Skip to content
This repository was archived by the owner on Aug 6, 2026. It is now read-only.

Commit afd5861

Browse files
committed
add run-from-ci local update test script
1 parent 8ff0697 commit afd5861

2 files changed

Lines changed: 92 additions & 19 deletions

File tree

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
#!/usr/bin/env bash
2+
# One command to try the macOS auto-update flow locally against the CI-signed
3+
# builds, no local signing. It downloads the old (1.0.0) app and the new (2.0.0)
4+
# feed from the latest green Code Update E2E run, serves the feed, and opens the
5+
# old app pointed at it. In the app: open the update banner, click Download, then
6+
# Restart, and watch the real Squirrel swap + relaunch into 2.0.0.
7+
#
8+
# Squirrel verifies signatures cryptographically, so the CI-signed pair updates
9+
# here without the cert being in your keychain.
10+
#
11+
# Usage:
12+
# bash scripts/dev-update/run-from-ci.sh [run-id]
13+
# AUTOMATED=1 bash scripts/dev-update/run-from-ci.sh # run the Playwright spec instead
14+
set -euo pipefail
15+
16+
cd "$(dirname "$0")/../.."
17+
18+
command -v gh >/dev/null || {
19+
echo "gh (GitHub CLI) is required and must be authenticated" >&2
20+
exit 1
21+
}
22+
23+
if pgrep -x "PostHog Code" >/dev/null; then
24+
echo "PostHog Code is already running. Quit it first; the test build shares its single-instance lock and data dir." >&2
25+
exit 1
26+
fi
27+
28+
RUN_ID="${1:-$(gh run list --workflow=code-update-e2e.yml --status success -L 1 --json databaseId -q '.[0].databaseId')}"
29+
[[ -n "$RUN_ID" ]] || {
30+
echo "no successful Code Update E2E run found; pass a run id explicitly" >&2
31+
exit 1
32+
}
33+
echo "==> using CI run $RUN_ID"
34+
35+
TMP="$(mktemp -d)"
36+
cleanup() {
37+
[[ -n "${SERVE_PID:-}" ]] && kill "$SERVE_PID" 2>/dev/null || true
38+
rm -rf "$TMP"
39+
}
40+
trap cleanup EXIT
41+
42+
echo "==> downloading signed builds from CI"
43+
gh run download "$RUN_ID" -n update-old-build-1.0.0 -D "$TMP/old"
44+
gh run download "$RUN_ID" -n update-new-build-2.0.0 -D "$TMP/new"
45+
46+
OLD_ZIP="$(find "$TMP/old" -name 'PostHog-Code-*-arm64-mac.zip' | head -1)"
47+
FEED_YML="$(find "$TMP/new" -name latest-mac.yml | head -1)"
48+
[[ -n "$OLD_ZIP" ]] || {
49+
echo "old build zip not found in artifact" >&2
50+
exit 1
51+
}
52+
[[ -n "$FEED_YML" ]] || {
53+
echo "latest-mac.yml not found in new build artifact" >&2
54+
exit 1
55+
}
56+
57+
echo "==> old 1.0.0 app -> out/mac-arm64"
58+
rm -rf out/mac-arm64 && mkdir -p out/mac-arm64
59+
ditto -x -k "$OLD_ZIP" out/mac-arm64
60+
xattr -dr com.apple.quarantine "out/mac-arm64/PostHog Code.app" 2>/dev/null || true
61+
62+
echo "==> new 2.0.0 feed -> out/dev-update-feed"
63+
rm -rf out/dev-update-feed && mkdir -p out/dev-update-feed
64+
cp "$(dirname "$FEED_YML")"/* out/dev-update-feed/
65+
66+
if [[ "${AUTOMATED:-}" == "1" ]]; then
67+
echo "==> running the automated update test"
68+
pnpm exec playwright test --config=tests/e2e/playwright.update.config.ts
69+
exit $?
70+
fi
71+
72+
PORT="${PORT:-8788}"
73+
node scripts/dev-update/serve.mjs out/dev-update-feed "$PORT" &
74+
SERVE_PID=$!
75+
76+
APP_LOG="out/run-from-ci-app.log"
77+
echo
78+
echo "==> launching PostHog Code 1.0.0 (feed http://127.0.0.1:$PORT)"
79+
echo " In the app: open the update banner, click Download, then Restart."
80+
echo " It swaps and relaunches into 2.0.0. Quit the app (or Ctrl+C) to finish."
81+
echo " App output: $APP_LOG update log: ~/.posthog-code/logs/main.log"
82+
echo
83+
POSTHOG_E2E_UPDATE_FEED="http://127.0.0.1:$PORT" \
84+
"out/mac-arm64/PostHog Code.app/Contents/MacOS/PostHog Code" >"$APP_LOG" 2>&1 || true
85+
86+
echo "==> app exited; cleaning up"

docs/AUTO-UPDATE-TESTING.md

Lines changed: 6 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -47,30 +47,17 @@ OLD_VERSION=1.0.0 NEW_VERSION=2.0.0 bash apps/code/scripts/dev-update/build-pair
4747

4848
This takes a few minutes and may prompt for keychain access to sign.
4949

50-
## Or: pull a signed pair from CI (no local signing)
50+
## Or: one command, against the CI-signed pair (no local signing)
5151

52-
If you don't have a Developer ID cert, `build-pair.sh` produces unsigned builds and the swap won't complete. The nightly run signs both with PostHog's identity and uploads them as two separate artifacts. Squirrel verifies signatures cryptographically (it does not need the cert in your keychain), so the pulled pair updates locally just like a real release.
53-
54-
Drop them into the same paths the local build produces, then use the run sections below unchanged:
52+
If you don't have a Developer ID cert, `build-pair.sh` produces unsigned builds and the swap won't complete. Instead run one script: it pulls the signed pair from the latest green run, serves the feed, and opens the old app pointed at it. Squirrel verifies signatures cryptographically (it does not need the cert in your keychain), so the CI-signed pair updates locally just like a real release.
5553

5654
```bash
57-
# latest green run
58-
RUN=$(gh run list --workflow=code-update-e2e.yml --status success -L 1 \
59-
--json databaseId -q '.[0].databaseId')
60-
61-
# old 1.0.0 app -> apps/code/out/mac-arm64/PostHog Code.app
62-
gh run download "$RUN" -n update-old-build-1.0.0 -D /tmp/upd-old
63-
rm -rf apps/code/out/mac-arm64 && mkdir -p apps/code/out/mac-arm64
64-
ditto -x -k "/tmp/upd-old/PostHog-Code-1.0.0-arm64-mac.zip" apps/code/out/mac-arm64
65-
# harmless if already clear; needed only if you downloaded via the browser
66-
xattr -dr com.apple.quarantine "apps/code/out/mac-arm64/PostHog Code.app"
67-
68-
# new 2.0.0 feed -> apps/code/out/dev-update-feed/
69-
rm -rf apps/code/out/dev-update-feed
70-
gh run download "$RUN" -n update-new-build-2.0.0 -D apps/code/out/dev-update-feed
55+
bash apps/code/scripts/dev-update/run-from-ci.sh
56+
# a specific run: bash apps/code/scripts/dev-update/run-from-ci.sh <run-id>
57+
# automated spec instead: AUTOMATED=1 bash apps/code/scripts/dev-update/run-from-ci.sh
7158
```
7259

73-
The builds are signed but not notarized, so launch by the binary path (the manual section does this); `open`-ing the `.app` may trip Gatekeeper.
60+
Needs the GitHub CLI (`gh`) authenticated, and your normal PostHog Code must be quit (the test build shares its single-instance lock and data dir). The app opens on `1.0.0` with an update available; click Download, then Restart, and it swaps and relaunches into `2.0.0`.
7461

7562
## 2a. Run it automated (Playwright)
7663

0 commit comments

Comments
 (0)