Skip to content

Harden OHOS unsigned hap dependency resolution against mirror hash mismatches - #191

Merged
HeZeBang merged 3 commits into
masterfrom
copilot/fix-ohos-unsigned-hap-job-failure
Nov 10, 2026
Merged

HeZeBang merged 3 commits into
masterfrom
copilot/fix-ohos-unsigned-hap-job-failure

Conversation

Copilot AI commented Nov 10, 2026 •

Copy link
Copy Markdown
Contributor

The OHOS unsigned hap / Build unsigned hap job was failing before build steps due to intermittent package integrity mismatches from the configured pub mirror (pub.flutter-io.cn). This change keeps the normal mirror path but adds a targeted fallback so release jobs can proceed when that specific mirror failure occurs.

  • Problem scope

    • Failure occurred in Resolve dependencies (flutter pub get) with wrong content-hash, causing the OHOS workflow to abort before Build unsigned hap.
  • Workflow change (.github/workflows/ohos-release.yml)

    • Switched dependency resolution to flutter pub get --enforce-lockfile.
    • Wrapped the step in failure-aware logic:
      • first attempt uses current mirror configuration (unchanged default behavior),
      • if logs contain wrong content-hash, retry once with PUB_HOSTED_URL=https://pub.dev,
      • otherwise fail as before.
  • Why this is minimal

    • No changes to build scripts, release asset flow, or other platform workflows.
    • Behavior changes only on the known integrity-mismatch error signature.
- name: Resolve dependencies
  run: |
    log_file="$(mktemp)"
    if flutter pub get --enforce-lockfile 2>&1 | tee "$log_file"; then
      exit 0
    fi
    if grep -q 'wrong content-hash' "$log_file"; then
      PUB_HOSTED_URL=https://pub.dev flutter pub get --enforce-lockfile
      exit 0
    fi
    exit 1

Co-authored-by: HeZeBang <27360275+HeZeBang@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix failing GitHub Actions job for OHOS unsigned hap Harden OHOS unsigned hap dependency resolution against mirror hash mismatches Nov 10, 2026
Copilot AI requested a review from HeZeBang November 10, 2026 06:24
@HeZeBang
HeZeBang marked this pull request as ready for review November 10, 2026 13:04
The first version of this fallback could not have worked, in either branch:

- `PUB_HOSTED_URL=https://pub.dev` alone changes nothing, because pub reads
  each package's host from `pubspec.lock` — the retry would keep talking to
  the mirror that just failed.
- `--enforce-lockfile` on that same lock refuses the retry, and dropping the
  flag re-resolves: measured against pub.dev, `xml` 6.5.0 became 7.0.1, so a
  "recovery" would have shipped packages the lock does not name.
- It was also gated on `wrong content-hash`, while the outage's other half is
  `Package not available (could not find package qr_flutter ...)` — mirror
  metadata whose `archive_url` 404s.

So retry on any failure, after rewriting the host in the lock, and prove the
retry did not move a version: every line except `url:` must be byte-identical,
or the step fails rather than build against a drifted resolution. The host
goes into `$GITHUB_ENV` too, since the build steps resolve again.

Verified locally against the live mirror: the failing path emits the warning,
`seds` 125 hosts, resolves on pub.dev, keeps `xml` 6.5.0, and writes both
variables to `$GITHUB_ENV`; the happy path leaves the lock untouched.
@HeZeBang
HeZeBang merged commit 9b0c7ce into master Nov 10, 2026
1 check passed
@HeZeBang
HeZeBang deleted the copilot/fix-ohos-unsigned-hap-job-failure branch November 10, 2026 13:34
@github-project-automation github-project-automation Bot moved this from Backlog to Done in TechPie Nov 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

2 participants