mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 20:53:06 +00:00
Oliver Kieselbach
91f9d656ae
The scripts behind download.autopilotmonitor.com/agent/ rotated only on a publish_as_stable run of build-agent.yml, so a bootstrap fix sat unpublished until the next agent cutover -- while the WDP bootstrap MSI downloads the published copy on every enrolling device. Publish-BootstrapScripts.ps1 becomes the single owner of the chain: dev render with anchor check, $ScriptVersion bump guard, uploads (eu + fail-soft legacy mirror, no-cache), the two version oracles, and verification through the alias. publish-scripts.yml calls it on every push to main touching the sources; the publish_as_stable branch of build-agent.yml calls the same code, so a release still lands a consistent set. Blobs are published in a deterministic CRLF/UTF-8-without-BOM form. Git normalises line endings on checkout, so raw working-copy bytes would differ per environment and make every byte comparison -- guard and verify alike -- depend on where the workflow ran. The form reproduces the currently published bytes exactly. The Pester (PS 5.1) and ASCII gates move into the reusable bootstrap-script-gates.yml and now block the upload; pester.yml keeps the pull-request view and drops its push trigger. AdminConfiguration .LatestBootstrapV2ScriptVersion gets exactly one writer. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
57 lines
1.9 KiB
YAML
57 lines
1.9 KiB
YAML
name: Publish customer scripts
|
|
|
|
# Keeps the scripts behind download.autopilotmonitor.com/agent/ current WITHOUT waiting
|
|
# for an agent release. Before this workflow existed, the script blobs rotated only on a
|
|
# publish_as_stable run of build-agent.yml, so a bootstrap fix sat unpublished until the
|
|
# next agent cutover -- while the WDP bootstrap MSI downloads the published copy on every
|
|
# enrolling device.
|
|
#
|
|
# Same publish code as the release path (.github/scripts/Publish-BootstrapScripts.ps1);
|
|
# this workflow only supplies a second trigger for it.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'scripts/Bootstrap/**'
|
|
- 'scripts/CustomerSetup/**'
|
|
- '.github/scripts/Publish-BootstrapScripts.ps1'
|
|
workflow_dispatch:
|
|
inputs:
|
|
dry_run:
|
|
description: 'Run every check and report drift, upload nothing'
|
|
required: true
|
|
type: boolean
|
|
default: false
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
# Shared with build-agent.yml: a script publish and an agent release both touch
|
|
# version.json, and the bootstrapVersion read-modify-write must not interleave with the
|
|
# release writing its agent fields. Never cancel -- a half-published set is worse than a queue.
|
|
concurrency:
|
|
group: agent-blob-publish
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
gates:
|
|
uses: ./.github/workflows/bootstrap-script-gates.yml
|
|
|
|
publish:
|
|
name: Publish to the download alias
|
|
needs: gates
|
|
runs-on: windows-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Publish bootstrap + customer scripts
|
|
shell: pwsh
|
|
run: |
|
|
$dryRun = '${{ inputs.dry_run }}' -eq 'true'
|
|
./.github/scripts/Publish-BootstrapScripts.ps1 `
|
|
-SasToken '${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}' `
|
|
-LegacySasToken '${{ secrets.AZURE_BLOB_AGENT_LEGACY_SAS_TOKEN }}' `
|
|
-TableSasToken '${{ secrets.AZURE_TABLE_ADMIN_SAS_TOKEN }}' `
|
|
-DryRun:$dryRun
|