V1004 fixes

.github/workflows/oasis-stable-promote.yml

@@ -0,0 +1,119 @@
+name: Oasis Stable Ring Promote
+
+on:
+  workflow_dispatch:
+    inputs:
+      target_version:
+        description: Version to promote to oasis-stable (X.Y.Z.N)
+        required: true
+        type: string
+      build_target:
+        description: Build target to validate
+        required: false
+        default: Darwin_aarch64-gcc3
+        type: string
+      locale:
+        description: Locale to validate
+        required: false
+        default: en-US
+        type: string
+      actor:
+        description: Audit actor label
+        required: false
+        default: github-actions
+        type: string
+      reason:
+        description: Audit reason
+        required: false
+        default: manual stable promotion
+        type: string
+
+permissions:
+  contents: read
+
+env:
+  PRODUCT: Firefox
+
+jobs:
+  promote-stable:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Validate version format
+        run: |
+          set -euo pipefail
+          VERSION="${{ inputs.target_version }}"
+          if ! [[ "${VERSION}" =~ ^[0-9]+(\.[0-9]+){3}$ ]]; then
+            echo "Version must match X.Y.Z.N (numeric dot notation)." >&2
+            exit 1
+          fi
+
+      - name: Verify canary release asset exists
+        id: release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          VERSION="${{ inputs.target_version }}"
+          BUILD_TARGET="${{ inputs.build_target }}"
+          LOCALE="${{ inputs.locale }}"
+          SAFE_TARGET="$(echo "${BUILD_TARGET}" | tr '/ ' '__')"
+          TAG="canary"
+          ASSET_NAME="oasis-${VERSION}-${SAFE_TARGET}-${LOCALE}.signed.complete.mar"
+          RELEASE_JSON="$(mktemp)"
+          gh release view "${TAG}" --json tagName,assets > "${RELEASE_JSON}"
+          if ! python3 -c 'import json, sys; payload = json.load(open(sys.argv[1], "r", encoding="utf-8")); asset_name = sys.argv[2]; sys.exit(0 if any(a.get("name") == asset_name for a in payload.get("assets", [])) else 1)' "${RELEASE_JSON}" "${ASSET_NAME}"
+          then
+            echo "Expected canary bucket asset ${ASSET_NAME} was not found under release ${TAG}." >&2
+            exit 1
+          fi
+          echo "tag=${TAG}" >> "${GITHUB_OUTPUT}"
+          echo "asset_name=${ASSET_NAME}" >> "${GITHUB_OUTPUT}"
+          rm -f "${RELEASE_JSON}"
+
+      - name: Verify canary currently resolves target artifact
+        env:
+          OASIS_ADMIN_TOKEN: ${{ secrets.OASIS_UPDATE_ADMIN_TOKEN }}
+          OASIS_UPDATE_SERVICE_URL: ${{ secrets.OASIS_UPDATE_SERVICE_URL }}
+        run: |
+          set -euo pipefail
+          SERVICE_BASE="${OASIS_UPDATE_SERVICE_URL%/}"
+          TARGET_VERSION="${{ inputs.target_version }}"
+          EXPECTED_MAR_URL="https://github.com/${{ github.repository }}/releases/download/${{ steps.release.outputs.tag }}/${{ steps.release.outputs.asset_name }}"
+
+          RING_JSON="$(curl -fsS -H "Authorization: Bearer ${OASIS_ADMIN_TOKEN}" "${SERVICE_BASE}/admin/rings/oasis-canary")"
+          CURRENT_CANARY="$(python3 -c 'import json,sys; print(json.loads(sys.stdin.read())["target_version"])' <<<"${RING_JSON}")"
+          if [ "${CURRENT_CANARY}" != "${TARGET_VERSION}" ]; then
+            echo "Canary ring points to ${CURRENT_CANARY}, expected ${TARGET_VERSION} before stable promotion." >&2
+            exit 1
+          fi
+
+          UPDATE_URL="${SERVICE_BASE}/update/6/${PRODUCT}/0.0.0.0/0/${{ inputs.build_target }}/${{ inputs.locale }}/oasis-canary/Linux/default/default/update.xml"
+          UPDATE_XML="$(curl -fsS "${UPDATE_URL}")"
+          ACTUAL_MAR_URL="$(python3 -c 'import sys,xml.etree.ElementTree as ET; root = ET.fromstring(sys.stdin.read()); patch = root.find("./update/patch"); print(patch.attrib["URL"] if patch is not None else "")' <<<"${UPDATE_XML}")"
+          if [ -z "${ACTUAL_MAR_URL}" ]; then
+            echo "Canary update XML did not contain a patch URL for ${TARGET_VERSION}/${{ inputs.build_target }}/${{ inputs.locale }}." >&2
+            exit 1
+          fi
+          if [ "${ACTUAL_MAR_URL}" != "${EXPECTED_MAR_URL}" ]; then
+            echo "Canary artifact URL mismatch." >&2
+            echo "Expected: ${EXPECTED_MAR_URL}" >&2
+            echo "Actual:   ${ACTUAL_MAR_URL}" >&2
+            exit 1
+          fi
+
+      - name: Update stable ring pointer
+        env:
+          OASIS_ADMIN_TOKEN: ${{ secrets.OASIS_UPDATE_ADMIN_TOKEN }}
+          OASIS_UPDATE_SERVICE_URL: ${{ secrets.OASIS_UPDATE_SERVICE_URL }}
+        run: |
+          set -euo pipefail
+          python3 tools/oasis-update-service/publish_update.py \
+            --service "${OASIS_UPDATE_SERVICE_URL}" \
+            --admin-token "${OASIS_ADMIN_TOKEN}" \
+            --version "${{ inputs.target_version }}" \
+            --ring oasis-stable \
+            --actor "${{ inputs.actor }}" \
+            --reason "${{ inputs.reason }} (run ${GITHUB_RUN_ID}, source canary bucket)"

.gitignore

@@ -17,6 +17,11 @@ tags
 *.gcov
 *.tsbuildinfo
 compile_commands.json
+*.env
+
+# Local Apple signing assets (never commit)
+/developer_id.p12
+/p12_password.txt
 
 # emacs backup files in any directory.
 # lint-ignore-next-line: syntax-difference
@@ -104,6 +109,17 @@ tools/lint/stylelint/stylelint-plugin-mozilla/node_modules/
 tools/terser/node_modules/
 browser/components/asrouter/node_modules/
 browser/components/aboutwelcome/node_modules/
+
+# Oasis assistant: local-only npm artifacts (platform esbuild, devDependencies, Lambda deps)
+browser/base/content/assistant/ui-preact/node_modules/@esbuild/darwin-*/
+browser/base/content/assistant/ui-preact/node_modules/@esbuild/linux-*/
+browser/base/content/assistant/ui-preact/node_modules/@esbuild/freebsd-*/
+browser/base/content/assistant/ui-preact/node_modules/@esbuild/android-*/
+browser/base/content/assistant/ui-preact/node_modules/typescript/
+browser/base/content/assistant/ui-preact/node_modules/.bin/tsc
+browser/base/content/assistant/ui-preact/node_modules/.bin/tsserver
+browser/base/content/assistant/lambda/voice-runtime/node_modules/
+
 browser/extensions/newtab/node_modules/
 tools/ts/node_modules/
 testing/xpcshell/moz-http2/node_modules/
@@ -393,10 +409,22 @@ toolkit/crashreporter/minidump-analyzer/target/
 # Ignore mozperftest artifacts folder
 /artifacts/
 
+# Distribution packages (generated files)
+Oasis-Browser-*.dmg
+Oasis-Browser-*.zip
+
 # Ignore personal preferences files
 CLAUDE.local.md
 .claude/settings.local.json
 
 # Ignore .json.gz (typically profiles) in the root directory
 # lint-ignore-next-line: git-only
 /*.json.gz
+\n# Gemini files\ngemini.md\n.gemini/
+
+# Ignore tour directory
+tour/
+
+# Ignore Python profiling files
+*.cProfile
+*.pstats