Documentation
¶
Index ¶
- Constants
- Variables
- func AssetName() string
- func CompareVersions(a, b string) int
- func DownloadAsset(ctx context.Context, rawURL string) ([]byte, error)
- func DownloadChecksums(ctx context.Context, release *Release) (map[string]string, error)
- func NormalizeChannel(raw string) string
- func VerifyReleaseAsset(ctx context.Context, releaseTag string, assetName string, archive []byte) error
- type Asset
- type Release
Constants ¶
const ( ChannelStable = "stable" ChannelRC = "rc" )
Update channels. GitHub's /releases/latest already excludes prereleases, so the stable channel needs no filtering; the rc channel scans the release list and accepts release candidates.
Variables ¶
var AllowedDownloadPrefixes = []string{
"https://github.com/",
"https://api.github.com/",
}
AllowedDownloadPrefixes controls which URL prefixes are accepted by DownloadAsset. Exported for test injection only.
var ReleaseListURL = "https://api.github.com/repos/brandyn-s/code-graph/releases?per_page=20"
ReleaseListURL lists recent releases including prereleases. Exported for test injection. Used only on the "rc" update channel.
var ReleaseURL = "https://api.github.com/repos/brandyn-s/code-graph/releases/latest"
ReleaseURL is the GitHub API endpoint for latest release. Exported for test injection.
Points at this fork, NOT upstream DeusData — `code-graph update` replaces the running binary with whatever this URL serves, and an upstream binary would silently drop every fork addition (security tools, resolver gates, SCIP ingest). See tools.releaseURL for the matching update-notice endpoint.
Functions ¶
func AssetName ¶
func AssetName() string
AssetName returns the expected release asset name for the current platform.
func CompareVersions ¶
CompareVersions compares two semver strings (e.g. "0.2.1" vs "0.2.0"). Returns >0 if a > b, <0 if a < b, 0 if equal.
func DownloadAsset ¶
DownloadAsset downloads a release asset and returns the full body as bytes. The response body is fully read before returning to avoid premature context cancellation.
func DownloadChecksums ¶
DownloadChecksums downloads and parses the checksums.txt file from a release. Returns a map of filename → hex-encoded SHA-256 hash.
func NormalizeChannel ¶
NormalizeChannel maps a raw CODE_GRAPH_UPDATE_CHANNEL value to a channel. Unknown values fall back to stable so a typo never opts into prereleases.
func VerifyReleaseAsset ¶
func VerifyReleaseAsset( ctx context.Context, releaseTag string, assetName string, archive []byte, ) error
VerifyReleaseAsset proves that archive is the named immutable release asset and, for releases that publish provenance, that it has a valid SLSA attestation. Verification is performed against a private temporary copy so the exact downloaded bytes are checked before extraction or replacement.
Types ¶
type Asset ¶
type Asset struct {
Name string `json:"name"`
BrowserDownloadURL string `json:"browser_download_url"`
Size int64 `json:"size"`
}
Asset holds a single release artifact.
type Release ¶
type Release struct {
TagName string `json:"tag_name"`
Assets []Asset `json:"assets"`
Prerelease bool `json:"prerelease"`
Draft bool `json:"draft"`
}
Release holds parsed GitHub release metadata.
func FetchLatestRelease ¶
FetchLatestRelease fetches release metadata from GitHub.
func FetchNewestRelease ¶
FetchNewestRelease returns the newest release visible on the channel: GitHub's latest non-prerelease on stable, or the highest version among published (non-draft) releases including release candidates on rc.
func FetchRelease ¶
FetchRelease fetches release metadata, authenticating access through GitHub CLI while retaining HTTP injection for generic/public URLs.
func (*Release) LatestVersion ¶
LatestVersion returns the version string from the latest release (without "v" prefix).
Source Files