Use the GitHub Releases API to refine the download process for CI - #327
Merged
Conversation
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
DrXiao
force-pushed
the
ci-improve-wget-verification
branch
3 times, most recently
from
August 24, 2026 05:59
db5b4ca to
66acfac
Compare
The host-x86 CI job contains a step to download and verifies the RISC-V GNU toolchain using a fixed URL and a SHA-256 value. This approach means the version may need to be bumped every time a new release comes out. Therefore, this CI step is improved by introducing the use of the GitHub Releases API, which can directly retrieve a JSON-formatted data about the latest release information. Since the reponse data contains the URL and SHA-256 of the latest release file(s), this step now sends a request to GitHub to obtain the URL and SHA-256 first, and then performs downlaod and verification process for the latest release toolchain.
The original fastfetch download process retrieved the archive directly via a fixed URL and performed installation without any verification. This step has now been enhanced by using the GitHub Releases API to first retrieve the URL and SHA256 checksum of the target file, and then sequentially perform the download, verification, and installation process using the previously obtained data.
DrXiao
force-pushed
the
ci-improve-wget-verification
branch
from
August 24, 2026 06:08
66acfac to
5940a93
Compare
Collaborator
|
Thank @DrXiao for contributing! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The host-x86 and host-arm jobs need to download the RISC-V GNU toolchain and fastfetch, respectively. However, both jobs rely on hard-coded URLs to download the required files, and only the toolchain archive is verified by a fixed SHA256 checksum.
Therefore, the proposed changes introduce the use of the GitHub Releases API to improve the CI flow. The two jobs now use the GitHub Releases API to obtain the release metadata of the target files first, then sequentially perform URL/SHA256 retrieval, download, verification, and installation steps.
As a result, the jobs can always automatically download and install the latest releases without requiring manual updates to the download URLs or checksums.
Summary by cubic
CI now uses the GitHub Releases API to resolve, download, and SHA‑256 verify the RISC‑V toolchain (host‑x86) and
fastfetch(host‑arm), replacing hard‑coded URLs. This keeps jobs on the latest assets and adds checksum verification forfastfetch.riscv-collab/riscv-gnu-toolchainandfastfetch-cli/fastfetch; build results may vary between runs..browser_download_urland.digestwithjq, download to/tmp, verify withsha256sum, then extract to/optand append/opt/riscv/bintoGITHUB_PATH(toolchain) or install viadpkg(fastfetch).GITHUB_TOKENfor API calls; steps fail on API or checksum errors; assumes asset namesriscv32-glibc-ubuntu-24.04-gcc.tar.xzandfastfetch-linux-aarch64.deb.Written for commit 5940a93. Summary will update on new commits.