security: remove legacy publish-state-file write#7892
Merged
Conversation
The dual-write in #7886 was a rollout aid for getsentry/craft#797, which moved the state file out of the repo checkout into $XDG_STATE_HOME/craft/. Craft 2.26.0 is released and getsentry/craft:latest now points at it; Craft reads only the new location. Drop the legacy cwd write, keep only the safe location. The new-write logic is unchanged from what #7886 already exercises in production.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Drops the legacy-location write that #7886 added as a rollout aid for getsentry/craft#797. Craft 2.26.0 ships the new-location read/write and is now live on
getsentry/craft:latest, so the dual-write is no longer needed.Context
$XDG_STATE_HOME/craft/location, so both old and new Craft images could find it during the rollout.Verification
craft 2.26.0binary, seeded a state file at the new location only, rancraft publish 9.9.9against a synthetic repo, and confirmed Craft loggedFound publish state file, resuming from there...and honoured thepublishedfield to skip the target. End-to-end confirmation of the new-location read path with the 2.26.0 binary.python3 -c "import yaml; yaml.safe_load(...)").Diff
8 insertions, 17 deletions: the legacy block is removed, comment updated to name the actual Craft PR (#797) that shipped the reader, and the remaining variables lose their
new_prefix since there's only one location now.Rollback
If something regresses, revert this PR; #7886's dual-write code returns and both locations are written again. Old Craft images would still work off the legacy location.