CI workaround for github actions runner

Stack Wallet/Stack Wallet

bad423c8 View source ↗

Public commit record

What the developer wrote

Authored by Dan Miller

45/100 · Thin

CI workaround for github actions runner

✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body

The short version

What changed, and why it matters

This commit is a routine GitHub Actions CI maintenance change. It adds the 'staging' branch to automated build triggers and fixes a Windows build problem where the CI runner could not create symbolic links (shortcuts) for app assets, so the workflow now copies those asset folders instead. There is no indication this affects user security or wallet safety.

Recommended action

No security action required. Review as normal CI/DevOps change.

Security signals we found

No strong security signals were identified.

Technical analysis

Evidence from the diff

The diff modifies .github/workflows/build.yaml only. It adds ‘staging’ to push triggers, refactors version/build-number logic to handle three cases (tag, manual input, staging branch defaulting to 0.0.0-staging.), and adds a Windows job step that removes symlinks/junctions under assets/ and copies real directories from asset_sources/ because the windows-2022 runner lacks SeCreateSymbolicLinkPrivilege. No application source code, cryptography, or secrets handling changed.

Changed components

.github/workflows/build.yaml

Inspect captured patch +42 / −6

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 01ec833..c0ba058 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -4,6 +4,8 @@ on:
   push:
     tags:
       - 'v[0-9]+.[0-9]+.[0-9]+'
+    branches:
+      - staging
   workflow_dispatch:
     inputs:
       version:
@@ -40,9 +42,12 @@ jobs:
             VERSION="${{ github.ref_name }}"
             VERSION="${VERSION#v}"
             BUILD_NUMBER="${{ github.run_number }}"
-          else
+          elif [ -n "${{ inputs.version }}" ]; then
             VERSION="${{ inputs.version }}"
             BUILD_NUMBER="${{ inputs.build_number }}"
+          else
+            VERSION="0.0.0-staging.${{ github.run_number }}"
+            BUILD_NUMBER="${{ github.run_number }}"
           fi
           echo "version=${VERSION}" >> $GITHUB_OUTPUT
           echo "build_number=${BUILD_NUMBER}" >> $GITHUB_OUTPUT
@@ -114,9 +119,12 @@ jobs:
             VERSION="${{ github.ref_name }}"
             VERSION="${VERSION#v}"
             BUILD_NUMBER="${{ github.run_number }}"
-          else
+          elif [ -n "${{ inputs.version }}" ]; then
             VERSION="${{ inputs.version }}"
             BUILD_NUMBER="${{ inputs.build_number }}"
+          else
+            VERSION="0.0.0-staging.${{ github.run_number }}"
+            BUILD_NUMBER="${{ github.run_number }}"
           fi
           echo "version=${VERSION}" >> $GITHUB_OUTPUT
           echo "build_number=${BUILD_NUMBER}" >> $GITHUB_OUTPUT
@@ -209,9 +217,12 @@ jobs:
             VERSION="${{ github.ref_name }}"
             VERSION="${VERSION#v}"
             BUILD_NUMBER="${{ github.run_number }}"
-          else
+          elif [ -n "${{ inputs.version }}" ]; then
             VERSION="${{ inputs.version }}"
             BUILD_NUMBER="${{ inputs.build_number }}"
+          else
+            VERSION="0.0.0-staging.${{ github.run_number }}"
+            BUILD_NUMBER="${{ github.run_number }}"
           fi
           echo "version=${VERSION}" >> $GITHUB_OUTPUT
           echo "build_number=${BUILD_NUMBER}" >> $GITHUB_OUTPUT
@@ -236,6 +247,25 @@ jobs:
             -b "${{ steps.ver.outputs.build_number }}" \
             -p windows -a stack_wallet -d -s
 
+      # The Actions windows-2022 runner user lacks SeCreateSymbolicLinkPrivilege,
+      # so link_assets.sh's mklink /D calls either fail or produce broken reparse
+      # points that Flutter's asset resolver cannot traverse. Replace each of
+      # the five gitignored asset directories with real copies instead.
+      - name: Replace asset symlinks with copies (CI workaround)
+        run: |
+          set -euo pipefail
+          for dirname in default_themes icon lottie in_app_logo_icons svg; do
+            target="assets/${dirname}"
+            source="asset_sources/${dirname}/stack_wallet"
+            # Remove whatever link_assets.sh left (reparse point, symlink, or nothing).
+            # cmd.exe rmdir on a junction/symlink removes the link, not the target.
+            if [ -e "$target" ] || [ -L "$target" ]; then
+              cmd.exe /c rmdir "$(cygpath -w "$target")" 2>/dev/null || rm -rf "$target"
+            fi
+            mkdir -p "$target"
+            cp -r "${source}/." "$target/"
+          done
+
       - name: Get dependencies
         run: flutter pub get
 
@@ -306,9 +336,12 @@ jobs:
             VERSION="${{ github.ref_name }}"
             VERSION="${VERSION#v}"
             BUILD_NUMBER="${{ github.run_number }}"
-          else
+          elif [ -n "${{ inputs.version }}" ]; then
             VERSION="${{ inputs.version }}"
             BUILD_NUMBER="${{ inputs.build_number }}"
+          else
+            VERSION="0.0.0-staging.${{ github.run_number }}"
+            BUILD_NUMBER="${{ github.run_number }}"
           fi
           echo "version=${VERSION}" >> $GITHUB_OUTPUT
           echo "build_number=${BUILD_NUMBER}" >> $GITHUB_OUTPUT
@@ -380,9 +413,12 @@ jobs:
             VERSION="${{ github.ref_name }}"
             VERSION="${VERSION#v}"
             BUILD_NUMBER="${{ github.run_number }}"
-          else
+          elif [ -n "${{ inputs.version }}" ]; then
             VERSION="${{ inputs.version }}"
             BUILD_NUMBER="${{ inputs.build_number }}"
+          else
+            VERSION="0.0.0-staging.${{ github.run_number }}"
+            BUILD_NUMBER="${{ github.run_number }}"
           fi
           echo "version=${VERSION}" >> $GITHUB_OUTPUT
           echo "build_number=${BUILD_NUMBER}" >> $GITHUB_OUTPUT

Risk score

Why this scored 15/100

Our methodology →

Potential impact 0/30

Exploitability 0/25

Stealth signal 0/15

Affected reach 0/15

Confidence 10/10

Evidence quality 5/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 15/100

Community notes

Related watches

Merge pull request #1469 from Cyrix126/building_dialog_cancel

Merge branch 'staging' into building_dialog_cancel

Merge pull request #1468 from Cyrix126/desktop_fee_form_refetch