feat(qa-bundle-upload): add batch directory upload action by originalix · Pull Request #81 · OneKeyHQ/actions

originalix · 2026-03-03T06:39:51Z

Summary

New qa-bundle-upload GitHub Action: scans a directory for *-bundle.zip files + .info metadata, then uploads each bundle to the Utility server via HMAC-signed multipart POST
Supports batch upload: one action call handles multiple platforms (e.g., android + ios from native CI, electron from desktop CI)
Reads appVersion, platform, sha256 from .info files automatically — no manual input needed
SHA256 cross-check between .info and computed hash ensures file integrity
Serial upload with exponential backoff retry (configurable max-retries)
Partial failure handling: continues uploading remaining bundles, reports all results

Test Plan

14 unit tests passing (scanBundleDir, parseInfoFile, validateZipMagic, fixtures)
Verified against real native artifacts (android + ios SHA256 MATCH)
Verified against real desktop artifacts (found workflow JSON bug — separate fix needed)
End-to-end test in CI workflow after Utility server deployment

Note

release-desktop-bundle.yml in x-app-monorepo has a JSON syntax bug (missing comma in electron-bundle.json.info template, line 117). This needs a separate fix before the desktop workflow can use this action.

🤖 Generated with Claude Code

…json Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Move ZIP magic check from validateInputs to run() after readFileSync, eliminating FD leak risk if readSync throws - Rebuild FormData inside retry loop to avoid stream reuse after consumption - Recompute HMAC timestamp/signature per attempt to prevent stale signatures - Add core.setSecret(secret) to mask upload secret in logs - Add NaN guard for max-retries input Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

SHA256 of the file buffer is constant across retries, so compute it once in run() instead of inside the retry loop. Also restores the SHA256 log line for debugging visibility. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Replace single-file mode with directory scanning approach that reads .info metadata files automatically, enabling one action call to upload multiple platform bundles. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

7-task plan covering action.yml update, test fixtures, scanBundleDir and parseInfoFile implementation, dist build, and manual verification. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

C1: Validate server response has bundleVersion/downloadUrl before use I1: Split try-catch in parseInfoFile to distinguish ENOENT from bad JSON I3: Validate sha256 is a 64-char hex string I4: Validate appVersion matches x.y.z format I5: Only append commitHash to form when truthy Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

revan-zhang · 2026-03-03T06:40:06Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 12d8b0c103

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-03-03T06:43:31Z

qa-bundle-upload/src/index.js

+    let hasFailure = false;
+
+    for (const bundle of bundles) {
+      const meta = parseInfoFile(bundle.infoPath);


Parse metadata inside per-bundle try block

parseInfoFile(bundle.infoPath) runs before the per-bundle try/catch, so a single malformed or incomplete .info file throws into the outer run() catch and aborts the whole loop. In that case, later valid bundles are never attempted and results is not emitted, which breaks the intended partial-failure behavior for batch uploads.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-03-03T06:43:31Z

qa-bundle-upload/src/index.js

+        core.info(`[${label}] Uploading ${path.basename(bundle.zipPath)} (${fileSizeMB} MB, v${meta.appVersion})...`);
+
+        const computedHash = crypto.createHash('sha256').update(fileBuffer).digest('hex');
+        if (computedHash !== meta.sha256) {


Normalize SHA256 before comparing with computed hash

The parser accepts uppercase hex hashes (/^[0-9a-f]{64}$/i), but this comparison is case-sensitive against computedHash, which is always lowercase. If a valid .info file contains an uppercase SHA256, this check will falsely report a mismatch and fail the upload; normalize meta.sha256 (or both sides) before equality comparison.

Useful? React with 👍 / 👎.

…rmalize sha256 case Move parseInfoFile into per-bundle try/catch so a malformed .info file skips only that bundle instead of aborting the entire loop. Normalize sha256 to lowercase before comparison to avoid false mismatch on uppercase hex hashes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add integration README covering inputs/outputs, bundle directory structure, .info file format, HMAC upload protocol, retry behavior, and server integration checklist. Update server-url example to onekeytest.com and upload path to /utility/v1/app-update/bundles/upload. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…tigation Add diagnostic logging of request URL and headers (with signature truncated) to help identify why Cloudflare WAF is blocking the upload request. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

originalix and others added 12 commits March 3, 2026 09:53

feat(qa-bundle-upload): scaffold project with action.yml and package.…

4ec278a

…json Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

feat(qa-bundle-upload): implement HMAC-signed upload with retry

fbdf1ca

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

feat(qa-bundle-upload): build dist and register in build.sh

16c03af

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs(qa-bundle-upload): add batch directory mode design

be35d82

Replace single-file mode with directory scanning approach that reads .info metadata files automatically, enabling one action call to upload multiple platform bundles. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs(qa-bundle-upload): add batch mode implementation plan

68f0263

7-task plan covering action.yml update, test fixtures, scanBundleDir and parseInfoFile implementation, dist build, and manual verification. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

refactor(qa-bundle-upload): update action.yml for batch directory mode

20f0cc8

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

test(qa-bundle-upload): add fixtures and tests for batch mode

63d1126

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

feat(qa-bundle-upload): rewrite for batch directory mode

8900097

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

build(qa-bundle-upload): add test script and rebuild dist for batch mode

12d8b0c

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

chatgpt-codex-connector bot reviewed Mar 3, 2026

View reviewed changes

originalix and others added 5 commits March 3, 2026 14:51

build(qa-bundle-upload): rebuild dist for updated upload path

6d43988

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

debug(qa-bundle-upload): log request headers for Cloudflare 403 inves…

a1127f1

…tigation Add diagnostic logging of request URL and headers (with signature truncated) to help identify why Cloudflare WAF is blocking the upload request. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

fix: handle correct response

cbd0bcc

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(qa-bundle-upload): add batch directory upload action#81

feat(qa-bundle-upload): add batch directory upload action#81
originalix wants to merge 17 commits intoOneKeyHQ:mainfrom
originalix:feat/qa-bundle-upload

originalix commented Mar 3, 2026

Uh oh!

revan-zhang commented Mar 3, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Mar 3, 2026

Uh oh!

originalix Mar 3, 2026

Uh oh!

chatgpt-codex-connector bot Mar 3, 2026

Uh oh!

originalix Mar 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

originalix commented Mar 3, 2026

Summary

Test Plan

Note

Uh oh!

revan-zhang commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

originalix Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

originalix Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

revan-zhang commented Mar 3, 2026 •

edited

Loading