[Depends on #3828] feat(installer): stage hosted install assets#3853
Merged
yiliang114 merged 5 commits intoMay 11, 2026
Merged
Conversation
yiliang114
force-pushed
the
codex/installer-hosted-entrypoint
branch
from
10e27d5 to
a205e6c
Compare
Collaborator
Author
|
@copilot pls review for me |
Contributor
Code Review Summary The change is correct, well-scoped, and all 40 tests pass ( What the PR does ✅ Looks good
Verdict: ✅ Approved with minor suggestions above. The implementation is clean and the risk is low since the |
wenshao
requested changes
May 5, 2026
wenshao
reviewed
May 6, 2026
Collaborator
wenshao
left a comment
wenshao
left a comment
There was a problem hiding this comment.
Overall this is a tight, well-tested change — adding a second INSTALLATION_ASSETS entry that maps the same source to install is the cleanest way to introduce the alias, and the byte-equality test plus SHA256SUMS coverage prevent silent drift.
A few inline notes below. The main ask is reverting the unrelated package-lock.json line so the diff stays focused. The rest are nits.
One non-inline observation: the docs reference https://qwen-code.ai/install while explicitly noting the endpoint isn't live. That's honest, but it would be worth filing/linking a tracking issue for actually wiring up the endpoint so the asset doesn't sit unused indefinitely.
yiliang114
force-pushed
the
codex/installer-hosted-entrypoint
branch
from
16a4af9 to
587dc1f
Compare
yiliang114
changed the title
yiliang114
changed the title
- Replace the loose `latest` fragment check with per-format regex patterns in HOSTED_INSTALLER_DEFAULT_VERSION_PATTERNS so an unrelated occurrence of `latest` (comment, help text) cannot satisfy the staging guard. The patterns still tolerate whitespace variation, only the default-version assignment itself must be intact. - Add a "Hosted endpoint status" callout in INSTALLATION_GUIDE.md before the curl examples. The documented `--version` flow does not work against the OSS URL today because it currently serves the legacy NVM-based installer; the callout points users at a local checkout until the next release sync. - Tests: drop `latest` from the fragments equality assertion, add positive and negative regex coverage, add a failure-path case for sources whose default version is not `latest`, and pin the new guide markers so the callout cannot silently disappear.
Collaborator
Author
|
Latest local validation for this PR (head 2e4086a):
Hosted-related test cases (all green): Staging output ( Integrity checks: Stale-output protection: Hosted URL probes (2026-05-07): The OSS URLs are reachable but currently serve the older NVM-based installer (size and Last-Modified above), which is why |
yiliang114
added a commit
that referenced
this pull request
May 7, 2026
The previous draft imported INSTALLATION_ASSET_NAMES and verified install / install-qwen.sh / install-qwen.bat as release assets, but those were removed in #3828 (per-release installer publishing dropped) and #3853 (install alias dropped). The verifier now targets only standalone archives + SHA256SUMS, both for --dir and --base-url modes, and the release workflow Verify step is anchored after Build Standalone Archives. Local --dir mode: - All five qwen-code-{platform}.{ext} archives must exist. - SHA256SUMS must cover exactly those five — missing or extra entries fail. - Each archive's actual SHA256 must match its SHA256SUMS entry. Remote --base-url mode: - SHA256SUMS is downloadable, parseable, and contains the expected entries. - Each archive URL is reachable via HEAD, with a 1-byte ranged GET fallback for hosts that disable HEAD. Hosted installer scripts (install-qwen.sh / install-qwen.bat) are intentionally out of scope here — they are served from the hosted endpoint prepared by package:hosted-installation, not from the GitHub Release surface this verifier targets.
yiliang114
added a commit
that referenced
this pull request
May 7, 2026
Adds `npm run verify:installation-release` and wires it into the release
workflow after `Build Standalone Archives`, so a broken release directory
fails CI before publishing.
Local mode (`--dir PATH`) checks:
- All five `qwen-code-{platform}.{ext}` standalone archives exist.
- `SHA256SUMS` covers exactly those five — missing or unexpected entries fail.
- Each archive's actual SHA256 matches its `SHA256SUMS` entry.
Remote mode (`--base-url URL`) checks:
- `SHA256SUMS` is downloadable, parseable, and contains exactly the expected
archive entries.
- Each archive URL is reachable via HEAD, with a 1-byte ranged GET fallback
for hosts that disable HEAD.
Hosted installer scripts (`install-qwen.sh` / `install-qwen.bat`) are
intentionally out of scope here — they are served from the hosted endpoint
prepared by `package:hosted-installation` (PR #3853), not from the GitHub
Release surface this verifier targets.
wenshao
approved these changes
May 8, 2026
Collaborator
wenshao
left a comment
wenshao
left a comment
There was a problem hiding this comment.
No issues found. LGTM! ✅ — DeepSeek/deepseek-v4-pro via Qwen Code /review
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
install-qwen.shandinstall-qwen.bat) from the source-tracking installer scripts, writesSHA256SUMSfor upload verification, and documents how the staged files should be synced to the hosted installation path.Scope
This PR intentionally does not add an extensionless
installGitHub Release asset and does not uploadinstall-qwen.sh/install-qwen.batto GitHub Releases.The hosted install flow remains OS-specific at the script layer:
The installer still downloads the matching platform-specific standalone archive, so this remains on the standalone/binary installation track.
Hosted Upload Status
The hosted OSS objects currently exist:
curl -fsSILreturns200 OKfor bothinstallation/install-qwen.shandinstallation/install-qwen.batas of 2026-05-07.This PR only stages the files and checksums needed to update those hosted objects. It does not automate the OSS/CDN upload step. Until a follow-up release automation step is added, release operators should run
npm run package:hosted-installationand sync the staged files byte-for-byte to the hosted paths.Validation
Commands run:
Observed:
npm run test:scriptsreports 43 passed and 4 Windows-only tests skipped on macOS. eslint, prettier, shell syntax, whitespace checks, and hosted URL HEAD checks are clean.Scope / Risk
SHA256SUMSfrom scratch.SHA256SUMSentries are emitted in installer filename order for stable diffs.--version,QWEN_INSTALL_VERSION, and thelatestdefault needed by the hosted entrypoint.Testing Matrix
Testing matrix notes:
Linked Issues / Bugs
Related #3728
Depends on #3828