From fa76fae0e5da5f19bf592d6a285a752d91375516 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 12 Sep 2026 20:27:06 -0500 Subject: [PATCH 01/10] test: exercise zed-cli 380 source fallback across test packages --- .../zed-cli-380-source-fallback-matrix.yml | 213 ++++++++++++++++++ 1 file changed, 213 insertions(+) create mode 100644 .github/workflows/zed-cli-380-source-fallback-matrix.yml diff --git a/.github/workflows/zed-cli-380-source-fallback-matrix.yml b/.github/workflows/zed-cli-380-source-fallback-matrix.yml new file mode 100644 index 0000000..62f8db9 --- /dev/null +++ b/.github/workflows/zed-cli-380-source-fallback-matrix.yml @@ -0,0 +1,213 @@ +name: zed-cli 380 source fallback matrix + +on: + pull_request: + paths: + - ".github/workflows/zed-cli-380-source-fallback-matrix.yml" + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: zed-cli-380-source-fallback-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: false + +defaults: + run: + shell: bash + +env: + ZED_CLI_SHA: 9a2d2bbcc682801ef26a479db22f1bb9a0d1142d + DEAD_REGISTRY: https://registry-write-intentionally-unavailable.invalid + DEAD_R2: http://127.0.0.1:1 + +jobs: + source-archive-matrix: + name: GitHub source archives across zed-pkg-test + runs-on: ubuntu-24.04 + timeout-minutes: 45 + steps: + - name: Check out exact zed-cli candidate + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: zed-pkg/zed-cli + ref: ${{ env.ZED_CLI_SHA }} + path: product/zed-cli + fetch-depth: 1 + persist-credentials: false + show-progress: false + + - name: Install candidate Rust toolchain + uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 + with: + toolchain: 1.98.1 + + - name: Refresh known stale zed-lock entry in runner + working-directory: product/zed-cli + run: | + set -Eeuo pipefail + cargo update -p zed-lock + git diff -- Cargo.lock + test "$(git diff --name-only)" = "Cargo.lock" + + - name: Build exact candidate + run: | + set -Eeuo pipefail + cargo build \ + --locked \ + --release \ + --manifest-path product/zed-cli/Cargo.toml \ + --bin zed + test "$(git -C product/zed-cli rev-parse HEAD)" = "$ZED_CLI_SHA" + + - name: Create three-package consumer + run: | + set -Eeuo pipefail + mkdir -p consumer + cat > consumer/.zpkg.toml <<'EOF' + [package] + org = "zed-pkg-test" + name = "source-fallback-matrix-consumer" + version = "0.0.0" + description = "Exercises source archive fallback across test packages" + + [package.repository] + vcs = "git" + url = "https://github.com/zed-pkg-test/github-api-fallback-canary" + + [install] + dir = "zed_modules" + adapter = "none" + + [dependencies] + "zed-pkg-test/go-lib" = "=1.0.0" + "zed-pkg-test/python-lib" = "=1.0.0" + "zed-pkg-test/dart-lib" = "=1.0.0" + EOF + + - name: Force registry failure and install from GitHub source archives + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + ZED_PKG_SOURCE_FALLBACK: "true" + ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} + run: | + set -Eeuo pipefail + ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" + "$ZED" \ + --registry "$DEAD_REGISTRY" \ + --home "$RUNNER_TEMP/zed-home-source-a" \ + install \ + --install-mode copy \ + --adapter none \ + --allow-ecosystem-mismatch \ + 2>&1 | tee "$RUNNER_TEMP/source-a.log" + grep -F "using GitHub" "$RUNNER_TEMP/source-a.log" + test -s consumer/.zpkg.lock + + python3 - <<'PY' + from pathlib import Path + root = Path("consumer/zed_modules") + manifests = list(root.rglob(".zpkg.toml")) + text = "\n".join(path.read_text(encoding="utf-8") for path in manifests) + expected = ("go-lib", "python-lib", "dart-lib") + missing = [name for name in expected if f'name = "{name}"' not in text] + if missing: + raise SystemExit(f"missing installed manifests for: {missing}; manifests={manifests}") + if len(manifests) < 3: + raise SystemExit(f"expected at least three installed package manifests, found {manifests}") + PY + + sha256sum consumer/.zpkg.lock | tee "$RUNNER_TEMP/lock-a.sha" + cp consumer/.zpkg.lock "$RUNNER_TEMP/lock-a" + + - name: Frozen reinstall from a clean home is lock-stable + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + ZED_PKG_SOURCE_FALLBACK: "true" + ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} + run: | + set -Eeuo pipefail + ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" + rm -rf consumer/zed_modules "$RUNNER_TEMP/zed-home-source-frozen" + "$ZED" \ + --registry "$DEAD_REGISTRY" \ + --home "$RUNNER_TEMP/zed-home-source-frozen" \ + install \ + --frozen \ + --install-mode copy \ + --adapter none \ + --allow-ecosystem-mismatch \ + 2>&1 | tee "$RUNNER_TEMP/source-frozen.log" + cmp "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock + test "$(find consumer/zed_modules -name .zpkg.toml -type f | wc -l)" -ge 3 + + - name: Fresh fallback resolution is deterministic + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + ZED_PKG_SOURCE_FALLBACK: "true" + ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} + run: | + set -Eeuo pipefail + ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" + rm -rf consumer/zed_modules consumer/.zpkg.lock "$RUNNER_TEMP/zed-home-source-b" + "$ZED" \ + --registry "$DEAD_REGISTRY" \ + --home "$RUNNER_TEMP/zed-home-source-b" \ + install \ + --install-mode copy \ + --adapter none \ + --allow-ecosystem-mismatch \ + 2>&1 | tee "$RUNNER_TEMP/source-b.log" + cmp "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock + + - name: Exercise zpkg.net first hop with the same packages + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + ZED_PKG_SOURCE_FALLBACK: "true" + ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} + run: | + set -Eeuo pipefail + ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" + python3 - <<'PY' + import urllib.error, urllib.request + url = "https://zpkg.net/v1/packages/zed-pkg-test/go-lib/versions/1.0.0" + req = urllib.request.Request(url, headers={"Accept":"application/json", "User-Agent":"zed-pkg-test-source-matrix/1.0"}) + try: + res = urllib.request.urlopen(req, timeout=20) + except urllib.error.HTTPError as exc: + res = exc + body = res.read(512).decode("utf-8", errors="replace") + print(f"zpkg.net probe status={res.status} body={body}") + PY + + rm -rf consumer/zed_modules consumer/.zpkg.lock "$RUNNER_TEMP/zed-home-edge" + "$ZED" \ + --registry https://zpkg.net \ + --home "$RUNNER_TEMP/zed-home-edge" \ + install \ + --install-mode copy \ + --adapter none \ + --allow-ecosystem-mismatch \ + 2>&1 | tee "$RUNNER_TEMP/edge.log" + test -s consumer/.zpkg.lock + test "$(find consumer/zed_modules -name .zpkg.toml -type f | wc -l)" -ge 3 + + - name: Exercise the CLI default registry alias + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + ZED_PKG_SOURCE_FALLBACK: "true" + ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} + run: | + set -Eeuo pipefail + ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" + rm -rf consumer/zed_modules consumer/.zpkg.lock "$RUNNER_TEMP/zed-home-default" + "$ZED" \ + --home "$RUNNER_TEMP/zed-home-default" \ + install \ + --install-mode copy \ + --adapter none \ + --allow-ecosystem-mismatch \ + 2>&1 | tee "$RUNNER_TEMP/default.log" + test -s consumer/.zpkg.lock + test "$(find consumer/zed_modules -name .zpkg.toml -type f | wc -l)" -ge 3 From f464ebbca0bbc8b4ad947f73d9cb76d2c5f7c604 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 12 Sep 2026 20:28:36 -0500 Subject: [PATCH 02/10] test: run public source fallback matrix on branch push --- .../zed-cli-380-public-source-fallback.yml | 145 ++++++++++++++++++ 1 file changed, 145 insertions(+) create mode 100644 .github/workflows/zed-cli-380-public-source-fallback.yml diff --git a/.github/workflows/zed-cli-380-public-source-fallback.yml b/.github/workflows/zed-cli-380-public-source-fallback.yml new file mode 100644 index 0000000..4a5a962 --- /dev/null +++ b/.github/workflows/zed-cli-380-public-source-fallback.yml @@ -0,0 +1,145 @@ +name: zed-cli 380 public source fallback + +on: + push: + branches: + - "test/zed-cli-380-source-fallback-matrix" + paths: + - ".github/workflows/zed-cli-380-public-source-fallback.yml" + workflow_dispatch: + +permissions: + contents: read + +defaults: + run: + shell: bash + +env: + ZED_CLI_SHA: 9a2d2bbcc682801ef26a479db22f1bb9a0d1142d + DEAD_REGISTRY: https://registry-write-intentionally-unavailable.invalid + DEAD_R2: http://127.0.0.1:1 + +jobs: + public-source-fallback: + name: Public GitHub source fallback matrix + runs-on: ubuntu-24.04 + timeout-minutes: 45 + steps: + - name: Check out exact zed-cli candidate + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: zed-pkg/zed-cli + ref: ${{ env.ZED_CLI_SHA }} + path: product/zed-cli + fetch-depth: 1 + persist-credentials: false + show-progress: false + + - name: Install candidate Rust toolchain + uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 + with: + toolchain: 1.98.1 + + - name: Refresh only the known stale zed-lock entry + working-directory: product/zed-cli + run: | + set -Eeuo pipefail + cargo update -p zed-lock + test "$(git diff --name-only)" = "Cargo.lock" + + - name: Build exact candidate + run: | + set -Eeuo pipefail + cargo build --locked --release --manifest-path product/zed-cli/Cargo.toml --bin zed + test "$(git -C product/zed-cli rev-parse HEAD)" = "$ZED_CLI_SHA" + + - name: Create multi-package consumer + run: | + set -Eeuo pipefail + mkdir -p consumer + cat > consumer/.zpkg.toml <<'EOF' + [package] + org = "zed-pkg-test" + name = "source-fallback-matrix-consumer" + version = "0.0.0" + description = "Public source archive fallback matrix" + + [package.repository] + vcs = "git" + url = "https://github.com/zed-pkg-test/github-api-fallback-canary" + + [install] + dir = "zed_modules" + adapter = "none" + + [dependencies] + "zed-pkg-test/go-lib" = "=1.0.0" + "zed-pkg-test/python-lib" = "=1.0.0" + "zed-pkg-test/dart-lib" = "=1.0.0" + EOF + + - name: Force source fallback and stitch three packages + env: + ZED_PKG_SOURCE_FALLBACK: "true" + ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} + run: | + set -Eeuo pipefail + ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" + unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true + "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-source" install \ + --install-mode copy --adapter none --allow-ecosystem-mismatch \ + 2>&1 | tee "$RUNNER_TEMP/source.log" + grep -F "using GitHub" "$RUNNER_TEMP/source.log" + test -s consumer/.zpkg.lock + python3 - <<'PY' + from pathlib import Path + manifests = list(Path("consumer/zed_modules").rglob(".zpkg.toml")) + text = "\n".join(p.read_text(encoding="utf-8") for p in manifests) + expected = ("go-lib", "python-lib", "dart-lib") + missing = [name for name in expected if f'name = "{name}"' not in text] + if missing: + raise SystemExit(f"missing installed packages {missing}; manifests={manifests}") + print(f"installed manifests: {[str(p) for p in manifests]}") + PY + cp consumer/.zpkg.lock "$RUNNER_TEMP/lock-first" + + - name: Frozen reinstall from clean store remains stable + env: + ZED_PKG_SOURCE_FALLBACK: "true" + ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} + run: | + set -Eeuo pipefail + ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" + unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true + rm -rf consumer/zed_modules "$RUNNER_TEMP/zed-home-frozen" + "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-frozen" install --frozen \ + --install-mode copy --adapter none --allow-ecosystem-mismatch \ + 2>&1 | tee "$RUNNER_TEMP/frozen.log" + cmp "$RUNNER_TEMP/lock-first" consumer/.zpkg.lock + test "$(find consumer/zed_modules -name .zpkg.toml -type f | wc -l)" -ge 3 + + - name: Probe and exercise zpkg.net first hop + env: + ZED_PKG_SOURCE_FALLBACK: "true" + ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} + run: | + set -Eeuo pipefail + ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" + unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true + python3 - <<'PY' + import urllib.error, urllib.request + url = "https://zpkg.net/v1/packages/zed-pkg-test/go-lib/versions/1.0.0" + req = urllib.request.Request(url, headers={"Accept":"application/json", "User-Agent":"zed-source-fallback-matrix/1.0"}) + try: + res = urllib.request.urlopen(req, timeout=20) + except urllib.error.HTTPError as exc: + res = exc + print("zpkg.net", res.status, res.read(512).decode("utf-8", errors="replace")) + PY + rm -rf consumer/zed_modules consumer/.zpkg.lock "$RUNNER_TEMP/zed-home-edge" + "$ZED" --registry https://zpkg.net --home "$RUNNER_TEMP/zed-home-edge" install \ + --install-mode copy --adapter none --allow-ecosystem-mismatch \ + 2>&1 | tee "$RUNNER_TEMP/edge.log" + test -s consumer/.zpkg.lock + test "$(find consumer/zed_modules -name .zpkg.toml -type f | wc -l)" -ge 3 From b1c5045d55e168d2f39ccd2a694fedf43abba942 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 12 Sep 2026 20:31:27 -0500 Subject: [PATCH 03/10] test: run fallback installs from consumer project --- .../zed-cli-380-public-source-fallback.yml | 21 +++++++++++-------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/.github/workflows/zed-cli-380-public-source-fallback.yml b/.github/workflows/zed-cli-380-public-source-fallback.yml index 4a5a962..9423e41 100644 --- a/.github/workflows/zed-cli-380-public-source-fallback.yml +++ b/.github/workflows/zed-cli-380-public-source-fallback.yml @@ -80,6 +80,7 @@ jobs: EOF - name: Force source fallback and stitch three packages + working-directory: consumer env: ZED_PKG_SOURCE_FALLBACK: "true" ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} @@ -91,10 +92,10 @@ jobs: --install-mode copy --adapter none --allow-ecosystem-mismatch \ 2>&1 | tee "$RUNNER_TEMP/source.log" grep -F "using GitHub" "$RUNNER_TEMP/source.log" - test -s consumer/.zpkg.lock + test -s .zpkg.lock python3 - <<'PY' from pathlib import Path - manifests = list(Path("consumer/zed_modules").rglob(".zpkg.toml")) + manifests = list(Path("zed_modules").rglob(".zpkg.toml")) text = "\n".join(p.read_text(encoding="utf-8") for p in manifests) expected = ("go-lib", "python-lib", "dart-lib") missing = [name for name in expected if f'name = "{name}"' not in text] @@ -102,9 +103,10 @@ jobs: raise SystemExit(f"missing installed packages {missing}; manifests={manifests}") print(f"installed manifests: {[str(p) for p in manifests]}") PY - cp consumer/.zpkg.lock "$RUNNER_TEMP/lock-first" + cp .zpkg.lock "$RUNNER_TEMP/lock-first" - name: Frozen reinstall from clean store remains stable + working-directory: consumer env: ZED_PKG_SOURCE_FALLBACK: "true" ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} @@ -112,14 +114,15 @@ jobs: set -Eeuo pipefail ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true - rm -rf consumer/zed_modules "$RUNNER_TEMP/zed-home-frozen" + rm -rf zed_modules "$RUNNER_TEMP/zed-home-frozen" "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-frozen" install --frozen \ --install-mode copy --adapter none --allow-ecosystem-mismatch \ 2>&1 | tee "$RUNNER_TEMP/frozen.log" - cmp "$RUNNER_TEMP/lock-first" consumer/.zpkg.lock - test "$(find consumer/zed_modules -name .zpkg.toml -type f | wc -l)" -ge 3 + cmp "$RUNNER_TEMP/lock-first" .zpkg.lock + test "$(find zed_modules -name .zpkg.toml -type f | wc -l)" -ge 3 - name: Probe and exercise zpkg.net first hop + working-directory: consumer env: ZED_PKG_SOURCE_FALLBACK: "true" ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} @@ -137,9 +140,9 @@ jobs: res = exc print("zpkg.net", res.status, res.read(512).decode("utf-8", errors="replace")) PY - rm -rf consumer/zed_modules consumer/.zpkg.lock "$RUNNER_TEMP/zed-home-edge" + rm -rf zed_modules .zpkg.lock "$RUNNER_TEMP/zed-home-edge" "$ZED" --registry https://zpkg.net --home "$RUNNER_TEMP/zed-home-edge" install \ --install-mode copy --adapter none --allow-ecosystem-mismatch \ 2>&1 | tee "$RUNNER_TEMP/edge.log" - test -s consumer/.zpkg.lock - test "$(find consumer/zed_modules -name .zpkg.toml -type f | wc -l)" -ge 3 + test -s .zpkg.lock + test "$(find zed_modules -name .zpkg.toml -type f | wc -l)" -ge 3 From 6fc49fe9e28ea04d64655a7d5f816896f38d8da4 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 12 Sep 2026 20:38:45 -0500 Subject: [PATCH 04/10] test: rerun source fallback matrix with PAX fix --- .github/workflows/zed-cli-380-public-source-fallback.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/zed-cli-380-public-source-fallback.yml b/.github/workflows/zed-cli-380-public-source-fallback.yml index 9423e41..eb6a2b5 100644 --- a/.github/workflows/zed-cli-380-public-source-fallback.yml +++ b/.github/workflows/zed-cli-380-public-source-fallback.yml @@ -16,7 +16,7 @@ defaults: shell: bash env: - ZED_CLI_SHA: 9a2d2bbcc682801ef26a479db22f1bb9a0d1142d + ZED_CLI_SHA: a6795384d13fa903dae9d902ba8e207888f437f3 DEAD_REGISTRY: https://registry-write-intentionally-unavailable.invalid DEAD_R2: http://127.0.0.1:1 From a9b25f4c96a5dda7671540b119e51f3824052f12 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 12 Sep 2026 20:46:03 -0500 Subject: [PATCH 05/10] test: expand zed-cli source fallback coverage --- .../zed-cli-380-expanded-source-fallback.yml | 202 ++++++++++++++++++ 1 file changed, 202 insertions(+) create mode 100644 .github/workflows/zed-cli-380-expanded-source-fallback.yml diff --git a/.github/workflows/zed-cli-380-expanded-source-fallback.yml b/.github/workflows/zed-cli-380-expanded-source-fallback.yml new file mode 100644 index 0000000..f08d810 --- /dev/null +++ b/.github/workflows/zed-cli-380-expanded-source-fallback.yml @@ -0,0 +1,202 @@ +name: zed-cli 380 expanded source fallback + +on: + push: + branches: + - "test/zed-cli-380-source-fallback-matrix" + paths: + - ".github/workflows/zed-cli-380-expanded-source-fallback.yml" + workflow_dispatch: + +permissions: + contents: read + +defaults: + run: + shell: bash + +env: + ZED_CLI_SHA: a6795384d13fa903dae9d902ba8e207888f437f3 + DEAD_REGISTRY: https://registry-write-intentionally-unavailable.invalid + DEAD_R2: http://127.0.0.1:1 + +jobs: + expanded-source-fallback: + name: Five-language source fallback plus negative identity check + runs-on: ubuntu-24.04 + timeout-minutes: 45 + steps: + - name: Check out exact zed-cli candidate + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: zed-pkg/zed-cli + ref: ${{ env.ZED_CLI_SHA }} + path: product/zed-cli + fetch-depth: 1 + persist-credentials: false + show-progress: false + + - name: Install candidate Rust toolchain + uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 + with: + toolchain: 1.98.1 + + - name: Refresh only the known stale zed-lock entry + working-directory: product/zed-cli + run: | + set -Eeuo pipefail + cargo update -p zed-lock + test "$(git diff --name-only)" = "Cargo.lock" + + - name: Build exact candidate + run: | + set -Eeuo pipefail + cargo build --locked --release --manifest-path product/zed-cli/Cargo.toml --bin zed + test "$(git -C product/zed-cli rev-parse HEAD)" = "$ZED_CLI_SHA" + + - name: Create five-language consumer + run: | + set -Eeuo pipefail + mkdir -p consumer + cat > consumer/.zpkg.toml <<'EOF' + [package] + org = "zed-pkg-test" + name = "expanded-source-fallback-consumer" + version = "0.0.0" + description = "Five-language public source archive fallback matrix" + + [package.repository] + vcs = "git" + url = "https://github.com/zed-pkg-test/github-api-fallback-canary" + + [install] + dir = "zed_modules" + adapter = "none" + + [dependencies] + "zed-pkg-test/go-lib" = "=1.0.0" + "zed-pkg-test/python-lib" = "=1.0.0" + "zed-pkg-test/dart-lib" = "=1.0.0" + "zed-pkg-test/node-lib" = "=1.0.0" + "zed-pkg-test/gleam-lib" = "=1.0.0" + EOF + + - name: Force direct GitHub source fallback for five release-free repos + working-directory: consumer + env: + ZED_PKG_SOURCE_FALLBACK: "true" + ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} + run: | + set -Eeuo pipefail + ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" + unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true + "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-source-a" install \ + --install-mode copy --adapter none --allow-ecosystem-mismatch \ + 2>&1 | tee "$RUNNER_TEMP/source-a.log" + + test "$(grep -c 'using GitHub fallback' "$RUNNER_TEMP/source-a.log")" -ge 5 + test -s .zpkg.lock + python3 - <<'PY' + from pathlib import Path + manifests = list(Path("zed_modules").rglob(".zpkg.toml")) + text = "\n".join(p.read_text(encoding="utf-8") for p in manifests) + expected = ("go-lib", "python-lib", "dart-lib", "node-lib", "gleam-lib") + missing = [name for name in expected if f'name = "{name}"' not in text] + if missing: + raise SystemExit(f"missing installed packages {missing}; manifests={manifests}") + if len(manifests) < len(expected): + raise SystemExit(f"expected >= {len(expected)} installed manifests, got {manifests}") + print("installed", sorted(str(p) for p in manifests)) + PY + cp .zpkg.lock "$RUNNER_TEMP/lock-a" + + - name: Fresh clean-store resolution is deterministic + working-directory: consumer + env: + ZED_PKG_SOURCE_FALLBACK: "true" + ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} + run: | + set -Eeuo pipefail + ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" + unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true + rm -rf zed_modules .zpkg.lock "$RUNNER_TEMP/zed-home-source-b" + "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-source-b" install \ + --install-mode copy --adapter none --allow-ecosystem-mismatch \ + 2>&1 | tee "$RUNNER_TEMP/source-b.log" + cmp "$RUNNER_TEMP/lock-a" .zpkg.lock + + - name: Frozen replay from another clean store is lock-stable + working-directory: consumer + env: + ZED_PKG_SOURCE_FALLBACK: "true" + ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} + run: | + set -Eeuo pipefail + ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" + unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true + rm -rf zed_modules "$RUNNER_TEMP/zed-home-frozen" + "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-frozen" install --frozen \ + --install-mode copy --adapter none --allow-ecosystem-mismatch \ + 2>&1 | tee "$RUNNER_TEMP/frozen.log" + cmp "$RUNNER_TEMP/lock-a" .zpkg.lock + test "$(find zed_modules -name .zpkg.toml -type f | wc -l)" -ge 5 + + - name: Reject a tagged repo whose manifest claims the wrong org + run: | + set -Eeuo pipefail + mkdir -p negative + cat > negative/.zpkg.toml <<'EOF' + [package] + org = "zed-pkg-test" + name = "negative-source-fallback-consumer" + version = "0.0.0" + description = "Identity-mismatch negative fallback test" + + [package.repository] + vcs = "git" + url = "https://github.com/zed-pkg-test/github-api-fallback-canary" + + [install] + dir = "zed_modules" + adapter = "none" + + [dependencies] + "zed-pkg-test/awkward-lib" = "=0.1.0" + EOF + + ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" + unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true + set +e + ( + cd negative + ZED_PKG_SOURCE_FALLBACK=true ZED_PKG_R2_PUBLIC_BASE="$DEAD_R2" \ + "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-negative" install \ + --install-mode copy --adapter none --allow-ecosystem-mismatch + ) >"$RUNNER_TEMP/negative.log" 2>&1 + status=$? + set -e + cat "$RUNNER_TEMP/negative.log" + test "$status" -ne 0 + grep -E 'tagged .*\.zpkg\.toml claims zedtest/awkward-lib@0\.1\.0, expected zed-pkg-test/awkward-lib@0\.1\.0|expected zed-pkg-test/awkward-lib@0\.1\.0' "$RUNNER_TEMP/negative.log" + + - name: Use registry.zpkg.net as a Worker-edge control + working-directory: consumer + env: + ZED_PKG_SOURCE_FALLBACK: "true" + ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} + run: | + set -Eeuo pipefail + python3 - <<'PY' + import urllib.error, urllib.request + url = "https://registry.zpkg.net/v1/packages/zed-pkg-test/go-lib/versions/1.0.0" + req = urllib.request.Request(url, headers={"Accept":"application/json", "User-Agent":"zed-expanded-source-fallback/1.0"}) + try: + res = urllib.request.urlopen(req, timeout=20) + except urllib.error.HTTPError as exc: + res = exc + body = res.read(1024).decode("utf-8", errors="replace") + print("registry.zpkg.net", res.status, dict(res.headers), body) + edge = res.headers.get("x-zed-edge", "") + if edge.lower() != "registry": + raise SystemExit(f"registry.zpkg.net did not traverse registry Worker: x-zed-edge={edge!r}") + PY From 21dce82c958fcf4b15455f5d50e95a6adf1d75c9 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 12 Sep 2026 22:16:00 -0500 Subject: [PATCH 06/10] test: bind source fallback matrix to current PR head and consumer cwd --- .../zed-cli-380-source-fallback-matrix.yml | 102 ++++++++++-------- 1 file changed, 56 insertions(+), 46 deletions(-) diff --git a/.github/workflows/zed-cli-380-source-fallback-matrix.yml b/.github/workflows/zed-cli-380-source-fallback-matrix.yml index 62f8db9..f05ab12 100644 --- a/.github/workflows/zed-cli-380-source-fallback-matrix.yml +++ b/.github/workflows/zed-cli-380-source-fallback-matrix.yml @@ -18,7 +18,7 @@ defaults: shell: bash env: - ZED_CLI_SHA: 9a2d2bbcc682801ef26a479db22f1bb9a0d1142d + ZED_CLI_SHA: a6795384d13fa903dae9d902ba8e207888f437f3 DEAD_REGISTRY: https://registry-write-intentionally-unavailable.invalid DEAD_R2: http://127.0.0.1:1 @@ -88,20 +88,22 @@ jobs: - name: Force registry failure and install from GitHub source archives env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} ZED_PKG_SOURCE_FALLBACK: "true" ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} run: | set -Eeuo pipefail ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" - "$ZED" \ - --registry "$DEAD_REGISTRY" \ - --home "$RUNNER_TEMP/zed-home-source-a" \ - install \ - --install-mode copy \ - --adapter none \ - --allow-ecosystem-mismatch \ - 2>&1 | tee "$RUNNER_TEMP/source-a.log" + unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true + ( + cd consumer + "$ZED" \ + --registry "$DEAD_REGISTRY" \ + --home "$RUNNER_TEMP/zed-home-source-a" \ + install \ + --install-mode copy \ + --adapter none \ + --allow-ecosystem-mismatch + ) 2>&1 | tee "$RUNNER_TEMP/source-a.log" grep -F "using GitHub" "$RUNNER_TEMP/source-a.log" test -s consumer/.zpkg.lock @@ -123,52 +125,56 @@ jobs: - name: Frozen reinstall from a clean home is lock-stable env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} ZED_PKG_SOURCE_FALLBACK: "true" ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} run: | set -Eeuo pipefail ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" + unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true rm -rf consumer/zed_modules "$RUNNER_TEMP/zed-home-source-frozen" - "$ZED" \ - --registry "$DEAD_REGISTRY" \ - --home "$RUNNER_TEMP/zed-home-source-frozen" \ - install \ - --frozen \ - --install-mode copy \ - --adapter none \ - --allow-ecosystem-mismatch \ - 2>&1 | tee "$RUNNER_TEMP/source-frozen.log" + ( + cd consumer + "$ZED" \ + --registry "$DEAD_REGISTRY" \ + --home "$RUNNER_TEMP/zed-home-source-frozen" \ + install \ + --frozen \ + --install-mode copy \ + --adapter none \ + --allow-ecosystem-mismatch + ) 2>&1 | tee "$RUNNER_TEMP/source-frozen.log" cmp "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock test "$(find consumer/zed_modules -name .zpkg.toml -type f | wc -l)" -ge 3 - name: Fresh fallback resolution is deterministic env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} ZED_PKG_SOURCE_FALLBACK: "true" ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} run: | set -Eeuo pipefail ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" + unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true rm -rf consumer/zed_modules consumer/.zpkg.lock "$RUNNER_TEMP/zed-home-source-b" - "$ZED" \ - --registry "$DEAD_REGISTRY" \ - --home "$RUNNER_TEMP/zed-home-source-b" \ - install \ - --install-mode copy \ - --adapter none \ - --allow-ecosystem-mismatch \ - 2>&1 | tee "$RUNNER_TEMP/source-b.log" + ( + cd consumer + "$ZED" \ + --registry "$DEAD_REGISTRY" \ + --home "$RUNNER_TEMP/zed-home-source-b" \ + install \ + --install-mode copy \ + --adapter none \ + --allow-ecosystem-mismatch + ) 2>&1 | tee "$RUNNER_TEMP/source-b.log" cmp "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock - name: Exercise zpkg.net first hop with the same packages env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} ZED_PKG_SOURCE_FALLBACK: "true" ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} run: | set -Eeuo pipefail ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" + unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true python3 - <<'PY' import urllib.error, urllib.request url = "https://zpkg.net/v1/packages/zed-pkg-test/go-lib/versions/1.0.0" @@ -182,32 +188,36 @@ jobs: PY rm -rf consumer/zed_modules consumer/.zpkg.lock "$RUNNER_TEMP/zed-home-edge" - "$ZED" \ - --registry https://zpkg.net \ - --home "$RUNNER_TEMP/zed-home-edge" \ - install \ - --install-mode copy \ - --adapter none \ - --allow-ecosystem-mismatch \ - 2>&1 | tee "$RUNNER_TEMP/edge.log" + ( + cd consumer + "$ZED" \ + --registry https://zpkg.net \ + --home "$RUNNER_TEMP/zed-home-edge" \ + install \ + --install-mode copy \ + --adapter none \ + --allow-ecosystem-mismatch + ) 2>&1 | tee "$RUNNER_TEMP/edge.log" test -s consumer/.zpkg.lock test "$(find consumer/zed_modules -name .zpkg.toml -type f | wc -l)" -ge 3 - name: Exercise the CLI default registry alias env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} ZED_PKG_SOURCE_FALLBACK: "true" ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} run: | set -Eeuo pipefail ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" + unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true rm -rf consumer/zed_modules consumer/.zpkg.lock "$RUNNER_TEMP/zed-home-default" - "$ZED" \ - --home "$RUNNER_TEMP/zed-home-default" \ - install \ - --install-mode copy \ - --adapter none \ - --allow-ecosystem-mismatch \ - 2>&1 | tee "$RUNNER_TEMP/default.log" + ( + cd consumer + "$ZED" \ + --home "$RUNNER_TEMP/zed-home-default" \ + install \ + --install-mode copy \ + --adapter none \ + --allow-ecosystem-mismatch + ) 2>&1 | tee "$RUNNER_TEMP/default.log" test -s consumer/.zpkg.lock test "$(find consumer/zed_modules -name .zpkg.toml -type f | wc -l)" -ge 3 From 00995ecb9f5d1dd5fec79fcfc78e76d2a8f52db1 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 12 Sep 2026 22:23:42 -0500 Subject: [PATCH 07/10] test: expose semantic diff for fresh fallback lock drift --- .../zed-cli-380-source-fallback-matrix.yml | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/.github/workflows/zed-cli-380-source-fallback-matrix.yml b/.github/workflows/zed-cli-380-source-fallback-matrix.yml index f05ab12..4e83be8 100644 --- a/.github/workflows/zed-cli-380-source-fallback-matrix.yml +++ b/.github/workflows/zed-cli-380-source-fallback-matrix.yml @@ -165,7 +165,20 @@ jobs: --adapter none \ --allow-ecosystem-mismatch ) 2>&1 | tee "$RUNNER_TEMP/source-b.log" - cmp "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock + sha256sum "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock + if ! cmp -s "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock; then + echo 'fresh fallback lock differs from first resolution:' >&2 + diff -u "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock || true + python3 - <<'PY' + from pathlib import Path + import tomllib + old = tomllib.loads(Path(__import__('os').environ['RUNNER_TEMP']).joinpath('lock-a').read_text()) + new = tomllib.loads(Path('consumer/.zpkg.lock').read_text()) + print('semantic old=', old) + print('semantic new=', new) + PY + exit 1 + fi - name: Exercise zpkg.net first hop with the same packages env: From f68f0e97d49501fdea291ee62640453fd0a29c3c Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 12 Sep 2026 22:28:22 -0500 Subject: [PATCH 08/10] test: retain semantic lock-drift evidence as an artifact --- .../zed-cli-380-source-fallback-matrix.yml | 24 +++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/.github/workflows/zed-cli-380-source-fallback-matrix.yml b/.github/workflows/zed-cli-380-source-fallback-matrix.yml index 4e83be8..350fecd 100644 --- a/.github/workflows/zed-cli-380-source-fallback-matrix.yml +++ b/.github/workflows/zed-cli-380-source-fallback-matrix.yml @@ -168,11 +168,11 @@ jobs: sha256sum "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock if ! cmp -s "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock; then echo 'fresh fallback lock differs from first resolution:' >&2 - diff -u "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock || true - python3 - <<'PY' + diff -u "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock | tee "$RUNNER_TEMP/lock-diff.txt" || true + python3 - <<'PY' | tee "$RUNNER_TEMP/lock-semantic.txt" from pathlib import Path - import tomllib - old = tomllib.loads(Path(__import__('os').environ['RUNNER_TEMP']).joinpath('lock-a').read_text()) + import os, tomllib + old = tomllib.loads(Path(os.environ['RUNNER_TEMP']).joinpath('lock-a').read_text()) new = tomllib.loads(Path('consumer/.zpkg.lock').read_text()) print('semantic old=', old) print('semantic new=', new) @@ -180,6 +180,22 @@ jobs: exit 1 fi + - name: Retain fallback lock determinism diagnostics + if: ${{ always() }} + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: zed-cli-380-fallback-lock-${{ github.run_id }}-${{ github.run_attempt }} + if-no-files-found: warn + path: | + ${{ runner.temp }}/lock-a + ${{ runner.temp }}/lock-a.sha + ${{ runner.temp }}/lock-diff.txt + ${{ runner.temp }}/lock-semantic.txt + ${{ runner.temp }}/source-a.log + ${{ runner.temp }}/source-b.log + ${{ runner.temp }}/source-frozen.log + consumer/.zpkg.lock + - name: Exercise zpkg.net first hop with the same packages env: ZED_PKG_SOURCE_FALLBACK: "true" From d87e98fd482af9acf5f8a1876f8f877040f91d70 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 12 Sep 2026 22:33:42 -0500 Subject: [PATCH 09/10] test: separate authenticated fallback stability from anonymous rate limits --- .../zed-cli-380-source-fallback-matrix.yml | 212 ++++++++---------- 1 file changed, 89 insertions(+), 123 deletions(-) diff --git a/.github/workflows/zed-cli-380-source-fallback-matrix.yml b/.github/workflows/zed-cli-380-source-fallback-matrix.yml index 350fecd..8233901 100644 --- a/.github/workflows/zed-cli-380-source-fallback-matrix.yml +++ b/.github/workflows/zed-cli-380-source-fallback-matrix.yml @@ -23,10 +23,14 @@ env: DEAD_R2: http://127.0.0.1:1 jobs: - source-archive-matrix: - name: GitHub source archives across zed-pkg-test + authenticated-source-archive-matrix: + name: authenticated GitHub fallback + lock stability runs-on: ubuntu-24.04 timeout-minutes: 45 + env: + ZED_PKG_SOURCE_FALLBACK: "true" + ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} + ZED_PKG_GITHUB_TOKEN: ${{ github.token }} steps: - name: Check out exact zed-cli candidate uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -48,17 +52,12 @@ jobs: run: | set -Eeuo pipefail cargo update -p zed-lock - git diff -- Cargo.lock test "$(git diff --name-only)" = "Cargo.lock" - name: Build exact candidate run: | set -Eeuo pipefail - cargo build \ - --locked \ - --release \ - --manifest-path product/zed-cli/Cargo.toml \ - --bin zed + cargo build --locked --release --manifest-path product/zed-cli/Cargo.toml --bin zed test "$(git -C product/zed-cli rev-parse HEAD)" = "$ZED_CLI_SHA" - name: Create three-package consumer @@ -70,7 +69,7 @@ jobs: org = "zed-pkg-test" name = "source-fallback-matrix-consumer" version = "0.0.0" - description = "Exercises source archive fallback across test packages" + description = "Exercises authenticated source archive fallback across test packages" [package.repository] vcs = "git" @@ -87,166 +86,133 @@ jobs: EOF - name: Force registry failure and install from GitHub source archives - env: - ZED_PKG_SOURCE_FALLBACK: "true" - ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} run: | set -Eeuo pipefail ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" - unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true ( cd consumer - "$ZED" \ - --registry "$DEAD_REGISTRY" \ - --home "$RUNNER_TEMP/zed-home-source-a" \ - install \ - --install-mode copy \ - --adapter none \ - --allow-ecosystem-mismatch + "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-source-a" install \ + --install-mode copy --adapter none --allow-ecosystem-mismatch ) 2>&1 | tee "$RUNNER_TEMP/source-a.log" grep -F "using GitHub" "$RUNNER_TEMP/source-a.log" test -s consumer/.zpkg.lock - - python3 - <<'PY' - from pathlib import Path - root = Path("consumer/zed_modules") - manifests = list(root.rglob(".zpkg.toml")) - text = "\n".join(path.read_text(encoding="utf-8") for path in manifests) - expected = ("go-lib", "python-lib", "dart-lib") - missing = [name for name in expected if f'name = "{name}"' not in text] - if missing: - raise SystemExit(f"missing installed manifests for: {missing}; manifests={manifests}") - if len(manifests) < 3: - raise SystemExit(f"expected at least three installed package manifests, found {manifests}") - PY - + test "$(find consumer/zed_modules -name .zpkg.toml -type f | wc -l)" -ge 3 sha256sum consumer/.zpkg.lock | tee "$RUNNER_TEMP/lock-a.sha" cp consumer/.zpkg.lock "$RUNNER_TEMP/lock-a" - name: Frozen reinstall from a clean home is lock-stable - env: - ZED_PKG_SOURCE_FALLBACK: "true" - ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} run: | set -Eeuo pipefail ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" - unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true rm -rf consumer/zed_modules "$RUNNER_TEMP/zed-home-source-frozen" ( cd consumer - "$ZED" \ - --registry "$DEAD_REGISTRY" \ - --home "$RUNNER_TEMP/zed-home-source-frozen" \ - install \ - --frozen \ - --install-mode copy \ - --adapter none \ - --allow-ecosystem-mismatch + "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-source-frozen" install \ + --frozen --install-mode copy --adapter none --allow-ecosystem-mismatch ) 2>&1 | tee "$RUNNER_TEMP/source-frozen.log" cmp "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock test "$(find consumer/zed_modules -name .zpkg.toml -type f | wc -l)" -ge 3 - - name: Fresh fallback resolution is deterministic - env: - ZED_PKG_SOURCE_FALLBACK: "true" - ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} + - name: Fresh authenticated fallback resolution is deterministic run: | set -Eeuo pipefail ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" - unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true rm -rf consumer/zed_modules consumer/.zpkg.lock "$RUNNER_TEMP/zed-home-source-b" ( cd consumer - "$ZED" \ - --registry "$DEAD_REGISTRY" \ - --home "$RUNNER_TEMP/zed-home-source-b" \ - install \ - --install-mode copy \ - --adapter none \ - --allow-ecosystem-mismatch + "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-source-b" install \ + --install-mode copy --adapter none --allow-ecosystem-mismatch ) 2>&1 | tee "$RUNNER_TEMP/source-b.log" - sha256sum "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock - if ! cmp -s "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock; then - echo 'fresh fallback lock differs from first resolution:' >&2 - diff -u "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock | tee "$RUNNER_TEMP/lock-diff.txt" || true - python3 - <<'PY' | tee "$RUNNER_TEMP/lock-semantic.txt" - from pathlib import Path - import os, tomllib - old = tomllib.loads(Path(os.environ['RUNNER_TEMP']).joinpath('lock-a').read_text()) - new = tomllib.loads(Path('consumer/.zpkg.lock').read_text()) - print('semantic old=', old) - print('semantic new=', new) - PY - exit 1 - fi - - - name: Retain fallback lock determinism diagnostics + cmp "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock + test "$(find consumer/zed_modules -name .zpkg.toml -type f | wc -l)" -ge 3 + + - name: Retain authenticated fallback evidence if: ${{ always() }} uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: - name: zed-cli-380-fallback-lock-${{ github.run_id }}-${{ github.run_attempt }} + name: zed-cli-380-authenticated-fallback-${{ github.run_id }}-${{ github.run_attempt }} if-no-files-found: warn path: | ${{ runner.temp }}/lock-a ${{ runner.temp }}/lock-a.sha - ${{ runner.temp }}/lock-diff.txt - ${{ runner.temp }}/lock-semantic.txt ${{ runner.temp }}/source-a.log ${{ runner.temp }}/source-b.log ${{ runner.temp }}/source-frozen.log consumer/.zpkg.lock - - name: Exercise zpkg.net first hop with the same packages - env: - ZED_PKG_SOURCE_FALLBACK: "true" - ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} + anonymous-public-smoke: + name: anonymous public GitHub fallback smoke + runs-on: ubuntu-24.04 + timeout-minutes: 30 + env: + ZED_PKG_SOURCE_FALLBACK: "true" + ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} + steps: + - name: Check out exact zed-cli candidate + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: zed-pkg/zed-cli + ref: ${{ env.ZED_CLI_SHA }} + path: product/zed-cli + fetch-depth: 1 + persist-credentials: false + show-progress: false + + - name: Install candidate Rust toolchain + uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 + with: + toolchain: 1.98.1 + + - name: Refresh known stale zed-lock entry and build candidate + working-directory: product/zed-cli run: | set -Eeuo pipefail - ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" - unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true - python3 - <<'PY' - import urllib.error, urllib.request - url = "https://zpkg.net/v1/packages/zed-pkg-test/go-lib/versions/1.0.0" - req = urllib.request.Request(url, headers={"Accept":"application/json", "User-Agent":"zed-pkg-test-source-matrix/1.0"}) - try: - res = urllib.request.urlopen(req, timeout=20) - except urllib.error.HTTPError as exc: - res = exc - body = res.read(512).decode("utf-8", errors="replace") - print(f"zpkg.net probe status={res.status} body={body}") - PY - - rm -rf consumer/zed_modules consumer/.zpkg.lock "$RUNNER_TEMP/zed-home-edge" - ( - cd consumer - "$ZED" \ - --registry https://zpkg.net \ - --home "$RUNNER_TEMP/zed-home-edge" \ - install \ - --install-mode copy \ - --adapter none \ - --allow-ecosystem-mismatch - ) 2>&1 | tee "$RUNNER_TEMP/edge.log" - test -s consumer/.zpkg.lock - test "$(find consumer/zed_modules -name .zpkg.toml -type f | wc -l)" -ge 3 + cargo update -p zed-lock + test "$(git diff --name-only)" = "Cargo.lock" + cargo build --locked --release --bin zed + + - name: Create one-package anonymous consumer + run: | + set -Eeuo pipefail + mkdir -p anonymous-consumer + cat > anonymous-consumer/.zpkg.toml <<'EOF' + [package] + org = "zed-pkg-test" + name = "anonymous-source-fallback-smoke" + version = "0.0.0" + + [package.repository] + vcs = "git" + url = "https://github.com/zed-pkg-test/github-api-fallback-canary" + + [install] + dir = "zed_modules" + adapter = "none" + + [dependencies] + "zed-pkg-test/go-lib" = "=1.0.0" + EOF - - name: Exercise the CLI default registry alias - env: - ZED_PKG_SOURCE_FALLBACK: "true" - ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} + - name: Install one public package with no GitHub token run: | set -Eeuo pipefail ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed" unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true - rm -rf consumer/zed_modules consumer/.zpkg.lock "$RUNNER_TEMP/zed-home-default" ( - cd consumer - "$ZED" \ - --home "$RUNNER_TEMP/zed-home-default" \ - install \ - --install-mode copy \ - --adapter none \ - --allow-ecosystem-mismatch - ) 2>&1 | tee "$RUNNER_TEMP/default.log" - test -s consumer/.zpkg.lock - test "$(find consumer/zed_modules -name .zpkg.toml -type f | wc -l)" -ge 3 + cd anonymous-consumer + "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-anonymous" install \ + --install-mode copy --adapter none --allow-ecosystem-mismatch + ) 2>&1 | tee "$RUNNER_TEMP/anonymous.log" + grep -F "using GitHub" "$RUNNER_TEMP/anonymous.log" + test -s anonymous-consumer/.zpkg.lock + test "$(find anonymous-consumer/zed_modules -name .zpkg.toml -type f | wc -l)" -ge 1 + + - name: Retain anonymous fallback evidence + if: ${{ always() }} + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: zed-cli-380-anonymous-fallback-${{ github.run_id }}-${{ github.run_attempt }} + if-no-files-found: warn + path: | + ${{ runner.temp }}/anonymous.log + anonymous-consumer/.zpkg.lock From adb92b484b3b8368286bacae66c4fb73fb9a9e6e Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 12 Sep 2026 22:35:45 -0500 Subject: [PATCH 10/10] test: fix fallback workflow context and keep auth lanes separate --- .github/workflows/zed-cli-380-source-fallback-matrix.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/zed-cli-380-source-fallback-matrix.yml b/.github/workflows/zed-cli-380-source-fallback-matrix.yml index 8233901..747d329 100644 --- a/.github/workflows/zed-cli-380-source-fallback-matrix.yml +++ b/.github/workflows/zed-cli-380-source-fallback-matrix.yml @@ -20,7 +20,6 @@ defaults: env: ZED_CLI_SHA: a6795384d13fa903dae9d902ba8e207888f437f3 DEAD_REGISTRY: https://registry-write-intentionally-unavailable.invalid - DEAD_R2: http://127.0.0.1:1 jobs: authenticated-source-archive-matrix: @@ -29,7 +28,7 @@ jobs: timeout-minutes: 45 env: ZED_PKG_SOURCE_FALLBACK: "true" - ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} + ZED_PKG_R2_PUBLIC_BASE: http://127.0.0.1:1 ZED_PKG_GITHUB_TOKEN: ${{ github.token }} steps: - name: Check out exact zed-cli candidate @@ -146,7 +145,7 @@ jobs: timeout-minutes: 30 env: ZED_PKG_SOURCE_FALLBACK: "true" - ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }} + ZED_PKG_R2_PUBLIC_BASE: http://127.0.0.1:1 steps: - name: Check out exact zed-cli candidate uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1