Anvil
fangorn/anvil-cli public
ref:main

Release 2026.07.6 published incomplete — build-runner timed out mid-upload #40

closed Opened by cole.christensen@gmail.com

Links

No links yet.

The build-runner job on main (run 5133763690, job 91cec80ea7) exceeded its timeout after creating the release, so 2026.07.6 is live with half its assets missing.

Duration   1862.0s      <- timeout_seconds: 1800

Exit Code  -1

The log shows the build fully succeeding, then dying during asset upload:

✓ Created release 2026.07.6

  https://anvil.fangorn.io/fangorn/anvil-cli/releases/2026.07.6

✓ Uploaded (unknown) (0 B)



--- Job failed (exit code: -1) ---

What shipped

Release Assets
2026.07.5 anvil_linux_amd64, anvil_linux_arm64, anvil_macos_amd64, anvil_macos_arm64, SHA256SUMS (5)
2026.07.6 anvil_linux_arm64, anvil_linux_amd64 (2)

Both macOS binaries and SHA256SUMS are missing.

Why this matters

anvil update “downloads the build matching your OS and architecture, verifies its SHA256 against the server’s published checksums, and atomically replaces the current executable”. Against 2026.07.6:

  • macOS users have no asset to download at all.
  • No SHA256SUMS means the verification step has nothing to check against, on every platform. The only way through is --no-verify, which the docs correctly call “not recommended”.

2026.07.6 is the newest release, so it is what anvil update resolves to.

Two separate defects

  1. The publish is not atomic. The release is created and made visible before its assets finish uploading, so any failure mid-upload leaves a partial release rather than none. Uploading assets first and creating/publishing the release last would make the failure mode “no release” instead of “broken release”.
  2. The timeout is too tight for what the step does. 1862s against a 1800s budget, for four cross-compiles plus four uploads plus checksums — it only just failed, so it will keep flapping. ci/build-runner.sh has trap ERR rollback for publish, but a SIGKILL from the timeout can’t run a trap.

Also worth noting: ✓ Uploaded (unknown) (0 B) suggests the upload reporting doesn’t have the asset name or size at that point, which made this much harder to diagnose than it should have been.

Suggested immediate action

Delete or re-cut 2026.07.6 so anvil update stops resolving to it.

Found while watching CI after #41 and #42 merged.

colechristensen cole.christensen@gmail.com commented 2026-07-26 20:08

Fixed by #44/#45 (build time) and the release-pipeline rework (merged).

Both defects are addressed:

  1. The publish is now atomic. ci/publish-release.sh creates the release as a draft up front, both arch jobs upload their binaries to that draft, the publish job then computes the combined SHA256SUMS and publishes last. A mid-upload failure now leaves an unpublished draft rather than a live half-release. (ci/release.sh also excludes drafts when computing the next version so concurrent jobs agree.)
  2. The timeout is no longer marginal — the build jobs run with timeout_seconds: 3600 (was 1800), and the toolchain install moved into a prepared image (#43), which removed the ~1750s that caused the overrun in the first place.

Verified against the current newest release, 2026.07.12 — all six assets present: SHA256SUMS, anvil_linux_amd64, anvil_linux_arm64, anvil_macos_amd64, anvil_macos_arm64, anvil_windows_amd64.

Note: the original 2026.07.6 still exists with its two assets, but it is no longer the newest release, so anvil update no longer resolves to it and the “no checksums to verify against” impact is gone.

Back to issues