DeepSeek/deepseek-harness
1
0
Fork 0
mirror of https://github.com/deepseek-ai/deepseek-harness synced 2026-08-15 21:04:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(release): verify the packed install against the framework it peers on

Browse Source 
The harness packages declare the vendored framework as a peer, so installing
only the dsh tarballs left npm resolving @deepseek-ai/cordis from a private
registry the credential-free pack job cannot reach. The verification now takes
several pack directories and installs every tarball in them, and the dsh
workflow packs the vendored family for that purpose while still publishing only
its own set.

The verification also reads what each tarball declares instead of what the
checkout says, which is what let the process and tarball helpers become one
home each - the three copies of a spawn wrapper were a duplication finding.
This commit is contained in:
imccyu
2026-08-11 00:51:02 +08:00
parent bb489d1325
commit 787443b13f
7 changed files with 182 additions and 124 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
.github/workflows/release.yml vendored
View File

@@ -79,8 +79,14 @@ jobs:
- name: Pack release tarballs
run: pnpm run release:pack --family dsh --out dist/npm
# The harness packages declare the vendored framework as a peer, and this
# job has no credentials for the private registry, so the verification
# installs that family's pack output too. Only dist/npm is published.
- name: Pack the vendored framework for verification
run: pnpm run release:pack --family vendor --out dist/npm-vendor
- name: Verify packed install
run: pnpm run release:verify-packed-install --family dsh --from dist/npm
run: pnpm run release:verify-packed-install --family dsh --from dist/npm --from dist/npm-vendor
- uses: actions/upload-artifact@v4
with: