Unverified Commit 8d78d245 authored by Lemon-miaow's avatar Lemon-miaow
Browse files

fix(updater): 官方仓库 404 不再提示私有仓库

parent 80141dee

internal/updater/github.go

+7 −3
Changes for internal/updater/github.go: 7 added lines, 3 removed lines.
Original line number Diff line number Diff line
@@ -45,7 +45,8 @@ type github struct { 
	// from a private fork, where its absence does not look like an auth failure:

	// GitHub answers 404 — not 401 or 403 — for a private repo the caller cannot see, so

	// "no token" is indistinguishable from "no release published yet" by status alone.

	// latestStable says both in the error rather than making an operator guess.

	// latestStable says both in the error rather than making an operator guess, for any

	// repository other than the official one, which is public.

	//

	// It is read from the environment and never compiled in. A constant would be

	// committed to the very repository it protects, ship inside every felis binary where
@@ -56,7 +57,7 @@ type github struct { 
}



// tokenEnv names the environment variable holding the GitHub credential. deploy/bootstrap.sh

// reads the same variable to clone a private repo, so an operator sets one value once.

// reads the same variable to clone a private fork, so an operator sets one value once.

const tokenEnv = "FELIS_GITHUB_TOKEN"



// newGitHub builds a source pointed at the live GitHub REST API with sane defaults.
@@ -148,7 +149,10 @@ func (g github) latestTag(ctx context.Context, repo string) (string, error) { 
		// 404 is the ambiguous one: GitHub hides a private repo behind it rather than

		// answering 401/403, so an unauthenticated miss and a repo with no stable release

		// are the same status. Name both causes, and name the fix for the one an operator

		// can act on.

		// can act on. The official repository is public, so there only the first applies.

		if resp.StatusCode == http.StatusNotFound && strings.EqualFold(repo, officialRepo) {

			return "", fmt.Errorf("github: %s releases/latest returned HTTP 404 — it has no published stable release", repo)

		}

		if resp.StatusCode == http.StatusNotFound && g.token == "" {

			return "", fmt.Errorf(

				"github: %s releases/latest returned HTTP 404 — either it has no published stable release, or it is private and %s is unset",

internal/updater/github_test.go

+14 −0
Changes for internal/updater/github_test.go: 14 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -223,4 +223,18 @@ func TestGitHubNamesTheTokenOnAnUnauthenticated404(t *testing.T) { 
	if strings.Contains(err.Error(), tokenEnv) {

		t.Errorf("a 404 WITH a token set must not blame the missing token; got: %v", err)

	}



	// The official repository is public: a 404 there means no stable release, whatever

	// the token.

	g.token = ""

	_, err = g.latestStable(context.Background(), "felismc/felis")

	if err == nil {

		t.Fatal("want an error on 404")

	}

	if strings.Contains(err.Error(), tokenEnv) || strings.Contains(err.Error(), "private") {

		t.Errorf("a 404 from the public official repository must not suggest it is private; got: %v", err)

	}

	if !strings.Contains(err.Error(), "no published stable release") {

		t.Errorf("a 404 from the official repository must say it has no stable release; got: %v", err)

	}

}

internal/updater/topology.go

+6 −5
Changes for internal/updater/topology.go: 6 added lines, 5 removed lines.
Original line number Diff line number Diff line
@@ -13,6 +13,9 @@ const ( 
	sourcePostgres                   // postgresql.org/versions.json, within Current's major

)



// officialRepo is Felis's own GitHub repository, which is public.

const officialRepo = "FelisMC/Felis"



// Spec is one platform component's static update policy plus how to find its latest

// upstream version. Current is deliberately NOT here — it is gathered at runtime

// (integration: an image tag, `k3s --version`, a jar manifest) and combined with the
@@ -56,11 +59,9 @@ type Spec struct { 
func Topology() []Spec {

	return []Spec{

		// Felis's own release repo, and the same slug deploy/bootstrap.sh clones from

		// (FELIS_REPO_URL). It is PRIVATE today, which is why the github source carries an

		// optional token: unauthenticated, this coord answers 404 — the status GitHub uses

		// to hide a repo's existence — and felis-api is the one tracked component where

		// that happens. k3s and cloudflared are public and need no credential.

		{Name: "felis-api", Policy: updates.PolicyScheduled, Manageable: true, Source: sourceGitHub, Coord: "FelisMC/Felis"},

		// (FELIS_REPO_URL). It is public, like k3s and cloudflared; the github source's

		// optional token is for a build whose coord names a private fork.

		{Name: "felis-api", Policy: updates.PolicyScheduled, Manageable: true, Source: sourceGitHub, Coord: officialRepo},

		{Name: "k3s", Policy: updates.PolicyNotify, Manageable: false, Source: sourceGitHub, Coord: "k3s-io/k3s"},

		{Name: "cloudflared", Policy: updates.PolicyScheduled, Manageable: true, Source: sourceGitHub, Coord: "cloudflare/cloudflared"},

		{Name: "velocity", Policy: updates.PolicyNotify, Manageable: false, Source: sourcePaperMC, Coord: "velocity"},