From 2787eaadffe0e536c2281f146b90edc901eda754 Mon Sep 17 00:00:00 2001
From: wtclaude <claude@whitlocktech.net>
Date: Wed, 5 Aug 2026 17:20:18 -0500
Subject: [PATCH] feat(installer): read bundles from the branch they are
 published to

`main` is protected, so the compose job cannot push a bundle there --
the pre-receive hook declines it, which is not something a nightly cron
can resolve. Bundles now publish to a branch of their own, at its root,
so BUNDLE_BASE follows them. Everything the original choice was for
survives the move: a reviewable diff, a git history of the compat
matrix, and a plain anonymous URL that needs no credentials on the
shard host.

The test's bundle is now a frozen fixture rather than an include of the
published file, which this checkout no longer carries. Frozen is the
honest shape anyway: a test that silently re-targeted whatever CI
published last would change meaning without a commit. It is still a
real CI-emitted document, copied verbatim.

Nothing is released from `edge`, so no shipped binary ever read the old
URL.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 bundles/current.json                          | 40 -------------------
 src/bundle.rs                                 | 17 ++++++--
 .../fixtures/published-bundle.json            |  0
 3 files changed, 13 insertions(+), 44 deletions(-)
 delete mode 100644 bundles/current.json
 rename bundles/bundle-2026.08.04.json => tests/fixtures/published-bundle.json (100%)

diff --git a/bundles/current.json b/bundles/current.json
deleted file mode 100644
index 7d99bb5..0000000
--- a/bundles/current.json
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  "schema": 1,
-  "bundle": "2026.08.04",
-  "generated": "2026-08-04T16:07:13Z",
-  "protocol": 3,
-  "link": {
-    "repo": "RunicGateway/link",
-    "tag": "v1.1.0",
-    "version": "1.1.0",
-    "protocol": 3,
-    "assets": {
-      "linux-x86_64": {
-        "name": "uo-link-sidecar-linux-x86_64",
-        "url": "https://gitea.whitlocktech.com/RunicGateway/link/releases/download/v1.1.0/uo-link-sidecar-linux-x86_64",
-        "sha256": "27d491efda3fc6859dd38da9b2aa3b97b5fdf1dc5fc488a8916bb88b03443ad9"
-      },
-      "windows-x86_64": {
-        "name": "uo-link-sidecar-windows-x86_64.exe",
-        "url": "https://gitea.whitlocktech.com/RunicGateway/link/releases/download/v1.1.0/uo-link-sidecar-windows-x86_64.exe",
-        "sha256": "fbefd886af0355bf128f1f4c65657b772a58b128d32438061adb0069978e0b8f"
-      }
-    }
-  },
-  "overlay": {
-    "repo": "RunicGateway/servuo-plugins",
-    "tag": "v0.1.1",
-    "version": "0.1.1",
-    "commit": "3a52abbd77047e7c94883934533edcfef3ede555",
-    "protocol": 3,
-    "servuo": {
-      "min_version": "57.4",
-      "patches_verified_against": "57.4"
-    },
-    "asset": {
-      "name": "runicgateway-overlay-0.1.1.tar.gz",
-      "url": "https://gitea.whitlocktech.com/RunicGateway/servuo-plugins/releases/download/v0.1.1/runicgateway-overlay-0.1.1.tar.gz",
-      "sha256": "75dc6d6ce08322b753a30303b3b2df6f15cf1e84658507d97430af44ec4d34d7"
-    }
-  }
-}
diff --git a/src/bundle.rs b/src/bundle.rs
index 59ff818..3791ce8 100644
--- a/src/bundle.rs
+++ b/src/bundle.rs
@@ -19,8 +19,13 @@ use std::collections::BTreeMap;
 
 /// Bundles are plain files in this repo, served by Gitea's raw endpoint over anonymous HTTPS —
 /// the shard host has no Gitea account and needs no git client (PLAN.md §1, §7.1).
+///
+/// They live on a **branch of their own**, not on `main`, and at its root. `main` is protected, so
+/// the unattended compose job cannot push there — a pre-receive hook declines it, which is not
+/// something a nightly cron can resolve. Everything the original choice was for survives the move:
+/// a reviewable diff, a git history of the compat matrix, and a plain anonymous URL.
 const BUNDLE_BASE: &str =
-    "https://gitea.whitlocktech.com/RunicGateway/installer/raw/branch/main/bundles";
+    "https://gitea.whitlocktech.com/RunicGateway/installer/raw/branch/bundles";
 
 /// The only `schema` this build understands.
 const SUPPORTED_SCHEMA: u32 = 1;
@@ -177,9 +182,13 @@ pub fn parse(body: &str) -> Result<Bundle> {
 mod tests {
     use super::*;
 
-    /// The first published bundle, verbatim from `bundles/current.json`. Using the real document
-    /// rather than a hand-written stand-in is the point: it is what CI actually emits.
-    const CURRENT: &str = include_str!("../bundles/current.json");
+    /// The first published bundle, verbatim. Using a real document rather than a hand-written
+    /// stand-in is the point: it is what CI actually emits.
+    ///
+    /// It is a frozen copy rather than a live include, because published bundles moved off `main`
+    /// onto a branch this checkout does not carry. Frozen is the honest shape anyway — a test that
+    /// silently re-targeted whatever CI published last would change meaning without a commit.
+    const CURRENT: &str = include_str!("../tests/fixtures/published-bundle.json");
 
     #[test]
     fn the_published_bundle_parses() {
diff --git a/bundles/bundle-2026.08.04.json b/tests/fixtures/published-bundle.json
similarity index 100%
rename from bundles/bundle-2026.08.04.json
rename to tests/fixtures/published-bundle.json