Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/scripts/vpm_archive.py
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ def download_archive(url: str, destination: Path) -> str:
url,
headers={
"Accept": "application/octet-stream",
"User-Agent": "PenguinDOOM-VPM-Repository-Actions",
"User-Agent": "Penguin-Repository-VPM-Repository-Actions",
},
)
digest = hashlib.sha256()
Expand Down
2 changes: 1 addition & 1 deletion .github/scripts/vpm_common.py
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
from typing import Any, Mapping

PACKAGE_NAME = "jp.penguin.purebase"
SOURCE_REPOSITORY = "PenguinDOOM/Pure-Base"
SOURCE_REPOSITORY = "Penguin-Repository/Pure-Base"
EXPECTED_LICENSE = "Apache-2.0"
LICENSE_PATH = "LICENSE"
VPM_PATH = Path("vpm.json")
Expand Down
2 changes: 1 addition & 1 deletion .github/scripts/vpm_payload.py
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ def github_api_get(url: str) -> dict[str, Any]:
"""Read one GitHub REST JSON object using the workflow token when available."""
headers = {
"Accept": "application/vnd.github+json",
"User-Agent": "PenguinDOOM-VPM-Repository-Actions",
"User-Agent": "Penguin-Repository-VPM-Repository-Actions",
"X-GitHub-Api-Version": "2022-11-28",
}
token = os.environ.get("GITHUB_TOKEN", "").strip()
Expand Down
22 changes: 11 additions & 11 deletions .github/tests/test_vpm_receiver.py
Original file line number Diff line number Diff line change
Expand Up @@ -36,10 +36,10 @@
DIGEST = "c" * 64
VERSION = "0.2.0"
PACKAGE_URL = (
"https://github.com/PenguinDOOM/Pure-Base/releases/download/"
"https://github.com/Penguin-Repository/Pure-Base/releases/download/"
f"{VERSION}/jp.penguin.purebase-{VERSION}.zip"
)
RELEASE_URL = f"https://github.com/PenguinDOOM/Pure-Base/releases/tag/{VERSION}"
RELEASE_URL = f"https://github.com/Penguin-Repository/Pure-Base/releases/tag/{VERSION}"


def valid_payload(
Expand All @@ -48,13 +48,13 @@ def valid_payload(
) -> dict[str, str]:
asset_name = f"jp.penguin.purebase-{version}.zip"
package_url = (
"https://github.com/PenguinDOOM/Pure-Base/releases/download/"
"https://github.com/Penguin-Repository/Pure-Base/releases/download/"
f"{version}/{asset_name}"
)
release_url = f"https://github.com/PenguinDOOM/Pure-Base/releases/tag/{version}"
release_url = f"https://github.com/Penguin-Repository/Pure-Base/releases/tag/{version}"
return {
"package_name": "jp.penguin.purebase",
"source_repository": "PenguinDOOM/Pure-Base",
"source_repository": "Penguin-Repository/Pure-Base",
"version": version,
"commit_sha": COMMIT_SHA,
"policy_commit_sha": policy_commit_sha,
Expand All @@ -64,7 +64,7 @@ def valid_payload(
"release_url": release_url,
"changelog_url": release_url,
"licenses_url": (
"https://github.com/PenguinDOOM/Pure-Base/blob/"
"https://github.com/Penguin-Repository/Pure-Base/blob/"
f"{COMMIT_SHA}/LICENSE"
),
}
Expand Down Expand Up @@ -185,7 +185,7 @@ class PayloadTests(unittest.TestCase):
def test_accepts_canonical_payload(self) -> None:
values = {
"PACKAGE_NAME": "jp.penguin.purebase",
"SOURCE_REPOSITORY": "PenguinDOOM/Pure-Base",
"SOURCE_REPOSITORY": "Penguin-Repository/Pure-Base",
"VERSION": VERSION,
"TAG": VERSION,
"COMMIT_SHA": COMMIT_SHA.upper(),
Expand Down Expand Up @@ -222,7 +222,7 @@ def test_accepts_prerelease_payload_with_separate_policy_commit(self) -> None:
def test_error_names_canonical_package_url_field(self) -> None:
values = {
"PACKAGE_NAME": "jp.penguin.purebase",
"SOURCE_REPOSITORY": "PenguinDOOM/Pure-Base",
"SOURCE_REPOSITORY": "Penguin-Repository/Pure-Base",
"VERSION": VERSION,
"TAG": VERSION,
"COMMIT_SHA": COMMIT_SHA,
Expand All @@ -237,16 +237,16 @@ def test_error_names_canonical_package_url_field(self) -> None:
def test_resolves_annotated_tag_to_commit(self) -> None:
tag_object_sha = "d" * 40
responses = {
f"https://api.github.com/repos/PenguinDOOM/Pure-Base/git/ref/tags/{VERSION}": {
f"https://api.github.com/repos/Penguin-Repository/Pure-Base/git/ref/tags/{VERSION}": {
"object": {"type": "tag", "sha": tag_object_sha}
},
f"https://api.github.com/repos/PenguinDOOM/Pure-Base/git/tags/{tag_object_sha}": {
f"https://api.github.com/repos/Penguin-Repository/Pure-Base/git/tags/{tag_object_sha}": {
"object": {"type": "commit", "sha": COMMIT_SHA}
},
}
self.assertEqual(
resolve_tag_commit(
"PenguinDOOM/Pure-Base", VERSION, api_get=responses.__getitem__
"Penguin-Repository/Pure-Base", VERSION, api_get=responses.__getitem__
),
COMMIT_SHA,
)
Expand Down
2 changes: 1 addition & 1 deletion .github/tests/test_vpm_yanks.py
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
from vpm_common import UpdateError # noqa: E402

PACKAGE_NAME = "jp.penguin.purebase"
SOURCE_REPOSITORY = "PenguinDOOM/Pure-Base"
SOURCE_REPOSITORY = "Penguin-Repository/Pure-Base"
POLICY_PATH = "vpm-yanks.json"
COMMIT_SHA = "a" * 40
CURRENT_COMMIT_SHA = "b" * 40
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/sync-vpm-yanks.yml
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ on:
source_repository:
description: Fixed Pure Base source repository
required: true
default: PenguinDOOM/Pure-Base
default: Penguin-Repository/Pure-Base
type: string
policy_commit_sha:
description: Pure Base vpm-yanks.json policy commit SHA
Expand Down Expand Up @@ -85,4 +85,4 @@ jobs:
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
git add -- vpm.json
git commit -m "Sync ${PACKAGE_NAME} yank policy"
git push origin "HEAD:master"
git push origin "HEAD:master"
2 changes: 1 addition & 1 deletion .github/workflows/update-vpm.yml
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ on:
source_repository:
description: Source repository in owner/name form
required: true
default: PenguinDOOM/Pure-Base
default: Penguin-Repository/Pure-Base
type: string

permissions:
Expand Down
20 changes: 10 additions & 10 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,27 +1,27 @@
# Penguin VPM Repository

VPM package listing for PenguinDOOM projects.
VPM package listing for Penguin-Repository projects.

## Add the repository

Use this listing URL in VRChat Creator Companion or a compatible VPM client:

```text
https://raw.githubusercontent.com/PenguinDOOM/VPM-Repository/refs/heads/master/vpm.json
https://raw.githubusercontent.com/Penguin-Repository/VPM-Repository/refs/heads/master/vpm.json
```

Alternatively, you can add it by pasting the following URL into your browser and opening it.
```text
vcc://vpm/addRepo?url=https://raw.githubusercontent.com/PenguinDOOM/VPM-Repository/refs/heads/master/vpm.json
vcc://vpm/addRepo?url=https://raw.githubusercontent.com/Penguin-Repository/VPM-Repository/refs/heads/master/vpm.json
```

Pure Base uses two separate receiver dispatches: `update-vpm` adds a published package release, while `sync-vpm-yanks` projects the fixed yank policy without release or archive processing.

## Pure Base release flow

`PenguinDOOM/Pure-Base` publishes an immutable GitHub Release and sends an `update-vpm` `repository_dispatch` event to this repository. The receiver then:
`Penguin-Repository/Pure-Base` publishes an immutable GitHub Release and sends an `update-vpm` `repository_dispatch` event to this repository. The receiver then:

1. accepts only `jp.penguin.purebase` from `PenguinDOOM/Pure-Base`;
1. accepts only `jp.penguin.purebase` from `Penguin-Repository/Pure-Base`;
2. validates the version, tag, source commit, release URL, and asset URL;
3. downloads the release ZIP and verifies its SHA-256 against the dispatch payload;
4. validates the root `package.json` name, version, and Apache-2.0 license;
Expand All @@ -44,9 +44,9 @@ This keeps historical metadata stable even if the default branch changes later.

## Required Pure Base configuration

Configure the following in `PenguinDOOM/Pure-Base`:
Configure the following in `Penguin-Repository/Pure-Base`:

- Repository variable `VPM_REPOSITORY`: `PenguinDOOM/VPM-Repository`
- Repository variable `VPM_REPOSITORY`: `Penguin-Repository/VPM-Repository`
- Release-environment secrets `APP_CLIENT_ID` and `APP_PRIVATE_KEY`
- A GitHub App installation that can write contents in both repositories

Expand All @@ -65,7 +65,7 @@ The `update-vpm` event uses this `client_payload` contract:
| `packageUrl` | Immutable release ZIP URL |
| `sha256` | SHA-256 of the release ZIP |
| `releaseUrl` | Published GitHub Release URL |
| `sourceRepository` | `PenguinDOOM/Pure-Base` |
| `sourceRepository` | `Penguin-Repository/Pure-Base` |
| `policyCommitSha` | Commit SHA for the Pure Base `vpm-yanks.json` policy |

`packageUrl` is the canonical field. The receiver temporarily accepts the legacy `packageurl` spelling so releases from the previous sender contract can still be reprocessed safely.
Expand All @@ -74,14 +74,14 @@ The workflow also exposes equivalent manual inputs for recovery or controlled re

## Yank synchronization

The `sync-vpm-yanks` `repository_dispatch` event is policy-only. It reads only `vpm-yanks.json` from the fixed `PenguinDOOM/Pure-Base` `master` branch and calls the policy synchronization entrypoint; it does not download a release archive or add release metadata.
The `sync-vpm-yanks` `repository_dispatch` event is policy-only. It reads only `vpm-yanks.json` from the fixed `Penguin-Repository/Pure-Base` `master` branch and calls the policy synchronization entrypoint; it does not download a release archive or add release metadata.

Its `client_payload` contract is:

| Field | Meaning |
| --- | --- |
| `packageName` | `jp.penguin.purebase` |
| `sourceRepository` | `PenguinDOOM/Pure-Base` |
| `sourceRepository` | `Penguin-Repository/Pure-Base` |
| `policyCommitSha` | 40-character commit SHA for the policy snapshot |

Manual recovery uses the constrained inputs `package_name`, `source_repository`, and `policy_commit_sha`. The policy path (`vpm-yanks.json`) and policy branch (`master`) are fixed in the receiver and cannot be supplied by the event or a manual run.
Expand Down
2 changes: 1 addition & 1 deletion vpm.json
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"name": "Penguin VPM Repository",
"id": "jp.penguin.vpm",
"url": "https://raw.githubusercontent.com/PenguinDOOM/VPM-Repository/refs/heads/master/vpm.json",
"url": "https://raw.githubusercontent.com/Penguin-Repository/VPM-Repository/refs/heads/master/vpm.json",
"author": "Penguin",
"packages": {
"jp.penguin.purebase": {
Expand Down