mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
feat(release): fold distribution back into the source repo
The separate J3vb/OwnCord-releases repo existed only because this repo was private: it carried the AGPL source snapshot and provided a publicly-readable update feed. Once this repo is public both roles collapse into its own Releases page, so the mirror is pure redundancy. - Server/config/config.go: github.repo default OwnCord-releases -> OwnCord. This one default drives both the server self-update and the client auto-update chain (tauri.conf.json updater.endpoints is empty, so the client resolves through the server). No test pinned the old value. - release.yml: drop the mirror step and its RELEASES_REPO_TOKEN guard, whose AGPL/private-repo premise no longer holds. The existing Create GitHub Release step is now the sole publish target. All 31 SHA pins verified intact. - Repoint the README badge/download link, both SECURITY.md links, the server-configuration table and sample, the system-overview diagram node and the CHANGELOG note. SECURITY.md's advisory link is the load-bearing one: left alone it would 404 once the mirror repo is deleted. - README: Go 1.25+ -> 1.26+ (badge and prerequisite) to match the toolchain actually required. Deleting the mirror repo loses nothing: both repos' v1.1.0-alpha.2 carry byte-identical asset sets, signatures and update manifest included. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
J3vb
@@ -421,6 +421,11 @@ jobs:
|
||||
shell: bash
|
||||
run: npx changelogen --output CHANGELOG.md
|
||||
|
||||
# Sole publish target. This repo is public, so its own Releases page both
|
||||
# satisfies AGPL source availability (via the owncord-src snapshot below)
|
||||
# and serves as the publicly-readable feed that deployed servers and
|
||||
# clients poll for updates. The former mirror step to a separate public
|
||||
# releases repo existed only to work around this repo being private.
|
||||
- name: Create GitHub Release
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
@@ -430,29 +435,3 @@ jobs:
|
||||
gh release create "${{ github.ref_name }}" \
|
||||
--notes-file CHANGELOG.md \
|
||||
"${assets[@]}"
|
||||
|
||||
# The public releases repo is what deployed servers and clients poll for
|
||||
# updates, and it carries the AGPL source snapshot while the source repo
|
||||
# is private. Publishing there must never be skipped silently once the
|
||||
# source repo is private.
|
||||
- name: Publish to public releases repo
|
||||
shell: bash
|
||||
env:
|
||||
RELEASES_TOKEN: ${{ secrets.RELEASES_REPO_TOKEN }}
|
||||
SOURCE_REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
if [ -z "$RELEASES_TOKEN" ]; then
|
||||
PRIVATE=$(GH_TOKEN="$SOURCE_REPO_TOKEN" gh api "repos/$GITHUB_REPOSITORY" --jq .private)
|
||||
if [ "$PRIVATE" = "true" ]; then
|
||||
echo "::error::Source repo is private and RELEASES_REPO_TOKEN is unset — binaries would ship with no public source or update feed (AGPL violation, broken updater)."
|
||||
exit 1
|
||||
fi
|
||||
echo "::warning::RELEASES_REPO_TOKEN not set — skipping publish to J3vb/OwnCord-releases."
|
||||
exit 0
|
||||
fi
|
||||
mapfile -t assets < <(find windows linux -type f)
|
||||
assets+=(checksums.sha256 owncord-src-*.tar.gz)
|
||||
GH_TOKEN="$RELEASES_TOKEN" gh release create "${{ github.ref_name }}" \
|
||||
--repo J3vb/OwnCord-releases \
|
||||
--notes-file CHANGELOG.md \
|
||||
"${assets[@]}"
|
||||
|
||||
+3
-3
@@ -9,9 +9,9 @@ behavioural changes operators must know about.
|
||||
|
||||
> **Project reset note:** OwnCord has re-entered alpha. The `v1.0.0` release is
|
||||
> superseded; versioning continues forward as `v1.1.0-alpha.N` so deployed
|
||||
> servers and clients keep receiving updates. Releases are published to the
|
||||
> public [`OwnCord-releases`](https://github.com/J3vb/OwnCord-releases)
|
||||
> repository, including a full source snapshot with every release.
|
||||
> servers and clients keep receiving updates. Releases are published to this
|
||||
> repository's [Releases](https://github.com/J3vb/OwnCord/releases) page,
|
||||
> including a full source snapshot with every release.
|
||||
|
||||
### Phase B — Acceleration
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
[](https://github.com/J3vb/OwnCord/actions/workflows/ci.yml)
|
||||
[](https://github.com/J3vb/OwnCord-releases/releases/latest)
|
||||
[](https://github.com/J3vb/OwnCord/releases/latest)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
[](LICENSE)
|
||||
@@ -65,7 +65,7 @@ It includes real-time messaging, voice/video via LiveKit, file sharing, and a we
|
||||
|
||||
### Option A: Prebuilt binaries
|
||||
|
||||
1. Download assets from [OwnCord-releases](https://github.com/J3vb/OwnCord-releases/releases) (binaries, checksums, signatures, and a full source snapshot per release).
|
||||
1. Download assets from [Releases](https://github.com/J3vb/OwnCord/releases) (binaries, checksums, signatures, and a full source snapshot per release).
|
||||
2. Run the server binary:
|
||||
- Windows: `chatserver.exe`
|
||||
- Linux: `./chatserver`
|
||||
@@ -132,7 +132,7 @@ Two main components:
|
||||
|
||||
### Prerequisites
|
||||
|
||||
- Go 1.25+
|
||||
- Go 1.26+
|
||||
- Node.js 20+
|
||||
- Rust stable (client builds)
|
||||
|
||||
|
||||
+4
-4
@@ -7,7 +7,7 @@ There are no backports.
|
||||
|
||||
| Version | Supported |
|
||||
| ------- | --------- |
|
||||
| Latest release (see [OwnCord-releases](https://github.com/J3vb/OwnCord-releases/releases)) | Yes |
|
||||
| Latest release (see [Releases](https://github.com/J3vb/OwnCord/releases)) | Yes |
|
||||
| Anything older | No |
|
||||
|
||||
## Reporting a vulnerability
|
||||
@@ -15,9 +15,9 @@ There are no backports.
|
||||
**Do not open a public issue for security bugs.**
|
||||
|
||||
Report vulnerabilities privately via GitHub Security Advisories on the
|
||||
[OwnCord-releases](https://github.com/J3vb/OwnCord-releases/security/advisories/new)
|
||||
repository ("Report a vulnerability"). This channel works even while the
|
||||
source repository is private.
|
||||
[OwnCord](https://github.com/J3vb/OwnCord/security/advisories/new)
|
||||
repository ("Report a vulnerability"). Advisories stay private until
|
||||
published, so this channel is safe even though the repository is public.
|
||||
|
||||
Please include:
|
||||
|
||||
|
||||
@@ -230,7 +230,7 @@ func defaults() Config {
|
||||
},
|
||||
GitHub: GitHubConfig{
|
||||
Owner: "J3vb",
|
||||
Repo: "OwnCord-releases",
|
||||
Repo: "OwnCord",
|
||||
},
|
||||
EventPersistence: EventPersistenceConfig{
|
||||
Enabled: true,
|
||||
|
||||
@@ -31,7 +31,7 @@ flowchart LR
|
||||
end
|
||||
|
||||
LK["LiveKit server<br/>(managed subprocess<br/>or external)"]
|
||||
REL["OwnCord-releases<br/>(GitHub, minisign-signed)"]
|
||||
REL["OwnCord releases<br/>(GitHub, minisign-signed)"]
|
||||
|
||||
WV -->|"HTTPS REST<br/>⚠ accepts any cert<br/>(no pinning)"| RTR
|
||||
WSP -->|"WSS, fingerprint-pinned"| HUB
|
||||
|
||||
@@ -74,7 +74,7 @@ For LiveKit options OwnCord does not model, you can take ownership of the auto-s
|
||||
|-----|------|---------|-------------|
|
||||
| `github.token` | string | `""` | Optional GitHub API token for higher rate limits on update checks (5000 req/hr vs 60) |
|
||||
| `github.owner` | string | `"J3vb"` | Owner of the GitHub repository server and client updates are fetched from |
|
||||
| `github.repo` | string | `"OwnCord-releases"` | Public releases repository. Must stay publicly readable — both the server self-update and the client auto-update chain fetch release assets from it |
|
||||
| `github.repo` | string | `"OwnCord"` | Repository whose releases carry update assets. Must stay publicly readable — both the server self-update and the client auto-update chain fetch release assets from it |
|
||||
|
||||
### Event Persistence (`event_persistence`)
|
||||
|
||||
@@ -208,7 +208,7 @@ voice:
|
||||
github:
|
||||
token: "" # optional GitHub PAT for update check rate limits
|
||||
owner: "J3vb" # update source repo owner
|
||||
repo: "OwnCord-releases" # public releases repo (binaries + source snapshots)
|
||||
repo: "OwnCord" # repo holding release assets (binaries + source snapshots)
|
||||
|
||||
# Event persistence (tiered reconnect replay)
|
||||
event_persistence:
|
||||
|
||||
Reference in New Issue
Block a user