fix build github action after version addition
What the developer wrote
Authored by newtonick
fix build github action after version addition
What changed, and why it matters
This commit fixes the project's automated build process after adding a new version-tracking feature. It moves file cleanup from the GitHub Actions workflow into the build script so the script can read git history and tools, and adds a check to make sure a version.json file was created. If version.json is missing or incomplete, the app would freeze at startup; the new check prevents publishing such broken images. This is a build-pipeline reliability fix, not a direct security patch.
No immediate security action required. Review the related seedsigner-os build.sh changes to confirm delete_unnecessary_files runs after version.json is written and that version.json schema validation is consistent. Monitor future CI runs for the new verification step.
Security signals we found
Prevents publication of broken firmware images that fail to boot past splash screen
Adds build-time integrity check for generated version metadata
Changes file deletion timing to preserve build tooling and git metadata needed for reproducible version generation
Evidence from the diff
The change modifies .github/workflows/build.yml. It removes an inline ‘delete unnecessary files’ step that stripped everything except src/ from the rootfs overlay, because the new seedsigner-os build.sh needs .git/ and tools/ to generate version.json. It also adds a verify version.json step that uses jq to ensure required fields (name, fork, short_commit_hash, timestamp) are present, failing the build otherwise. This prevents shipping images that would cause the app to raise an exception at the splash screen.
Changed components
.github/workflows/build.ymlseedsigner-os build.sh (referenced but not modified in this commit)version.json generation and verificationInspect captured patch +12 / −9
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 94770cb..90a04ec 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -83,15 +83,9 @@ jobs:
echo "img_version=os${os_version}_sw${source_version}"| tee -a $GITHUB_ENV
fi
- - name: delete unnecessary files
- # The seedsigner-os buildroot overlay only needs src/; drop everything
- # else from the seedsigner checkout (tests, docs, tooling, .git, etc.)
- # to keep the overlay minimal.
- run: |
- cd seedsigner-os/opt/rootfs-overlay/opt
- find . -mindepth 1 -maxdepth 1 ! -name src -exec rm -rf {} +
- ls -la .
- ls -la src
+ # NOTE: trimming the overlay down to src/ is deliberately left to seedsigner-os
+ # build.sh (delete_unnecessary_files). It needs the .git/ and tools/ we would
+ # otherwise delete here in order to write version.json first.
- name: restore build cache
uses: actions/cache@v4
@@ -125,6 +119,15 @@ jobs:
--${{ matrix.target }} --skip-repo --no-clean
sudo chown -R $USER:$USER seedsigner-os/images seedsigner-os/buildroot_dl ~/.buildroot-ccache/
+ # version.json is written by seedsigner-os build.sh. If it is missing or has a
+ # null field the app raises at the splash screen, which looks like an
+ # unrecoverable boot hang, so fail the build rather than publish the image.
+ - name: verify version.json
+ working-directory: seedsigner-os/opt/rootfs-overlay/opt
+ run: |
+ cat src/seedsigner/version.json
+ jq -e '.name and .fork and .short_commit_hash and .timestamp' src/seedsigner/version.json
+
- name: list image (before rename)
run: |
ls -la seedsigner-os/images
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.