recipes: pin the release tag with checkout_sha, not git pull
The daemon regressed from the driver's tag checkout to `git pull --ff-only`,
which builds whatever main is at pull time. Use Bento's checkout_sha(host) so
each host pins to v<version>; the daemon also verifies all hosts agree before
building. Unix recipes only (linux/macos/ios); windows keeps its own path.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
3 files changed,
+12 insertions,
-3 deletions
| 12 |
12 |
|
let r = repo();
|
| 13 |
13 |
|
|
| 14 |
14 |
|
step("checkout");
|
| 15 |
|
- |
sh_ok(h, "cd " + r + " && git pull --ff-only");
|
|
15 |
+ |
// Pin to the release tag v<version> (not whatever main is at pull time); the
|
|
16 |
+ |
// daemon also runs this as a cross-host preflight barrier before any build.
|
|
17 |
+ |
let sha = checkout_sha(h);
|
|
18 |
+ |
log("pinned " + h + " to v" + v + " @ " + sha);
|
| 16 |
19 |
|
|
| 17 |
20 |
|
// Gate: no artifact is built from code that fails clippy or its tests. It runs
|
| 18 |
21 |
|
// on this target's own build host, so a break confined to one platform is
|
| 12 |
12 |
|
let r = repo();
|
| 13 |
13 |
|
|
| 14 |
14 |
|
step("checkout");
|
| 15 |
|
- |
sh_ok(h, "cd " + r + " && git pull --ff-only");
|
|
15 |
+ |
// Pin to the release tag v<version> (not whatever main is at pull time); the
|
|
16 |
+ |
// daemon also runs this as a cross-host preflight barrier before any build.
|
|
17 |
+ |
let sha = checkout_sha(h);
|
|
18 |
+ |
log("pinned " + h + " to v" + v + " @ " + sha);
|
| 16 |
19 |
|
|
| 17 |
20 |
|
// Gate: no artifact is built from code that fails clippy or its tests. It runs
|
| 18 |
21 |
|
// on this target's own build host, so a break confined to one platform is
|
| 13 |
13 |
|
let r = repo();
|
| 14 |
14 |
|
|
| 15 |
15 |
|
step("checkout");
|
| 16 |
|
- |
sh_ok(h, "cd " + r + " && git pull --ff-only");
|
|
16 |
+ |
// Pin to the release tag v<version> (not whatever main is at pull time); the
|
|
17 |
+ |
// daemon also runs this as a cross-host preflight barrier before any build.
|
|
18 |
+ |
let sha = checkout_sha(h);
|
|
19 |
+ |
log("pinned " + h + " to v" + v + " @ " + sha);
|
| 17 |
20 |
|
|
| 18 |
21 |
|
// release-macos.sh: build, sign (ephemeral build keychain), notarize, staple.
|
| 19 |
22 |
|
// Gate: no artifact is built from code that fails clippy or its tests. It runs
|