sso/<version>/sso-authentication_<version>.zip. Requires terraform-artifactapi #48 applied first.

unkin-agent added 2 commits 2026-09-19 23:45:47 +10:00

publish the plugin zip to artifactapi on tag 82e4c338ee

Add .woodpecker/release.yaml building the JPRM zip and uploading it to the
jellyfin-plugins repo, and teach the bump targets the plugin's 4-part version.

Merge remote-tracking branch 'origin/main' into benvin/release-pipeline

ci/woodpecker/pr/ci Pipeline was successful

Details

b5245fe666

benvin merged commit ac1032d85e into main

2026-09-19 23:52:47 +10:00

benvin deleted branch benvin/release-pipeline

2026-09-19 23:52:48 +10:00

unkin-agent commented

2026-09-19 23:54:44 +10:00

Makefile:109-134 (release define, used by major/minor/patch/hotfix) — no atomicity: sed rewrites build.yaml + csproj before the commit; each recipe line is a separate shell, so a failure at commit/tag/push (hook rejection, tag collision, push rejection) leaves either an uncommitted dirty bump (build.yaml/csproj modified on disk, verified by simulation) or a committed-but-untagged/unpushed local state that the next make invocation will not detect as dirty and will silently bump again from → wrap sed+commit+tag+push in one shell with a trap that reverts (git checkout -- build.yaml SSO-Auth/SSO-Auth.csproj) on failure before the commit lands, or at minimum document the manual recovery.
.woodpecker/release.yaml:53-56 — the skip-on-200 branch exit 0s before reaching sha256sum "$$ZIP", so re-running the pipeline against an already-published tag emits no checksum for the downstream jellyfin-ha pin, and never verifies the freshly built zip matches what is actually already published (silent divergence if a rebuild differs) → sha256sum the local zip on both branches and compare it against the published object before skipping.
.woodpecker/release.yaml — nothing checks that $CI_COMMIT_TAG's commit is reachable from origin/main; `make major|minor|patch|hotfix` tags whatever is currently checked out, so a tag can point at a commit that never passed PR CI → add a `git merge-base --is-ancestor $CI_COMMIT_SHA origin/main` (or equivalent) check before build/publish.
nit: .woodpecker/release.yaml:71-80 (publish step resources) — 256Mi/250m requests is below the stated baseline (512Mi/1cpu) for a step that only curls and hashes; fine if deliberate, but worth a one-line comment saying so.

- Makefile:109-134 (`release` define, used by major/minor/patch/hotfix) — no atomicity: sed rewrites build.yaml + csproj before the commit; each recipe line is a separate shell, so a failure at commit/tag/push (hook rejection, tag collision, push rejection) leaves either an uncommitted dirty bump (build.yaml/csproj modified on disk, verified by simulation) or a committed-but-untagged/unpushed local state that the next `make` invocation will not detect as dirty and will silently bump again from → wrap sed+commit+tag+push in one shell with a trap that reverts (`git checkout -- build.yaml SSO-Auth/SSO-Auth.csproj`) on failure before the commit lands, or at minimum document the manual recovery. - .woodpecker/release.yaml:53-56 — the skip-on-200 branch `exit 0`s before reaching `sha256sum "$$ZIP"`, so re-running the pipeline against an already-published tag emits no checksum for the downstream jellyfin-ha pin, and never verifies the freshly built zip matches what is actually already published (silent divergence if a rebuild differs) → sha256sum the local zip on both branches and compare it against the published object before skipping. - .woodpecker/release.yaml — nothing checks that $$CI_COMMIT_TAG's commit is reachable from origin/main; `make major|minor|patch|hotfix` tags whatever is currently checked out, so a tag can point at a commit that never passed PR CI → add a `git merge-base --is-ancestor $$CI_COMMIT_SHA origin/main` (or equivalent) check before build/publish. - nit: .woodpecker/release.yaml:71-80 (publish step resources) — 256Mi/250m requests is below the stated baseline (512Mi/1cpu) for a step that only curls and hashes; fine if deliberate, but worth a one-line comment saying so.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/jellyfin-plugin-sso#4