Oct 2, 2025 · Sep 30, 2025 · Sep 30, 2025 · Sep 30, 2025 · Sep 30, 2025 · Sep 30, 2025
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
    needs: changes
    # We always build the dylibs on Go changes to verify we're not merging unbuildable code,
    # but they need only be signed and uploaded on coder/coder main.
    if:needs.changes.outputs.go == 'true' || needs.changes.outputs.ci == 'true' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')
    if: true
    runs-on: ${{ github.repository_owner == 'coder' && 'depot-macos-latest' || 'macos-latest' }}
    steps:
      # Harden Runner doesn't work on macOS
        uses: ./.github/actions/setup-go

      - name: Install rcodesign
        if:${{ github.repository_owner == 'coder' && github.ref == 'refs/heads/main' }}
        if:true
        run: |
          set -euo pipefail
          wget -O /tmp/rcodesign.tar.gz https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F0.22.0/apple-codesign-0.22.0-macos-universal.tar.gz
          AC_CERTIFICATE_PASSWORD_FILE: /tmp/apple_cert_password.txt

      - name: Upload build artifacts
        if:${{ github.repository_owner == 'coder' && github.ref == 'refs/heads/main' }}
        if:true
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: dylibs
    needs:
      - changes
      - build-dylib
    if:(github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')) && needs.changes.outputs.docs-only == 'false' && !github.event.pull_request.head.repo.fork
    if:true
    runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-22.04' }}
    permissions:
      # Necessary to push docker images to ghcr.io.
          make build/coder_"$version"_linux_{amd64,arm64,armv7}.tag

          # only push if we are on main branch or release branch
          if[[ "${GITHUB_REF}" == "refs/heads/main" || "${GITHUB_REF}" == refs/heads/release/* ]]; then
          iffalse; then
            # build and push multi-arch manifest, this depends on the other images
            # being pushed so will automatically push them
            # note: omitting the -j argument to avoid race conditions when pushing
  deploy:
    needs:
      - changes
      - build
    if: |
      (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/'))
      && needs.changes.outputs.docs-only == 'false'
      && !github.event.pull_request.head.repo.fork
      #- build
    if: true
    uses: ./.github/workflows/deploy.yaml
    with:
      image:${{ needs.build.outputs.IMAGE }}
      image:ghcr.io/coder/coder-preview:2.26.0-devel-d5e433119
    permissions:
      contents: read
      id-token: write
diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
          fetch-depth: 0
          persist-credentials: false

      - name: CHECKOUT MAIN
        run: |
          set -euxo pipefail
          git checkout main
          git checkout origin/dean/releases-freeze -- scripts/should_deploy.sh

      - name: Check if deploy is enabled
        id: check
        run: |
        with:
          egress-policy: audit

      - name: FAIL
        run: |
          echo "FAIL"
          exit 1

      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
Original file line number	Diff line number	Diff line change
Expand Up		@@ -968,7 +968,7 @@ jobs:
		needs: changes
		# We always build the dylibs on Go changes to verify we're not merging unbuildable code,
		# but they need only be signed and uploaded on coder/coder main.
		if:needs.changes.outputs.go == 'true' \|\| needs.changes.outputs.ci == 'true' \|\| github.ref == 'refs/heads/main' \|\| startsWith(github.ref, 'refs/heads/release/')
		if: true
		runs-on: ${{ github.repository_owner == 'coder' && 'depot-macos-latest' \|\| 'macos-latest' }}
		steps:
		# Harden Runner doesn't work on macOS
Expand DownExpand Up		@@ -996,7 +996,7 @@ jobs:
		uses: ./.github/actions/setup-go

		- name: Install rcodesign
		if:${{ github.repository_owner == 'coder' && github.ref == 'refs/heads/main' }}
		if:true
		run: \|
		set -euo pipefail
		wget -O /tmp/rcodesign.tar.gz https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F0.22.0/apple-codesign-0.22.0-macos-universal.tar.gz
Expand DownExpand Up		@@ -1033,7 +1033,7 @@ jobs:
		AC_CERTIFICATE_PASSWORD_FILE: /tmp/apple_cert_password.txt

		- name: Upload build artifacts
		if:${{ github.repository_owner == 'coder' && github.ref == 'refs/heads/main' }}
		if:true
		uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
		with:
		name: dylibs
Expand DownExpand Up		@@ -1093,7 +1093,7 @@ jobs:
		needs:
		- changes
		- build-dylib
		if:(github.ref == 'refs/heads/main' \|\| startsWith(github.ref, 'refs/heads/release/')) && needs.changes.outputs.docs-only == 'false' && !github.event.pull_request.head.repo.fork
		if:true
		runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' \|\| 'ubuntu-22.04' }}
		permissions:
		# Necessary to push docker images to ghcr.io.
Expand DownExpand Up		@@ -1260,7 +1260,7 @@ jobs:
		make build/coder_"$version"_linux_{amd64,arm64,armv7}.tag

		# only push if we are on main branch or release branch
		if[[ "${GITHUB_REF}" == "refs/heads/main" \|\| "${GITHUB_REF}" == refs/heads/release/* ]]; then
		iffalse; then
		# build and push multi-arch manifest, this depends on the other images
		# being pushed so will automatically push them
		# note: omitting the -j argument to avoid race conditions when pushing
Expand DownExpand Up		@@ -1479,14 +1479,11 @@ jobs:
		deploy:
		needs:
		- changes
		- build
		if: \|
		(github.ref == 'refs/heads/main' \|\| startsWith(github.ref, 'refs/heads/release/'))
		&& needs.changes.outputs.docs-only == 'false'
		&& !github.event.pull_request.head.repo.fork
		#- build
		if: true
		uses: ./.github/workflows/deploy.yaml
		with:
		image:${{ needs.build.outputs.IMAGE }}
		image:ghcr.io/coder/coder-preview:2.26.0-devel-d5e433119
		permissions:
		contents: read
		id-token: write
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -46,6 +46,12 @@ jobs:
		fetch-depth: 0
		persist-credentials: false

		- name: CHECKOUT MAIN
		run: \|
		set -euxo pipefail
		git checkout main
		git checkout origin/dean/releases-freeze -- scripts/should_deploy.sh

		- name: Check if deploy is enabled
		id: check
		run: \|
Expand All		@@ -71,6 +77,11 @@ jobs:
		with:
		egress-policy: audit

		- name: FAIL
		run: \|
		echo "FAIL"
		exit 1

		- name: Checkout
		uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
		with:
Expand Down