Architecture Finding
Type: interface-violation
Affected area: .github/workflows/build-flatpaks.yml:91-126
The centralized Flatpak publisher treats image publication and catalog publication as independent best-effort operations inside one shell loop. Both skopeo copy and .github/scripts/update-index.py end in || true (lines 109 and 115), after which the workflow commits whatever index mutation happened and pushes it directly to main.
This violates the catalog's core producer-consumer invariant: an index entry and the OCI object it names must be published as one validated unit. A failed image copy can be followed by a successful index rewrite; a successful image copy can be followed by a suppressed index failure; multiple apps can leave a partially updated batch that still reports success.
Impact
Consumers of https://tunaos.org/flatpak/ can receive references to missing or stale OCI objects while the publishing run is green. Operators cannot distinguish complete publication from partial success, retries have no explicit transaction boundary, and the production index can advance independently of the registry state it describes.
Recommendation
Make each app publication fail closed: publish to an immutable digest/tag, verify the remote object, then update a staged index against that verified reference. Validate the complete staged index before committing it, and publish the batch only when every selected app succeeds. If partial publication is intentional, record per-app outcomes and exclude failed apps from the index transaction rather than suppressing errors.
Filed by architect agent (ACMM L6 — full mode)
— hive: agent=architect backend=codex model=gpt-5.6-sol codex=0.146.0
Architecture Finding
Type: interface-violation
Affected area:
.github/workflows/build-flatpaks.yml:91-126The centralized Flatpak publisher treats image publication and catalog publication as independent best-effort operations inside one shell loop. Both
skopeo copyand.github/scripts/update-index.pyend in|| true(lines 109 and 115), after which the workflow commits whatever index mutation happened and pushes it directly tomain.This violates the catalog's core producer-consumer invariant: an index entry and the OCI object it names must be published as one validated unit. A failed image copy can be followed by a successful index rewrite; a successful image copy can be followed by a suppressed index failure; multiple apps can leave a partially updated batch that still reports success.
Impact
Consumers of
https://tunaos.org/flatpak/can receive references to missing or stale OCI objects while the publishing run is green. Operators cannot distinguish complete publication from partial success, retries have no explicit transaction boundary, and the production index can advance independently of the registry state it describes.Recommendation
Make each app publication fail closed: publish to an immutable digest/tag, verify the remote object, then update a staged index against that verified reference. Validate the complete staged index before committing it, and publish the batch only when every selected app succeeds. If partial publication is intentional, record per-app outcomes and exclude failed apps from the index transaction rather than suppressing errors.
Filed by architect agent (ACMM L6 — full mode)
— hive: agent=architect backend=codex model=gpt-5.6-sol codex=0.146.0