From 9db7699c247fc32bd94200fbb51797d00ca7ecae Mon Sep 17 00:00:00 2001 From: abrichr Date: Mon, 27 Jul 2026 21:18:41 -0400 Subject: [PATCH] fix: regenerate platform manifest for openadapt-flow 1.25.1 `platform-manifest.json` advertised flow 1.24.0 and its sha256 digests while PyPI's latest was 1.25.1, so `validate-platform-manifest` failed on `main` and on every PR. The manifest is served publicly from raw.githubusercontent and is OpenAdapt's only cryptographic claim about the current release, so while it is stale anyone verifying a downloaded wheel against it fails. Regenerated with `scripts/generate_platform_manifest.py`. Both new digests were independently confirmed by downloading the artifacts from PyPI and hashing the bytes, not just by trusting the generator's read of the JSON API: 375c516837a44bc8bea87ba0429967f92561d6df92eef41e624f55c281bed9ae wheel 15393bb978283e87f043e6fa5f05d7b1d3fc0f9a497a4cf9561a23e8fc5f76ac sdist pyproject.toml pins flow by range (>=1.20.1,<2.0.0), so no pin change is needed; the manifest records the published version. Why it drifted, and why it will drift again ------------------------------------------- The launcher's own release workflow regenerates the manifest, so launcher releases self-heal. Component releases do not. This workflow declares a `component-released` `repository_dispatch` receiver and its comment stated the sending side was already a one-step `gh api ... /dispatches` in the component release workflows. That is false: none of openadapt-flow, openadapt-capture or openadapt-desktop has such a step. The receiver has no sender, so the daily cron is the only automatic detector. Flow published 1.25.0 and then 1.25.1 on 2026-07-27, hours after the manifest was last regenerated at 15:42 that day and hours after the 06:17 cron, which is why this landed as a red `main` rather than as a drift issue. The false comment is corrected here, in the workflow and in docs/platform-manifest.md, so the open loop is visible instead of looking closed. The fix itself is deliberately not attempted in this PR: a cross-repository dispatch cannot use a component repo's own GITHUB_TOKEN and needs a `contents: write` token provisioned as a secret in three repositories, which is a credential decision. Auto-opening a regeneration PR is separately impossible today because Actions is not permitted to create pull requests in this repository (`can_approve_pull_request_reviews: false`); adding that job would produce a permanently red check rather than a fix. Note: https://openadapt.ai/status.json (openadapt-web) is also still on flow 1.24.0. The validator treats that as a WARNING, not an error, so it does not block, but it is the same drift on a second public surface. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01NyCHrzA1psrKMFfroYbzaM --- .github/workflows/platform-manifest.yml | 27 ++++++++++++++++++++++--- docs/platform-manifest.md | 17 +++++++++++++--- platform-manifest.json | 16 +++++++-------- 3 files changed, 46 insertions(+), 14 deletions(-) diff --git a/.github/workflows/platform-manifest.yml b/.github/workflows/platform-manifest.yml index 8ac86c99c..1bccba23c 100644 --- a/.github/workflows/platform-manifest.yml +++ b/.github/workflows/platform-manifest.yml @@ -22,9 +22,30 @@ on: - cron: '17 6 * * *' workflow_dispatch: # Receiver for a component repository to announce its release immediately - # rather than waiting for the daily sweep. The sending side is a one-step - # `gh api repos/OpenAdaptAI/OpenAdapt/dispatches -f event_type=component-released` - # in openadapt-flow/-capture/-desktop's release workflow. + # rather than waiting for the daily sweep. + # + # NOT YET WIRED: as of 2026-07-28 no component repository sends this. None of + # openadapt-flow, -capture, or -desktop has a dispatch step in its release + # workflow, so the daily cron above is in practice the ONLY thing that + # notices a component release. That is how flow 1.25.0 and 1.25.1 published + # on 2026-07-27 after the manifest was regenerated at 15:42 that day and the + # manifest went stale again within hours, red on every PR until someone + # regenerated by hand. + # + # The sending side would be one step in each component's release workflow: + # gh api repos/OpenAdaptAI/OpenAdapt/dispatches -f event_type=component-released + # It cannot use that repository's default GITHUB_TOKEN, which is scoped to + # its own repository; cross-repository dispatch needs a token with `contents: + # write` on OpenAdaptAI/OpenAdapt stored as a secret in each component repo. + # Provisioning that secret is a credential decision, not a code change, so it + # is tracked outside this file rather than half-implemented here. + # + # Note that even a wired sender only makes DETECTION immediate. Repair stays + # manual: this workflow validates and files an issue, it does not regenerate. + # Auto-opening a fix PR is currently impossible anyway -- Actions is not + # permitted to create pull requests in this repository + # (`can_approve_pull_request_reviews: false`), so such a job would be + # permanently red rather than helpful. repository_dispatch: types: [component-released] diff --git a/docs/platform-manifest.md b/docs/platform-manifest.md index 677a41aae..3b1125171 100644 --- a/docs/platform-manifest.md +++ b/docs/platform-manifest.md @@ -54,9 +54,20 @@ python scripts/validate_platform_manifest.py CI runs this on every pull request, on pushes to `main`, and DAILY (`.github/workflows/platform-manifest.yml`), so drift between the committed -manifest and the actually published artifacts fails loudly. A component -repository can also trigger the check immediately via a -`component-released` `repository_dispatch`. +manifest and the actually published artifacts fails loudly. + +The workflow also accepts a `component-released` `repository_dispatch` so a +component repository can trigger the check immediately. **No component +repository sends it yet.** `openadapt-flow`, `openadapt-capture`, and +`openadapt-desktop` have no dispatch step in their release workflows, so the +daily cron is in practice the only automatic detector, and a component release +can serve stale digests for up to a day. Wiring the sender needs a token with +`contents: write` on `OpenAdaptAI/OpenAdapt` stored as a secret in each +component repository; the component's own `GITHUB_TOKEN` cannot dispatch +across repositories. + +Detection is not repair. Both the cron and a dispatched run validate and file +an issue; regenerating and committing the manifest remains a human step. ### Why the schedule is daily and why false reds are not tolerated diff --git a/platform-manifest.json b/platform-manifest.json index c158453af..034596951 100644 --- a/platform-manifest.json +++ b/platform-manifest.json @@ -1,7 +1,7 @@ { "manifest_kind": "openadapt-platform-release-manifest", "schema_version": "1.0.0", - "generated_at": "2026-07-27T15:42:27+00:00", + "generated_at": "2026-07-28T01:16:50+00:00", "release_channel": "beta", "components": { "launcher": { @@ -26,21 +26,21 @@ }, "flow": { "package": "openadapt-flow", - "version": "1.24.0", + "version": "1.25.1", "source": "pypi", "requires_python": "<3.13,>=3.10", "artifacts": [ { "type": "bdist_wheel", - "filename": "openadapt_flow-1.24.0-py3-none-any.whl", - "url": "https://files.pythonhosted.org/packages/12/fb/86a58376c9bb7e587c45f3d1a149486053efb0ae86069b46d7581696983a/openadapt_flow-1.24.0-py3-none-any.whl", - "sha256": "170fdac154794292c99dc6eea6486e7a2c3fdf321bcd87976d924bccd3db4aef" + "filename": "openadapt_flow-1.25.1-py3-none-any.whl", + "url": "https://files.pythonhosted.org/packages/fa/b3/f68ec073b32374d9208fcc67faff70e90f974ed6ac327d3d2bd72cc4fdd4/openadapt_flow-1.25.1-py3-none-any.whl", + "sha256": "375c516837a44bc8bea87ba0429967f92561d6df92eef41e624f55c281bed9ae" }, { "type": "sdist", - "filename": "openadapt_flow-1.24.0.tar.gz", - "url": "https://files.pythonhosted.org/packages/4c/db/5b570f6511bcaed68134be094e9fc2b745f4f77c3cadf13a5d7518ac883f/openadapt_flow-1.24.0.tar.gz", - "sha256": "2d4702e5ccbdfed0f78063ca510dc82894a2833edbed71d77edffbd0ffebd67d" + "filename": "openadapt_flow-1.25.1.tar.gz", + "url": "https://files.pythonhosted.org/packages/f2/4a/b29ee9880970bc45bcf966dcee2dcacd1fc0412cf0581cb629011273ef14/openadapt_flow-1.25.1.tar.gz", + "sha256": "15393bb978283e87f043e6fa5f05d7b1d3fc0f9a497a4cf9561a23e8fc5f76ac" } ] },