Repository navigation
Downloads come from Cloudflare R2, so no GitHub access is needed - #26
Merged
Merged
Conversation
The repository is private, so the Download buttons led to a releases page that shows 404 to anyone who is not a collaborator, with a GitHub account or without. The DMGs now live in the private hyperpoint-releases R2 bucket and the site serves them: /download redirects to the release the bucket's `latest` object names, and /download/Hyperpoint-<version>.dmg and its .sha256 serve that release. A small Worker runs only for /download paths; the rest of the site stays static assets, and any other key or path gets the 404 page. release.sh --publish uploads each release to the bucket after the GitHub release and moves `latest` last, except for a prerelease. It checks it can read the bucket before building, so a missing Cloudflare sign-in stops it before notarization. v0.1.1 is already uploaded, matched by MD5. Checked with wrangler dev on a local bucket: /download redirects to Hyperpoint-0.1.1.dmg, which arrives with the release's SHA-256, its type and length; `latest`, a missing version and POST are refused. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
🚀 Deploying Preview to Cloudflare 🚀Preview URL: https://claude-app-downloader-hosting-cf6937-hyperpoint.progremir.workers.dev (commit 9ae6885)This URL reflects your latest Preview deploymentPreview Deployments by commit
|
Workers Builds publishes a branch with `npx wrangler preview`, and previews inherit no bindings, so the preview's Worker had no RELEASES and every /download threw (error 1101). wrangler.jsonc's `previews` block now binds the same bucket: the Worker only reads it, and a preview should serve the real releases. The build logs also show that a push to main runs `npx wrangler deploy`, not `npx cf deploy`, so production reads wrangler.jsonc as well. The site README and the file's comment now say so. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
release.yml only built an ad-hoc DMG on a GitHub macOS runner when a pull request touched the pipeline. Releases are published from the Mac that holds the certificate and the site deploys through Cloudflare, so this was the repository's last use of GitHub Actions, on its most expensive runner. It stopped running anyway: GitHub refuses to start the job while the account's billing or spending limit is unresolved. The README's Releasing section now gives the same check to run locally, `SIGN_IDENTITY=- ALLOW_ADHOC=1 scripts/release.sh 0.2.0-check`, which built and verified the DMG in 22 seconds. Comments that named CI now say what the ad-hoc build and the hdiutil retry are for. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The repository is private, so every Download button on hyperpoint.progremir.dev led to
github.com/progremir/hyperpoint/releases/latest. That page shows 404 to anyone who isn't a collaborator, with or without a GitHub account.What changed
Downloads are served from R2 by the site's own Worker.
hyperpoint-releases. It has no public URL; only the Worker reads it.site/src/index.tsruns only for/downloadand/download/*(runWorkerFirst). Every other path is still a static asset./downloadredirects (302,no-store) to the file the bucket'slatestobject names, so the saved file carries its version./download/Hyperpoint-<version>.dmgand its.sha256serve that release, with an ETag and immutable caching.latest, other keys, missing versions and unknown paths get the site's 404 page. Methods other than GET and HEAD get 405.wrangler.jsonc, which Workers Builds reads for bothmainand branch previews, andcloudflare.config.ts, forcf deployfrom a Mac, both gain the entry, theASSETSandRELEASESbindings and therunWorkerFirstroutes. Previews bind the same bucket inwrangler.jsonc'spreviewsblock.SoftwareApplicationdownloadUrland the privacy page now point at/download.scripts/release.sh --publishuploads to the bucket. Aftergh release create, it uploads the DMG and its SHA-256, then moveslatest, which a prerelease leaves alone. Before building, it checks that it can read the bucket, so a missing Cloudflare sign-in stops it before the 30-minute notarization. The one-time setup,npm ci && npx cf auth logininsite/, is in the README.v0.1.1 is already in the bucket. Its MD5 matches the GitHub release's DMG, which passes
shasum -candspctlas Notarized Developer ID.No GitHub Actions.
.github/workflows/release.ymlbuilt an ad-hoc DMG on a GitHub macOS runner when a PR touched the release pipeline. It was the repository's last workflow, and GitHub refused to start it here because of a billing or spending-limit problem on the account. The README's Releasing section now gives the same check to run on a Mac before merging a pipeline change. The comments inbuild-app.shandrelease.shthat named CI now say what the ad-hoc build and thehdiutilretry are for.Checked
With
wrangler devon a local bucket holding the same three objects:/downloadand/download/redirect to/download/Hyperpoint-0.1.1.dmg.application/x-apple-diskimage, 1,247,215 bytes, withContent-Lengthand the release's SHA-256..sha256file is served too./download/latestand/download/Hyperpoint-9.9.9.dmgget the branded 404 page, andPOST /downloadgets 405./,/privacyand a 404 behave as before, with no console or server errors.cf buildandwrangler deploy --dry-runboth list the R2 and assets bindings.On this branch's preview (https://claude-app-downloader-hosting-cf6937-hyperpoint.progremir.workers.dev), against the real bucket and with no GitHub credentials:
/downloadredirects toHyperpoint-0.1.1.dmgwithno-store.application/x-apple-diskimage, 1,247,215 bytes, with the release's SHA-256.spctlaccepts it as Notarized Developer ID./download/latestand a missing version return 404,POSTreturns 405, and/,/privacyand the 404 page work as before.That's Workers Builds' own preview of 9ae6885, built with
npx wrangler preview. Its build of 86b6410 deployed but returned 1101 on/download, because previews inherit no bindings. 9ae6885 adds the bucket towrangler.jsonc'spreviewsblock, and the build no longer warns about a missing binding.Production builds run
npx wrangler deployand read the samewrangler.jsonc, where the top-level entry, bindings andrun_worker_firstroutes are set. The site README now names the commands Workers Builds actually runs.SIGN_IDENTITY=- ALLOW_ADHOC=1 scripts/release.sh 0.2.0-check, the local check the README now documents, built and verified the DMG in 22 seconds.Not changed
The footer's Release notes and Source code links, the config-skill links and "Open an issue" still go to the private repository.
🤖 Generated with Claude Code