From 2c6d8e615841409a1be08064f31945cda2a9601f Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 1 Sep 2026 16:12:11 -0500 Subject: [PATCH 01/17] test(canary): reserve product-path fallback version --- .zpkg.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.zpkg.toml b/.zpkg.toml index ce6eea4..c7e1b6d 100644 --- a/.zpkg.toml +++ b/.zpkg.toml @@ -1,8 +1,8 @@ [package] org = "zed-pkg-test" name = "github-api-fallback-canary" -version = "0.0.1" -description = "Live GitHub API fallback canary" +version = "0.0.2" +description = "Live zed publish/install canary for GitHub and Cloudflare fallback" license = "MIT" [package.repository] From 14c326960ff11d036f061f5bd275a7c3e39f150d Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 1 Sep 2026 16:12:16 -0500 Subject: [PATCH 02/17] test(canary): add deterministic product payload --- src/payload.txt | 1 + 1 file changed, 1 insertion(+) create mode 100644 src/payload.txt diff --git a/src/payload.txt b/src/payload.txt new file mode 100644 index 0000000..f106a08 --- /dev/null +++ b/src/payload.txt @@ -0,0 +1 @@ +real-zed-github-cloudflare-e2e-v0.0.2 From 6012b9e39855eb61c37ceda929f6fd448f5b5b39 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 1 Sep 2026 16:12:33 -0500 Subject: [PATCH 03/17] test(canary): run live zed GitHub and Cloudflare E2E --- .github/workflows/live-zed-cloudflare.yml | 100 ++++++++++++++++++++++ 1 file changed, 100 insertions(+) create mode 100644 .github/workflows/live-zed-cloudflare.yml diff --git a/.github/workflows/live-zed-cloudflare.yml b/.github/workflows/live-zed-cloudflare.yml new file mode 100644 index 0000000..c00f5f1 --- /dev/null +++ b/.github/workflows/live-zed-cloudflare.yml @@ -0,0 +1,100 @@ +name: Live Zed GitHub and Cloudflare E2E + +on: + pull_request: + paths: + - ".github/workflows/live-zed-cloudflare.yml" + - ".zpkg.toml" + - "src/payload.txt" + - "README.md" + push: + branches: + - main + paths: + - ".github/workflows/live-zed-cloudflare.yml" + - ".zpkg.toml" + - "src/payload.txt" + - "README.md" + workflow_dispatch: + +permissions: + contents: write + packages: write + +concurrency: + group: live-zed-cloudflare-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: false + +defaults: + run: + shell: bash + +env: + CARGO_TERM_COLOR: always + RUST_BACKTRACE: "1" + ZED_CLI_SHA: d00b1913d5ff34b65fc11222fa7b141207a025d0 + ZED_E2E_SHA: 3b86ee6d55d1a74341a7fe95580b7e39e13d09cb + +jobs: + live-round-trip: + name: Publish, proxy, install, freeze + runs-on: ubuntu-24.04 + timeout-minutes: 45 + steps: + - name: Check out canary package + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 1 + persist-credentials: false + show-progress: false + + - name: Check out exact zed-cli candidate + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: zed-pkg/zed-cli + ref: ${{ env.ZED_CLI_SHA }} + path: product/zed-cli + fetch-depth: 1 + persist-credentials: false + show-progress: false + + - name: Check out exact E2E harness + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: zed-pkg-test/zed-pkg-e2e + ref: ${{ env.ZED_E2E_SHA }} + path: product/zed-pkg-e2e + fetch-depth: 1 + persist-credentials: false + show-progress: false + + - name: Verify immutable test inputs + run: | + set -euo pipefail + test "$(git -C product/zed-cli rev-parse HEAD)" = "$ZED_CLI_SHA" + test "$(git -C product/zed-pkg-e2e rev-parse HEAD)" = "$ZED_E2E_SHA" + python3 -m py_compile product/zed-pkg-e2e/scripts/zed_github_cloudflare_e2e.py + + - name: Install Rust + uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 + with: + toolchain: stable + + - name: Build exact zed candidate + run: | + set -euo pipefail + cargo build \ + --locked \ + --release \ + --manifest-path product/zed-cli/Cargo.toml \ + --bin zed + + - name: Exercise GitHub writes, Cloudflare reads, and direct GitHub installs + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + set -euo pipefail + python3 product/zed-pkg-e2e/scripts/zed_github_cloudflare_e2e.py \ + --zed "$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" \ + --package-root "$GITHUB_WORKSPACE" \ + --work-root "$RUNNER_TEMP/live-zed-cloudflare" From a76052635e299b4afbb462b926e1de4e3a5cc4df Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 1 Sep 2026 16:12:44 -0500 Subject: [PATCH 04/17] docs(canary): explain the live product-path contract --- README.md | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 90c4e1b..331d542 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,19 @@ # github-api-fallback-canary -Live GitHub API canary: packed Zed artifact on Releases so registry.zpkg.net outages still install. + +Public, non-secret package used to verify Zed's production fallback chain. + +The `Live Zed GitHub and Cloudflare E2E` workflow builds exact commits of +`zed-pkg/zed-cli` and `zed-pkg-test/zed-pkg-e2e`, then: + +1. runs the real `zed publish` command with the registry intentionally + unreachable; +2. requires the package artifact and metadata sidecar to be hosted on this + repository's GitHub Release; +3. compares direct GitHub bytes with the `cdn.zpkg.net/github/...` proxy; +4. verifies `registry.zpkg.net` reconstructs version metadata from the public + sidecar; and +5. runs normal and frozen installs with registry and R2 access disabled so the + CLI must consume the GitHub Release directly. + +Everything in this repository and its Releases is public. Never add credentials, +private source, customer data, or user data to the canary payload. From e9079cc34682aee25922d77cf13c1c9ecd0f43df Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 1 Sep 2026 16:22:54 -0500 Subject: [PATCH 05/17] test(canary): expose current registry edge response --- .github/workflows/live-zed-cloudflare.yml | 40 +++++++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/.github/workflows/live-zed-cloudflare.yml b/.github/workflows/live-zed-cloudflare.yml index c00f5f1..bcbf94b 100644 --- a/.github/workflows/live-zed-cloudflare.yml +++ b/.github/workflows/live-zed-cloudflare.yml @@ -36,6 +36,46 @@ env: ZED_E2E_SHA: 3b86ee6d55d1a74341a7fe95580b7e39e13d09cb jobs: + edge-probe: + name: Diagnose current registry edge + runs-on: ubuntu-24.04 + timeout-minutes: 5 + steps: + - name: Print the public version response without credentials + run: | + set -euo pipefail + python3 - <<'PY' + import json + import urllib.error + import urllib.request + + url = "https://registry.zpkg.net/v1/packages/zed-pkg-test/github-api-fallback-canary/versions/0.0.2" + request = urllib.request.Request( + url, + headers={"Accept": "application/json", "User-Agent": "zed-edge-probe/1.0"}, + ) + try: + response = urllib.request.urlopen(request, timeout=20) + except urllib.error.HTTPError as error: + response = error + body = response.read(4096).decode("utf-8", errors="replace") + headers = { + key.lower(): value + for key, value in response.headers.items() + if key.lower() in { + "content-type", + "retry-after", + "server", + "x-zed-edge", + "x-zed-source", + "cf-ray", + } + } + print(json.dumps({"status": response.status, "headers": headers, "body": body}, indent=2)) + if response.status != 200: + raise SystemExit(f"registry edge returned HTTP {response.status}") + PY + live-round-trip: name: Publish, proxy, install, freeze runs-on: ubuntu-24.04 From cd3e25718bfc40b0df9c149d48b23370ee6273ab Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 1 Sep 2026 16:27:54 -0500 Subject: [PATCH 06/17] test(canary): reserve isolated fallback version --- .zpkg.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.zpkg.toml b/.zpkg.toml index c7e1b6d..7f5aca8 100644 --- a/.zpkg.toml +++ b/.zpkg.toml @@ -1,7 +1,7 @@ [package] org = "zed-pkg-test" name = "github-api-fallback-canary" -version = "0.0.2" +version = "0.0.3" description = "Live zed publish/install canary for GitHub and Cloudflare fallback" license = "MIT" From e0f69e28a06dfd669892857b033e7b7f25bc01b6 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 1 Sep 2026 16:28:01 -0500 Subject: [PATCH 07/17] test(canary): bump deterministic fallback payload --- src/payload.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/payload.txt b/src/payload.txt index f106a08..6d92b9f 100644 --- a/src/payload.txt +++ b/src/payload.txt @@ -1 +1 @@ -real-zed-github-cloudflare-e2e-v0.0.2 +real-zed-github-cloudflare-e2e-v0.0.3 From b3081e2f3b444fc8bad07b4efb65f2c20ad79a7b Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 1 Sep 2026 16:28:20 -0500 Subject: [PATCH 08/17] test(canary): isolate package and prove direct GitHub restore first --- .github/workflows/live-zed-cloudflare.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/live-zed-cloudflare.yml b/.github/workflows/live-zed-cloudflare.yml index bcbf94b..147047e 100644 --- a/.github/workflows/live-zed-cloudflare.yml +++ b/.github/workflows/live-zed-cloudflare.yml @@ -32,8 +32,8 @@ defaults: env: CARGO_TERM_COLOR: always RUST_BACKTRACE: "1" - ZED_CLI_SHA: d00b1913d5ff34b65fc11222fa7b141207a025d0 - ZED_E2E_SHA: 3b86ee6d55d1a74341a7fe95580b7e39e13d09cb + ZED_CLI_SHA: 71a8b4c45e1f8e938b33ef19cd1468b2741e58f9 + ZED_E2E_SHA: 867948ff6221b9263d0e9852f17789940ab6722e jobs: edge-probe: @@ -81,9 +81,11 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 45 steps: - - name: Check out canary package + - name: Check out isolated canary package uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + ref: ${{ github.event.pull_request.head.sha || github.sha }} + path: canary fetch-depth: 1 persist-credentials: false show-progress: false @@ -113,6 +115,7 @@ jobs: set -euo pipefail test "$(git -C product/zed-cli rev-parse HEAD)" = "$ZED_CLI_SHA" test "$(git -C product/zed-pkg-e2e rev-parse HEAD)" = "$ZED_E2E_SHA" + test ! -e canary/product python3 -m py_compile product/zed-pkg-e2e/scripts/zed_github_cloudflare_e2e.py - name: Install Rust @@ -136,5 +139,5 @@ jobs: set -euo pipefail python3 product/zed-pkg-e2e/scripts/zed_github_cloudflare_e2e.py \ --zed "$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" \ - --package-root "$GITHUB_WORKSPACE" \ + --package-root "$GITHUB_WORKSPACE/canary" \ --work-root "$RUNNER_TEMP/live-zed-cloudflare" From bbb2899246dd16a7b3b80bcf16806219245ba60f Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 1 Sep 2026 16:41:41 -0500 Subject: [PATCH 09/17] test(canary): reserve exact-head fallback version 0.0.4 --- .zpkg.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.zpkg.toml b/.zpkg.toml index 7f5aca8..a0cb426 100644 --- a/.zpkg.toml +++ b/.zpkg.toml @@ -1,7 +1,7 @@ [package] org = "zed-pkg-test" name = "github-api-fallback-canary" -version = "0.0.3" +version = "0.0.4" description = "Live zed publish/install canary for GitHub and Cloudflare fallback" license = "MIT" From d939e576bf35a1a3cc8218ed093c1d806de4a018 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 1 Sep 2026 16:41:51 -0500 Subject: [PATCH 10/17] test(canary): bump deterministic fallback payload to 0.0.4 --- src/payload.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/payload.txt b/src/payload.txt index 6d92b9f..a237e8c 100644 --- a/src/payload.txt +++ b/src/payload.txt @@ -1 +1 @@ -real-zed-github-cloudflare-e2e-v0.0.3 +real-zed-github-cloudflare-e2e-v0.0.4 From a4c27f6951ed790eda16e8ce99a1226363de9d5e Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 1 Sep 2026 16:42:05 -0500 Subject: [PATCH 11/17] test(canary): pin formatted CLI head and version 0.0.4 --- .github/workflows/live-zed-cloudflare.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/live-zed-cloudflare.yml b/.github/workflows/live-zed-cloudflare.yml index 147047e..f76ce8e 100644 --- a/.github/workflows/live-zed-cloudflare.yml +++ b/.github/workflows/live-zed-cloudflare.yml @@ -32,7 +32,7 @@ defaults: env: CARGO_TERM_COLOR: always RUST_BACKTRACE: "1" - ZED_CLI_SHA: 71a8b4c45e1f8e938b33ef19cd1468b2741e58f9 + ZED_CLI_SHA: 40fe52dfa8ea1ca2a84e4f12587b08594a47d5f5 ZED_E2E_SHA: 867948ff6221b9263d0e9852f17789940ab6722e jobs: @@ -140,4 +140,5 @@ jobs: python3 product/zed-pkg-e2e/scripts/zed_github_cloudflare_e2e.py \ --zed "$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" \ --package-root "$GITHUB_WORKSPACE/canary" \ - --work-root "$RUNNER_TEMP/live-zed-cloudflare" + --work-root "$RUNNER_TEMP/live-zed-cloudflare" \ + --version 0.0.4 From 4ada9920c1bcfa2b547c1235365d06783b9d71cd Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 1 Sep 2026 23:55:14 -0500 Subject: [PATCH 12/17] test(canary): reserve exact-head fallback version 0.0.5 --- .zpkg.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.zpkg.toml b/.zpkg.toml index a0cb426..d833631 100644 --- a/.zpkg.toml +++ b/.zpkg.toml @@ -1,7 +1,7 @@ [package] org = "zed-pkg-test" name = "github-api-fallback-canary" -version = "0.0.4" +version = "0.0.5" description = "Live zed publish/install canary for GitHub and Cloudflare fallback" license = "MIT" From 2aa5ba166c0accdd3bb2aaa99b39f7cac75ff4d2 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 1 Sep 2026 23:55:21 -0500 Subject: [PATCH 13/17] test(canary): bump deterministic fallback payload to 0.0.5 --- src/payload.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/payload.txt b/src/payload.txt index a237e8c..e357ae8 100644 --- a/src/payload.txt +++ b/src/payload.txt @@ -1 +1 @@ -real-zed-github-cloudflare-e2e-v0.0.4 +real-zed-github-cloudflare-e2e-v0.0.5 From 88291437ae0292e5074d17a1f50678d83cc60913 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 1 Sep 2026 23:55:44 -0500 Subject: [PATCH 14/17] test(canary): pin resolver head and version 0.0.5 --- .github/workflows/live-zed-cloudflare.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/live-zed-cloudflare.yml b/.github/workflows/live-zed-cloudflare.yml index f76ce8e..b598f90 100644 --- a/.github/workflows/live-zed-cloudflare.yml +++ b/.github/workflows/live-zed-cloudflare.yml @@ -32,7 +32,7 @@ defaults: env: CARGO_TERM_COLOR: always RUST_BACKTRACE: "1" - ZED_CLI_SHA: 40fe52dfa8ea1ca2a84e4f12587b08594a47d5f5 + ZED_CLI_SHA: 072c99205be4ebb14fc9142a0237dda8b0a16d85 ZED_E2E_SHA: 867948ff6221b9263d0e9852f17789940ab6722e jobs: @@ -141,4 +141,4 @@ jobs: --zed "$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" \ --package-root "$GITHUB_WORKSPACE/canary" \ --work-root "$RUNNER_TEMP/live-zed-cloudflare" \ - --version 0.0.4 + --version 0.0.5 From 45eb0273503a1f8b8c13feaf78bc9a8d61b82967 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Wed, 2 Sep 2026 00:11:02 -0500 Subject: [PATCH 15/17] test(canary): reserve merged-main fallback version 0.0.6 --- .zpkg.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.zpkg.toml b/.zpkg.toml index d833631..90e1236 100644 --- a/.zpkg.toml +++ b/.zpkg.toml @@ -1,7 +1,7 @@ [package] org = "zed-pkg-test" name = "github-api-fallback-canary" -version = "0.0.5" +version = "0.0.6" description = "Live zed publish/install canary for GitHub and Cloudflare fallback" license = "MIT" From 052c13e75d65e1d3893b4b8fd6e92adc7e1ad443 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Wed, 2 Sep 2026 00:11:14 -0500 Subject: [PATCH 16/17] test(canary): bump deterministic merged-main payload to 0.0.6 --- src/payload.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/payload.txt b/src/payload.txt index e357ae8..adfce09 100644 --- a/src/payload.txt +++ b/src/payload.txt @@ -1 +1 @@ -real-zed-github-cloudflare-e2e-v0.0.5 +real-zed-github-cloudflare-e2e-v0.0.6 From 2bb814cefed152127e0dc02944088dedc899a6e8 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Wed, 2 Sep 2026 00:11:39 -0500 Subject: [PATCH 17/17] test(canary): pin merged CLI and harness at version 0.0.6 --- .github/workflows/live-zed-cloudflare.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/live-zed-cloudflare.yml b/.github/workflows/live-zed-cloudflare.yml index b598f90..511042f 100644 --- a/.github/workflows/live-zed-cloudflare.yml +++ b/.github/workflows/live-zed-cloudflare.yml @@ -32,8 +32,8 @@ defaults: env: CARGO_TERM_COLOR: always RUST_BACKTRACE: "1" - ZED_CLI_SHA: 072c99205be4ebb14fc9142a0237dda8b0a16d85 - ZED_E2E_SHA: 867948ff6221b9263d0e9852f17789940ab6722e + ZED_CLI_SHA: 5c65985274dd42b5974db51c73adc256cb28bbdb + ZED_E2E_SHA: cb45233fea9b09b33295e410ec2a038f57e2dc5f jobs: edge-probe: @@ -90,7 +90,7 @@ jobs: persist-credentials: false show-progress: false - - name: Check out exact zed-cli candidate + - name: Check out exact merged zed-cli uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: zed-pkg/zed-cli @@ -100,7 +100,7 @@ jobs: persist-credentials: false show-progress: false - - name: Check out exact E2E harness + - name: Check out exact merged E2E harness uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: zed-pkg-test/zed-pkg-e2e @@ -110,7 +110,7 @@ jobs: persist-credentials: false show-progress: false - - name: Verify immutable test inputs + - name: Verify immutable merged inputs run: | set -euo pipefail test "$(git -C product/zed-cli rev-parse HEAD)" = "$ZED_CLI_SHA" @@ -123,7 +123,7 @@ jobs: with: toolchain: stable - - name: Build exact zed candidate + - name: Build exact merged zed run: | set -euo pipefail cargo build \ @@ -141,4 +141,4 @@ jobs: --zed "$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" \ --package-root "$GITHUB_WORKSPACE/canary" \ --work-root "$RUNNER_TEMP/live-zed-cloudflare" \ - --version 0.0.5 + --version 0.0.6