From b62981ff80f63798721debdda7c462784b688f07 Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Tue, 18 Aug 2026 07:00:42 -0400 Subject: [PATCH] fix(build): anchor pack/push scripts to their own repo root (0038d46 pattern, all seven) Secrets/push.sh, Theme/pack.sh+push.sh, Audit/pack.sh+push.sh and Auth/pack.sh+push.sh all carried the CWD-pack bug LocalDb's push.sh was cured of in 0038d46: a bare 'dotnet pack -c Release -o ./artifacts' packs whatever solution sits in the CALLER's working directory, and the push scripts then shove the caller's ./artifacts/*.nupkg onto the live Gitea feed (the incident that briefly published 25 unrelated packages). Each script now cds to its own repo root, names its .slnx explicitly, writes to an absolute artifacts path, and (push.sh) pushes an anchored glob. Verified by bash -n on all seven plus a positive control: Audit's pack.sh run from a foreign CWD packed only ZB.MOM.WW.Audit into its own artifacts dir and left the caller's directory untouched. Push scripts deliberately NOT executed (they publish); pack half verified only. Closes ScadaBridge deferred-work register row 42 (cross-repo). --- ZB.MOM.WW.Audit/build/pack.sh | 8 +++++++- ZB.MOM.WW.Audit/build/push.sh | 15 +++++++++++++-- ZB.MOM.WW.Auth/build/pack.sh | 8 +++++++- ZB.MOM.WW.Auth/build/push.sh | 15 +++++++++++++-- ZB.MOM.WW.Secrets/build/push.sh | 15 +++++++++++++-- ZB.MOM.WW.Theme/build/pack.sh | 8 +++++++- ZB.MOM.WW.Theme/build/push.sh | 15 +++++++++++++-- 7 files changed, 73 insertions(+), 11 deletions(-) diff --git a/ZB.MOM.WW.Audit/build/pack.sh b/ZB.MOM.WW.Audit/build/pack.sh index 68d2b48..36166ff 100755 --- a/ZB.MOM.WW.Audit/build/pack.sh +++ b/ZB.MOM.WW.Audit/build/pack.sh @@ -1,4 +1,10 @@ #!/usr/bin/env bash # pack.sh — produce the ZB.MOM.WW.Audit NuGet package into ./artifacts. set -euo pipefail -dotnet pack -c Release -o ./artifacts +# cd to the repo root and name the solution + an absolute output path: `dotnet pack` with +# neither a project argument nor a fixed working directory packs whatever solution happens +# to sit in the CALLER's directory (the bug behind the LocalDb feed incident, 0038d46). +REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +cd "$REPO_ROOT" + +dotnet pack ZB.MOM.WW.Audit.slnx -c Release -o "$REPO_ROOT/artifacts" diff --git a/ZB.MOM.WW.Audit/build/push.sh b/ZB.MOM.WW.Audit/build/push.sh index a9f5a77..6937805 100755 --- a/ZB.MOM.WW.Audit/build/push.sh +++ b/ZB.MOM.WW.Audit/build/push.sh @@ -16,9 +16,20 @@ set -euo pipefail : "${GITEA_NUGET_SOURCE:?set GITEA_NUGET_SOURCE to your Gitea NuGet feed URL}" : "${GITEA_NUGET_KEY:?set GITEA_NUGET_KEY to your Gitea access token}" -dotnet pack -c Release -o ./artifacts +# Named solution, named output, and a cd to the repo root, all for one reason: `dotnet pack` +# with neither a project argument nor a fixed working directory packs whatever solution +# happens to sit in the CALLER's directory — and then pushes it to a live feed under this +# script's name. Invoked by absolute path from another repo's checkout, the relative form +# packed and published 25 unrelated packages (LocalDb's copy of this script, fixed in +# 0038d46; recovered with `dotnet nuget delete`, but only because the token happened to +# carry delete rights). A publish script must be unambiguous about WHAT it publishes no +# matter where it is run. +REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +cd "$REPO_ROOT" -dotnet nuget push "./artifacts/*.nupkg" \ +dotnet pack ZB.MOM.WW.Audit.slnx -c Release -o "$REPO_ROOT/artifacts" + +dotnet nuget push "$REPO_ROOT/artifacts/*.nupkg" \ --source "$GITEA_NUGET_SOURCE" \ --api-key "$GITEA_NUGET_KEY" \ --skip-duplicate diff --git a/ZB.MOM.WW.Auth/build/pack.sh b/ZB.MOM.WW.Auth/build/pack.sh index 471e865..5f3e422 100755 --- a/ZB.MOM.WW.Auth/build/pack.sh +++ b/ZB.MOM.WW.Auth/build/pack.sh @@ -6,4 +6,10 @@ set -euo pipefail -dotnet pack -c Release -o ./artifacts +# cd to the repo root and name the solution + an absolute output path: `dotnet pack` with +# neither a project argument nor a fixed working directory packs whatever solution happens +# to sit in the CALLER's directory (the bug behind the LocalDb feed incident, 0038d46). +REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +cd "$REPO_ROOT" + +dotnet pack ZB.MOM.WW.Auth.slnx -c Release -o "$REPO_ROOT/artifacts" diff --git a/ZB.MOM.WW.Auth/build/push.sh b/ZB.MOM.WW.Auth/build/push.sh index c4a2a55..3d0e069 100755 --- a/ZB.MOM.WW.Auth/build/push.sh +++ b/ZB.MOM.WW.Auth/build/push.sh @@ -16,9 +16,20 @@ set -euo pipefail : "${GITEA_NUGET_SOURCE:?set GITEA_NUGET_SOURCE to your Gitea NuGet feed URL}" : "${GITEA_NUGET_KEY:?set GITEA_NUGET_KEY to your Gitea access token}" -dotnet pack -c Release -o ./artifacts +# Named solution, named output, and a cd to the repo root, all for one reason: `dotnet pack` +# with neither a project argument nor a fixed working directory packs whatever solution +# happens to sit in the CALLER's directory — and then pushes it to a live feed under this +# script's name. Invoked by absolute path from another repo's checkout, the relative form +# packed and published 25 unrelated packages (LocalDb's copy of this script, fixed in +# 0038d46; recovered with `dotnet nuget delete`, but only because the token happened to +# carry delete rights). A publish script must be unambiguous about WHAT it publishes no +# matter where it is run. +REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +cd "$REPO_ROOT" -dotnet nuget push "./artifacts/*.nupkg" \ +dotnet pack ZB.MOM.WW.Auth.slnx -c Release -o "$REPO_ROOT/artifacts" + +dotnet nuget push "$REPO_ROOT/artifacts/*.nupkg" \ --source "$GITEA_NUGET_SOURCE" \ --api-key "$GITEA_NUGET_KEY" \ --skip-duplicate diff --git a/ZB.MOM.WW.Secrets/build/push.sh b/ZB.MOM.WW.Secrets/build/push.sh index 5454f4e..0230c12 100755 --- a/ZB.MOM.WW.Secrets/build/push.sh +++ b/ZB.MOM.WW.Secrets/build/push.sh @@ -16,9 +16,20 @@ set -euo pipefail : "${GITEA_NUGET_SOURCE:?set GITEA_NUGET_SOURCE to your Gitea NuGet feed URL}" : "${GITEA_NUGET_KEY:?set GITEA_NUGET_KEY to your Gitea access token}" -dotnet pack -c Release -o ./artifacts +# Named solution, named output, and a cd to the repo root, all for one reason: `dotnet pack` +# with neither a project argument nor a fixed working directory packs whatever solution +# happens to sit in the CALLER's directory — and then pushes it to a live feed under this +# script's name. Invoked by absolute path from another repo's checkout, the relative form +# packed and published 25 unrelated packages (LocalDb's copy of this script, fixed in +# 0038d46; recovered with `dotnet nuget delete`, but only because the token happened to +# carry delete rights). A publish script must be unambiguous about WHAT it publishes no +# matter where it is run. +REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +cd "$REPO_ROOT" -dotnet nuget push "./artifacts/*.nupkg" \ +dotnet pack ZB.MOM.WW.Secrets.slnx -c Release -o "$REPO_ROOT/artifacts" + +dotnet nuget push "$REPO_ROOT/artifacts/*.nupkg" \ --source "$GITEA_NUGET_SOURCE" \ --api-key "$GITEA_NUGET_KEY" \ --skip-duplicate diff --git a/ZB.MOM.WW.Theme/build/pack.sh b/ZB.MOM.WW.Theme/build/pack.sh index c166ead..c89b19c 100755 --- a/ZB.MOM.WW.Theme/build/pack.sh +++ b/ZB.MOM.WW.Theme/build/pack.sh @@ -6,4 +6,10 @@ set -euo pipefail -dotnet pack -c Release -o ./artifacts +# cd to the repo root and name the solution + an absolute output path: `dotnet pack` with +# neither a project argument nor a fixed working directory packs whatever solution happens +# to sit in the CALLER's directory (the bug behind the LocalDb feed incident, 0038d46). +REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +cd "$REPO_ROOT" + +dotnet pack ZB.MOM.WW.Theme.slnx -c Release -o "$REPO_ROOT/artifacts" diff --git a/ZB.MOM.WW.Theme/build/push.sh b/ZB.MOM.WW.Theme/build/push.sh index cd1ce5d..3a70c51 100755 --- a/ZB.MOM.WW.Theme/build/push.sh +++ b/ZB.MOM.WW.Theme/build/push.sh @@ -16,9 +16,20 @@ set -euo pipefail : "${GITEA_NUGET_SOURCE:?set GITEA_NUGET_SOURCE to your Gitea NuGet feed URL}" : "${GITEA_NUGET_KEY:?set GITEA_NUGET_KEY to your Gitea access token}" -dotnet pack -c Release -o ./artifacts +# Named solution, named output, and a cd to the repo root, all for one reason: `dotnet pack` +# with neither a project argument nor a fixed working directory packs whatever solution +# happens to sit in the CALLER's directory — and then pushes it to a live feed under this +# script's name. Invoked by absolute path from another repo's checkout, the relative form +# packed and published 25 unrelated packages (LocalDb's copy of this script, fixed in +# 0038d46; recovered with `dotnet nuget delete`, but only because the token happened to +# carry delete rights). A publish script must be unambiguous about WHAT it publishes no +# matter where it is run. +REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +cd "$REPO_ROOT" -dotnet nuget push "./artifacts/*.nupkg" \ +dotnet pack ZB.MOM.WW.Theme.slnx -c Release -o "$REPO_ROOT/artifacts" + +dotnet nuget push "$REPO_ROOT/artifacts/*.nupkg" \ --source "$GITEA_NUGET_SOURCE" \ --api-key "$GITEA_NUGET_KEY" \ --skip-duplicate