From c32ee210f7f785a7c5b4b13baf254c76206fc843 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 10 Nov 2026 06:20:40 +0000 Subject: [PATCH 1/3] Initial plan From a6dbdf3f1200ca4b99412cf3db7f3932fadf2939 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 10 Nov 2026 06:22:45 +0000 Subject: [PATCH 2/3] fix(ohos-release): retry pub get via pub.dev on mirror hash mismatch Co-authored-by: HeZeBang <27360275+HeZeBang@users.noreply.github.com> --- .github/workflows/ohos-release.yml | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ohos-release.yml b/.github/workflows/ohos-release.yml index d608eb1f..b215fd91 100644 --- a/.github/workflows/ohos-release.yml +++ b/.github/workflows/ohos-release.yml @@ -112,7 +112,21 @@ jobs: - uses: ./.github/actions/pub-cache - name: Resolve dependencies - run: flutter pub get + run: | + set -euo pipefail + + log_file="$(mktemp)" + if flutter pub get --enforce-lockfile 2>&1 | tee "$log_file"; then + exit 0 + fi + + if grep -q 'wrong content-hash' "$log_file"; then + echo "::warning::Mirror returned a package with the wrong content hash. Retrying with https://pub.dev." + PUB_HOSTED_URL=https://pub.dev flutter pub get --enforce-lockfile + exit 0 + fi + + exit 1 - name: Build unsigned hap run: scripts/build-unsigned-hap.sh From 589e9832da1e83fad12ba3a14248d7c198b3f436 Mon Sep 17 00:00:00 2001 From: ZAMBAR Date: Tue, 10 Nov 2026 21:27:58 +0800 Subject: [PATCH 3/3] fix(ohos-release): rewrite the lock's host before retrying on pub.dev MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The first version of this fallback could not have worked, in either branch: - `PUB_HOSTED_URL=https://pub.dev` alone changes nothing, because pub reads each package's host from `pubspec.lock` — the retry would keep talking to the mirror that just failed. - `--enforce-lockfile` on that same lock refuses the retry, and dropping the flag re-resolves: measured against pub.dev, `xml` 6.5.0 became 7.0.1, so a "recovery" would have shipped packages the lock does not name. - It was also gated on `wrong content-hash`, while the outage's other half is `Package not available (could not find package qr_flutter ...)` — mirror metadata whose `archive_url` 404s. So retry on any failure, after rewriting the host in the lock, and prove the retry did not move a version: every line except `url:` must be byte-identical, or the step fails rather than build against a drifted resolution. The host goes into `$GITHUB_ENV` too, since the build steps resolve again. Verified locally against the live mirror: the failing path emits the warning, `seds` 125 hosts, resolves on pub.dev, keeps `xml` 6.5.0, and writes both variables to `$GITHUB_ENV`; the happy path leaves the lock untouched. --- .github/workflows/ohos-release.yml | 41 ++++++++++++++++++++++++------ 1 file changed, 33 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ohos-release.yml b/.github/workflows/ohos-release.yml index b215fd91..c47a1460 100644 --- a/.github/workflows/ohos-release.yml +++ b/.github/workflows/ohos-release.yml @@ -112,21 +112,46 @@ jobs: - uses: ./.github/actions/pub-cache - name: Resolve dependencies + shell: bash run: | set -euo pipefail - log_file="$(mktemp)" - if flutter pub get --enforce-lockfile 2>&1 | tee "$log_file"; then + # The mirror is the project default (it is baked into the image, and + # `.envrc` sets it on a developer machine), but it has been serving + # two kinds of damage: an archive whose bytes miss the lock's sha256 + # (`wrong content-hash`) and metadata whose `archive_url` 404s + # (`Package not available`). Either one aborts the resolve before any + # build step, and 1.0.4-rc.2 lost two attempts to exactly that. + if flutter pub get; then exit 0 fi - if grep -q 'wrong content-hash' "$log_file"; then - echo "::warning::Mirror returned a package with the wrong content hash. Retrying with https://pub.dev." - PUB_HOSTED_URL=https://pub.dev flutter pub get --enforce-lockfile - exit 0 + echo "::warning::Resolving from pub.flutter-io.cn failed; retrying on pub.dev." + # Switching PUB_HOSTED_URL alone is not enough: pub takes each + # package's host from the lock itself, so the retry would keep + # talking to the mirror. Rewrite the host in place — and then prove + # the retry did not move a version, because a re-resolve would + # silently pick newer packages than the lock names (`flutter pub get` + # against another host bumped `xml` 6.5.0 to 7.0.1 when measured). + sed -i 's#https://pub.flutter-io.cn#https://pub.dev#g' pubspec.lock + cp pubspec.lock "$RUNNER_TEMP/lock.host-rewritten" + PUB_HOSTED_URL=https://pub.dev FLUTTER_STORAGE_BASE_URL=https://storage.googleapis.com \ + flutter pub get + # Compared without `diff`: this image has no libatomic, and diffutils + # dies before it compares anything. + before="$(grep -v '^ *url:' "$RUNNER_TEMP/lock.host-rewritten" | sha256sum)" + after="$(grep -v '^ *url:' pubspec.lock | sha256sum)" + if [[ "$before" != "$after" ]]; then + echo "::error::The pub.dev retry re-resolved beyond the lock's hosts, so it would build versions the lock does not name." + git diff -- pubspec.lock | head -60 + exit 1 fi - - exit 1 + # Later steps resolve again inside the build; keep them on the host + # whose lock is now in the tree, or they would disagree with it. + { + echo "PUB_HOSTED_URL=https://pub.dev" + echo "FLUTTER_STORAGE_BASE_URL=https://storage.googleapis.com" + } >> "$GITHUB_ENV" - name: Build unsigned hap run: scripts/build-unsigned-hap.sh