fix: validate ARMv6 upgrades and publish rolling development bundles

scripts/publish-upgrade-bundles.cjs

@@ -13,7 +13,6 @@ const platforms = [
   'linux-s390x-musl',
   'linux-ia32-musl',
   'linux-x64-glibc',
-  'linux-armv6-glibc',
   'linux-armv7-glibc',
   'linux-arm64-glibc',
   'linux-ppc64-glibc',
@@ -61,20 +60,14 @@ function publishBundles({
   branch,
   version,
   buildId,
-  allowDevelopment = false,
   gh = (...args) =>
     execFileSync('gh', args, {
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'pipe'],
     }),
 }) {
-  if (
-    branch !== 'master' &&
-    !(branch === 'develop' && allowDevelopment === true)
-  )
-    throw new Error(
-      'Only master or explicitly requested development images publish bundles',
-    );
+  if (!['master', 'develop'].includes(branch))
+    throw new Error('Only master or develop images publish bundles');
   if (!/^\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?$/.test(version || ''))
     throw new Error('Invalid bundle version');
   if (!/^\d+-\d+$/.test(buildId || ''))
@@ -226,6 +219,45 @@ function publishBundles({
       '--clobber',
     );
     gh('release', 'edit', ref, '--repo', repository, '--notes', notes);
+    if (
+      !matches(
+        lookup(ref)?.assets.find((a) => a.name === 'latest.json'),
+        path.join(directory, 'latest.json'),
+      )
+    )
+      throw new Error('Published channel index verification failed');
+  }
+  // Only prune development releases after the complete new batch and its
+  // channel pointer are verified. Production versions and aliases are retained.
+  if (development && currentSource()) {
+    const pages = JSON.parse(
+      gh(
+        'api',
+        `repos/${repository}/releases?per_page=100`,
+        '--paginate',
+        '--slurp',
+      ),
+    );
+    for (const release of pages.flat()) {
+      if (
+        release.tag_name !== tag &&
+        /^upgrade-build-develop-v\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?-\d+-\d+$/.test(
+          release.tag_name,
+        ) &&
+        release.prerelease === true &&
+        release.draft === false
+      ) {
+        if (!currentSource()) break;
+        gh(
+          'release',
+          'delete',
+          release.tag_name,
+          '--repo',
+          repository,
+          '--yes',
+        );
+      }
+    }
   }
   return true;
 }
@@ -246,8 +278,5 @@ if (require.main === module) {
     branch,
     version,
     buildId: `${process.env.GITHUB_RUN_ID}-${process.env.GITHUB_RUN_ATTEMPT}`,
-    allowDevelopment:
-      process.env.GITHUB_EVENT_NAME === 'workflow_dispatch' &&
-      process.env.QL_BUILD_DEVELOPMENT_BUNDLES === 'true',
   });
 }

scripts/verify-panel-package.cjs

@@ -29,8 +29,9 @@ const requiredFiles = [
   'shell/preload/esm-loader.mjs', 'shell/preload/notificationAudit.js',
   'sample/config.sample.sh', 'sample/auth.sample.json',
   'static/build-info.json', 'static/build/app.js', 'static/build/token.js',
-  'static/build/bootstrap/upgradeProbe.js', 'static/dist/index.html',
-  ...['upgradeArtifacts', 'platformBundle', 'upgradePrestart', 'panelUpgrade']
+  'static/build/bootstrap/upgradeProbe.js',
+  'static/dist/index.html',
+  ...['upgradeArtifacts', 'platformBundle', 'upgradePrestart', 'panelUpgrade', 'nodeRuntime']
     .map((name) => `cli/src/internal/maintenance/${name}.cjs`),
 ];
 

scripts/wait-for-mirror.sh

@@ -47,7 +47,19 @@ fi
 for requested_ref in "${refs[@]}"; do
   git check-ref-format "$requested_ref"
 done
-command -v timeout >/dev/null || { echo 'GNU timeout is required' >&2; exit 2; }
+# Ubuntu 26.04's default timeout is from uutils. We require GNU's process-group
+# termination so git transport children cannot keep the query pipes open.
+timeout_command=''
+for candidate in timeout gnutimeout gtimeout; do
+  if version=$("$candidate" --version 2>/dev/null) && [[ "$version" == *'(GNU coreutils)'* ]]; then
+    timeout_command=$candidate
+    break
+  fi
+done
+if [[ -z "$timeout_command" ]]; then
+  echo 'GNU timeout is required (timeout, gnutimeout or gtimeout)' >&2
+  exit 2
+fi
 if [[ -n "$notify_repo" ]]; then
   if [[ ! "$notify_repo" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; then
     echo 'QL_MIRROR_NOTIFY_REPO must be a GitHub owner/repository' >&2
@@ -62,7 +74,7 @@ notification_command() {
   local budget=$((notification_deadline - SECONDS))
   if (( budget <= 0 )); then return 1; fi
   if (( budget > 10 )); then budget=10; fi
-  timeout --signal=KILL "${budget}s" "$@"
+  "$timeout_command" --signal=KILL "${budget}s" "$@"
 }
 
 notify_static_mirror() {
@@ -156,7 +168,7 @@ while (( SECONDS < wait_seconds )); do
     fi
     budget=$query_timeout
     if (( budget > remaining )); then budget=$remaining; fi
-    if ! output=$(timeout --signal=KILL "${budget}s" git ls-remote --refs \
+    if ! output=$("$timeout_command" --signal=KILL "${budget}s" git ls-remote --refs \
       "${urls[$index]}" "${refs[@]}" | LC_ALL=C sort); then
       echo "::warning::Could not read ${labels[$index]} refs on attempt $attempt; retrying"
       ready=false