Download raw Scoop sidecar content from Forgejo attachment URL #1433

New issue

Closed

opened 2026-07-15 12:35:30 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-15 12:35:30 +00:00

Member

Problem

PR #1429 merged for #1420 and changed the Scoop digest helper to follow the release asset browser_download_url, but post-merge release run 8547 / repository run #2266 still fails in bump-scoop-manifest.

Expanded authenticated job-log evidence:

run 8547 (#2266) failure release.yml push release "Make Scoop release digest helper return raw sidecar body (#1429)"
job bump-scoop-manifest, step Write ward.json to the scoop bucket and push
::error::sidecar digest `{"id":4316,"name":"ward-windows-amd64.exe.sha256","size":65,...,"browser_download_url":"https://forgejo.coilysiren.me/attachments/...","type":"attachment"}` is not a 64-hex sha256; refusing to write manifest

The sidecar asset itself is 65 bytes, but the workflow still receives attachment metadata JSON instead of those raw bytes. Following browser_download_url is not sufficient with the helper current request behavior. This is a missed acceptance follow-up for #1420 / #1429.

Acceptance

Make bump-scoop-manifest download the raw body of both 65-byte .sha256 attachment assets and extract the 64-hex digest.
Do not pass API metadata headers or request semantics through to the attachment-content request if Forgejo interprets them as a metadata request.
Preserve the best-effort Scoop token/bucket behavior from #1414.
Add workflow/helper contract coverage that fails when the supposed sidecar body is an attachment metadata object, including after following browser_download_url.
Confirm release.yml succeeds for current release main through bump-scoop-manifest, or leave the exact remaining blocker.

Related: #1420, #1429, run 8547 / #2266.

## Problem PR #1429 merged for #1420 and changed the Scoop digest helper to follow the release asset `browser_download_url`, but post-merge release run 8547 / repository run #2266 still fails in `bump-scoop-manifest`. Expanded authenticated job-log evidence: ```text run 8547 (#2266) failure release.yml push release "Make Scoop release digest helper return raw sidecar body (#1429)" job bump-scoop-manifest, step Write ward.json to the scoop bucket and push ::error::sidecar digest `{"id":4316,"name":"ward-windows-amd64.exe.sha256","size":65,...,"browser_download_url":"https://forgejo.coilysiren.me/attachments/...","type":"attachment"}` is not a 64-hex sha256; refusing to write manifest ``` The sidecar asset itself is 65 bytes, but the workflow still receives attachment metadata JSON instead of those raw bytes. Following `browser_download_url` is not sufficient with the helper current request behavior. This is a missed acceptance follow-up for #1420 / #1429. ## Acceptance * Make `bump-scoop-manifest` download the raw body of both 65-byte `.sha256` attachment assets and extract the 64-hex digest. * Do not pass API metadata headers or request semantics through to the attachment-content request if Forgejo interprets them as a metadata request. * Preserve the best-effort Scoop token/bucket behavior from #1414. * Add workflow/helper contract coverage that fails when the supposed sidecar body is an attachment metadata object, including after following `browser_download_url`. * Confirm `release.yml` succeeds for current release main through `bump-scoop-manifest`, or leave the exact remaining blocker. Related: #1420, #1429, run 8547 / #2266.

coilyco-ops added this to the warded control plane coherence milestone

2026-07-15 12:35:30 +00:00

coilyco-ops added the

headless

labels

2026-07-15 12:35:30 +00:00

coilyco-ops commented

2026-07-15 12:36:08 +00:00

Author

Member

DISPATCH-DEFERRED: capacity blocked. Attempted warded engineer coilyco-flight-deck/ward#1433 --harness codex --workflow pull-request-and-merge from the director surface. Ward rejected the launch because the repository already has 3 active engineers at its limit of 3. No override was used. Retry this exact raw-attachment repair as soon as a slot opens; #1430 is the generic umbrella for the same failed run.

coilyco-ops commented

2026-07-15 12:47:03 +00:00

Author

Member

Superseded by #1430/#1436. The release asset digest dereference chain landed in PR #1436, and release run 8561 succeeded after that merge. Closing this duplicate follow-up for the same Scoop sidecar raw-content failure.

coilyco-ops closed this issue

2026-07-15 12:47:03 +00:00