Homepage/relay polish, live release panel, and CI cache fix#38
Merged
Conversation
The "how it works" phone did not pin for the later beats in real browsers, leaving empty space where the per-beat screenshots should show. - Root cause: overflow-x:hidden on the page root forced overflow-y to compute to auto, turning the root into a scroll container, so position:sticky resolved against a non-scrolling box and the phone never pinned. Changed to overflow-x:clip, which clips horizontally without creating a scroll container. An inline comment marks it so it is not reverted. - Restructured the section as standard scrollytelling: a full-viewport-height sticky box that centers the phone, each beat about one viewport tall, plus a short trailing spacer so the phone stays pinned through the last beat. - Hardened the cross-fade observer to activate the most-visible beat by intersection ratio instead of last-wins, so it lands on the right screenshot regardless of scroll speed. Also add a site favicon (the Cosign mark on a dark rounded square), served by the relay at /favicon.svg and linked from the landing and privacy pages.
The verifiable-builds panel showed a hardcoded placeholder version and fingerprint. Wire it to the real latest tagged release. - New relay endpoint GET /cosign/v1/release: fetches the latest GitHub release, downloads its published BuildClaim.json, computes the SHA-256 of the exact bytes as the fingerprint (matching what the app shows), and parses version, tag, and commit. Cached with a short TTL so page loads do not hit the GitHub API each time. On any failure it returns an error and never fabricates data. - Homepage JS fetches the endpoint and populates the panel (version, release, commit, fingerprint) plus a "View release" link. On failure it leaves the existing placeholder untouched rather than showing made-up values. - The panel QR now encodes the stable releases/latest URL, which always resolves to the current release, so it stays correct without per-release regeneration.
abhay
changed the title
The iOS CI job's XCFramework cache key hashed `core/src/**`, which includes `core/src/bin/relay-server.rs` (the relay binary). The XCFramework is built from the cosign_core library and does not depend on the relay binary, so relay-only edits were invalidating the cache and forcing an ~18 minute from-scratch XCFramework rebuild even though no Swift-facing code changed. Narrow the key to the library sources (`core/src/*.rs` + the `.udl`), excluding `core/src/bin`. Now only real library or dependency changes (or a Cargo.lock change) rebuild the XCFramework; relay-only edits reuse the cache and the iOS job stays in its normal ~4 to 6 minute range.
abhay
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Homepage and relay changes, plus a CI cache fix, shipping together.
real browsers. The root overflow-x:hidden forced overflow-y to auto,
turning the root into a scroll container and breaking position:sticky;
switched to overflow-x:clip, restructured to full-viewport scrollytelling
with a trailing spacer, and hardened the cross-fade to pick the
most-visible beat by intersection ratio.
/favicon.svg and linked from the landing and privacy pages.
tagged release via a new GET /cosign/v1/release endpoint (fetches the
latest release, hashes its published BuildClaim.json for the fingerprint,
parses version/tag/commit, cached with a short TTL). The panel populates
from live data with a "View release" link, and the QR encodes the stable
releases/latest URL. On failure it leaves the placeholder untouched,
never fabricated data.
(core/src/bin) no longer invalidate it. It hashed core/src/**, so every
relay edit forced an ~18 min from-scratch XCFramework rebuild; now it keys
on the library sources only (core/src/*.rs + the .udl).