gh-15144: Fixed installing updates does not updating registries (gh-15181)

.github/workflows/build.yml

@@ -26,6 +26,11 @@ on:
         required: true
         type: "boolean"
         default: false
+      disable-pgo:
+        description: "Build without PGO (skips the profile generation stages)"
+        required: false
+        type: "boolean"
+        default: false
   workflow_call:
     inputs:
       create_release:
@@ -48,6 +53,11 @@ on:
         required: true
         type: "boolean"
         default: false
+      disable-pgo:
+        description: "Build without PGO (skips the profile generation stages)"
+        required: false
+        type: "boolean"
+        default: false
 
 jobs:
   buildid:
@@ -73,6 +83,7 @@ jobs:
           echo "create_release: ${{ inputs.create_release }}"
           echo "update_version: ${{ inputs.update_version }}"
           echo "use sccache: ${{ inputs.use-sccache }}"
+          echo "disable-pgo: ${{ inputs.disable-pgo }}"
           echo "update_branch: ${{ inputs.update_branch }}"
           echo "GITHUB_REPOSITORY: ${{ github.repository }}"
           echo "GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}"
@@ -102,14 +113,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download aws-cli
-        if: ${{ inputs.create_release && inputs.update_branch == 'release' }}
+        if: ${{ inputs.update_branch == 'release' }}
         run: |
           curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
           unzip awscliv2.zip
           sudo ./aws/install --update
 
       - name: Start self-hosted runner
-        if: ${{ inputs.create_release && inputs.update_branch == 'release' }}
+        if: ${{ inputs.update_branch == 'release' }}
         run: |
           echo "Starting self-hosted runner"
           echo "${{ secrets.SELF_HOSTED_RUNNER_START_SCRIPT }}" | base64 -d > start.sh
@@ -117,7 +128,7 @@ jobs:
           bash ./start.sh
 
       - name: Remove self-hosted runner script
-        if: always() && ${{ inputs.create_release && inputs.update_branch == 'release' }}
+        if: always() && ${{ inputs.update_branch == 'release' }}
         run: |
           echo "Removing self-hosted runner script"
           rm start.sh || true
@@ -280,12 +291,14 @@ jobs:
   windows-step-1:
     name: Windows build step 1 (PGO build)
     uses: ./.github/workflows/windows-release-build.yml
+    if: ${{ !inputs.disable-pgo }}
     needs: [build-data, buildid]
     permissions:
       contents: write
     secrets: inherit
     with:
       use-sccache: ${{ inputs.use-sccache }}
+      force-candidate: ${{ !inputs.create_release }}
       build-version: ${{ needs.build-data.outputs.version }}
       generate-pgo: true
       profile-data-path-archive: zen-windows-profile-data-and-jarlog.zip
@@ -295,11 +308,13 @@ jobs:
   windows-step-2:
     name: Windows build step 2 (Generate profile data)
     uses: ./.github/workflows/windows-profile-build.yml
+    if: ${{ !inputs.disable-pgo }}
     permissions:
       contents: write
     secrets: inherit
     needs: [windows-step-1, build-data]
     with:
+      force-candidate: ${{ !inputs.create_release }}
       build-version: ${{ needs.build-data.outputs.version }}
       profile-data-path-archive: zen.win64-pgo-stage-1.zip
       release-branch: ${{ inputs.update_branch }}
@@ -310,10 +325,14 @@ jobs:
     permissions:
       contents: write
     secrets: inherit
+    # windows-step-2 is skipped when PGO is disabled, so don't inherit its skip
+    if: ${{ !failure() && !cancelled() }}
     needs: [build-data, windows-step-2, start-self-host, buildid]
     with:
+      force-candidate: ${{ !inputs.create_release }}
       build-version: ${{ needs.build-data.outputs.version }}
       generate-pgo: false
+      disable-pgo: ${{ inputs.disable-pgo }}
       release-branch: ${{ inputs.update_branch }}
       MOZ_BUILD_DATE: ${{needs.buildid.outputs.buildids}}
       use-sccache: ${{ inputs.use-sccache }}
@@ -326,20 +345,24 @@ jobs:
     secrets: inherit
     needs: [build-data, start-self-host, buildid]
     with:
+      force-candidate: ${{ !inputs.create_release }}
       build-version: ${{ needs.build-data.outputs.version }}
       release-branch: ${{ inputs.update_branch }}
       MOZ_BUILD_DATE: ${{needs.buildid.outputs.buildids}}
       use-sccache: ${{ inputs.use-sccache }}
+      disable-pgo: ${{ inputs.disable-pgo }}
 
   mac-step-1:
     name: macOS build step 1 (PGO build)
     uses: ./.github/workflows/macos-release-build.yml
+    if: ${{ !inputs.disable-pgo }}
     needs: [build-data, buildid]
     permissions:
       contents: write
     secrets: inherit
     with:
       use-sccache: ${{ inputs.use-sccache }}
+      force-candidate: ${{ !inputs.create_release }}
       build-version: ${{ needs.build-data.outputs.version }}
       generate-pgo: true
       release-branch: ${{ inputs.update_branch }}
@@ -348,11 +371,13 @@ jobs:
   mac-step-2:
     name: macOS build step 2 (Generate profile data)
     uses: ./.github/workflows/macos-profile-build.yml
+    if: ${{ !inputs.disable-pgo }}
     permissions:
       contents: write
     secrets: inherit
     needs: [mac-step-1, build-data]
     with:
+      force-candidate: ${{ !inputs.create_release }}
       build-version: ${{ needs.build-data.outputs.version }}
       release-branch: ${{ inputs.update_branch }}
 
@@ -362,10 +387,14 @@ jobs:
     permissions:
       contents: write
     secrets: inherit
+    # mac-step-2 is skipped when PGO is disabled, so don't inherit its skip
+    if: ${{ !failure() && !cancelled() }}
     needs: [build-data, mac-step-2, start-self-host, buildid]
     with:
+      force-candidate: ${{ !inputs.create_release }}
       build-version: ${{ needs.build-data.outputs.version }}
       generate-pgo: false
+      disable-pgo: ${{ inputs.disable-pgo }}
       release-branch: ${{ inputs.update_branch }}
       MOZ_BUILD_DATE: ${{needs.buildid.outputs.buildids}}
       use-sccache: ${{ inputs.use-sccache }}
@@ -378,6 +407,7 @@ jobs:
     secrets: inherit
     needs: [build-data, mac-step-3]
     with:
+      force-candidate: ${{ !inputs.create_release }}
       build-version: ${{ needs.build-data.outputs.version }}
       release-branch: ${{ inputs.update_branch }}
 
@@ -470,14 +500,14 @@ jobs:
     if: always()
     steps:
       - name: Download aws-cli
-        if: ${{ inputs.create_release && inputs.update_branch == 'release' }}
+        if: ${{ inputs.update_branch == 'release' }}
         run: |
           curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
           unzip awscliv2.zip
           sudo ./aws/install --update
 
       - name: Stop self-hosted runner
-        if: ${{ inputs.create_release && inputs.update_branch == 'release' }}
+        if: ${{ inputs.update_branch == 'release' }}
         run: |
           echo "Stopping self-hosted runner"
           echo "${{ secrets.SELF_HOSTED_RUNNER_STOP_SCRIPT }}" | base64 -d > stop.sh
@@ -485,13 +515,12 @@ jobs:
           bash ./stop.sh > /dev/null
 
       - name: Remove self-hosted runner script
-        if: always() && ${{ inputs.create_release && inputs.update_branch == 'release' }}
+        if: always() && ${{ inputs.update_branch == 'release' }}
         run: |
           echo "Removing self-hosted runner script"
           rm stop.sh || true
 
   release:
-    if: ${{ inputs.create_release || inputs.update_branch == 'twilight' }}
     permissions: write-all
     name: Release
     needs:
@@ -585,6 +614,7 @@ jobs:
 
       - name: Commit
         uses: stefanzweifel/git-auto-commit-action@v5
+        if: ${{ inputs.create_release || inputs.update_branch == 'twilight' }}
         with:
           commit_message: 🚀 Update update manifests
           commit_user_name: Zen Browser Robot
@@ -628,9 +658,22 @@ jobs:
         env:
           GITHUB_REPOSITORY: ${{ github.repository }}
 
+      - name: Upload signed MAR files to workflow artifacts
+        if: ${{ inputs.update_branch == 'release' && !inputs.create_release }}
+        uses: actions/upload-artifact@v4
+        with:
+          retention-days: 5
+          name: signed-mar-files
+          path: |
+            ./linux.mar/*
+            ./linux-aarch64.mar/*
+            ./.github/workflows/object/windows-x64-signed-x86_64/windows.mar
+            ./.github/workflows/object/windows-x64-signed-arm64/windows-arm64.mar
+            ./macos.mar/*
+
       - name: Release
         uses: softprops/action-gh-release@v2.2.2
-        if: ${{ inputs.update_branch == 'release' }}
+        if: ${{ inputs.update_branch == 'release' && inputs.create_release }}
         with:
           token: ${{ secrets.DEPLOY_KEY }}
           tag_name: ${{ needs.build-data.outputs.version }}

.github/workflows/linux-release-build.yml

@@ -20,6 +20,19 @@ on:
         required: true
         type: boolean
         default: false
+      disable-pgo:
+        description: "Build without PGO at all"
+        required: false
+        type: boolean
+        default: false
+      force-candidate:
+        description: "Force building against the Firefox release candidate"
+        required: false
+        type: boolean
+        default: false
+
+env:
+  SURFER_FORCE_CANDIDATE: ${{ inputs.force-candidate && '1' || '' }}
 
 jobs:
   build-linux:
@@ -122,7 +135,7 @@ jobs:
           cd ..
 
       - name: Build (PGO stage 1 - generate)
-        if: ${{ matrix.arch == 'x86_64' }}
+        if: ${{ matrix.arch == 'x86_64' && !inputs.disable-pgo }}
         env:
           SURFER_COMPAT: ${{ matrix.arch }}
           ZEN_RELEASE_BRANCH: ${{ inputs.release-branch }}
@@ -139,7 +152,7 @@ jobs:
           bash .github/workflows/src/release-build.sh
 
       - name: Generate PGO profile data
-        if: ${{ matrix.arch == 'x86_64' }}
+        if: ${{ matrix.arch == 'x86_64' && !inputs.disable-pgo }}
         run: |
           set -x
           export DISPLAY=:2
@@ -157,6 +170,7 @@ jobs:
         env:
           SURFER_COMPAT: ${{ matrix.arch }}
           ZEN_RELEASE_BRANCH: ${{ inputs.release-branch }}
+          ZEN_GA_DISABLE_PGO: ${{ inputs.disable-pgo && '1' || '' }}
           ZEN_SAFEBROWSING_API_KEY: ${{ secrets.ZEN_SAFEBROWSING_API_KEY }}
           ZEN_MOZILLA_API_KEY: ${{ secrets.ZEN_MOZILLA_API_KEY }}
           ZEN_GOOGLE_LOCATION_SERVICE_API_KEY: ${{ secrets.ZEN_GOOGLE_LOCATION_SERVICE_API_KEY }}

.github/workflows/macos-profile-build.yml

@@ -14,6 +14,14 @@ on:
         description: "The branch to build"
         required: true
         type: string
+      force-candidate:
+        description: "Force building against the Firefox release candidate"
+        required: false
+        type: boolean
+        default: false
+
+env:
+  SURFER_FORCE_CANDIDATE: ${{ inputs.force-candidate && '1' || '' }}
 
 jobs:
   macos-profile-build:

.github/workflows/macos-release-build.yml

@@ -10,6 +10,11 @@ on:
         required: true
         type: boolean
         default: false
+      disable-pgo:
+        description: "Build without PGO at all"
+        required: false
+        type: boolean
+        default: false
       build-version:
         description: "The version to build"
         required: true
@@ -27,6 +32,14 @@ on:
         required: true
         type: boolean
         default: false
+      force-candidate:
+        description: "Force building against the Firefox release candidate"
+        required: false
+        type: boolean
+        default: false
+
+env:
+  SURFER_FORCE_CANDIDATE: ${{ inputs.force-candidate && '1' || '' }}
 
 jobs:
   mac-build:
@@ -140,13 +153,13 @@ jobs:
 
       - name: Download artifact (if use profdata)
         uses: actions/download-artifact@v4
-        if: ${{ !inputs.generate-pgo }}
+        if: ${{ !inputs.generate-pgo && !inputs.disable-pgo }}
         with:
           path: ~/artifact
           name: macos-profdata-${{ matrix.arch }}
 
       - name: Show artifact info
-        if: ${{ !inputs.generate-pgo }}
+        if: ${{ !inputs.generate-pgo && !inputs.disable-pgo }}
         run: |
           ls ~/artifact
           ls ~/artifact/en-US.log
@@ -166,6 +179,9 @@ jobs:
           if test ${{ inputs.generate-pgo }} = true; then
             export ZEN_GA_GENERATE_PROFILE=1
           fi
+          if test ${{ inputs.disable-pgo }} = true; then
+            export ZEN_GA_DISABLE_PGO=1
+          fi
           if [[ -n ${{ inputs.MOZ_BUILD_DATE }} ]];then
             export MOZ_BUILD_DATE=${{ inputs.MOZ_BUILD_DATE }}
           fi

.github/workflows/macos-universal-release-build.yml

@@ -11,6 +11,14 @@ on:
         description: "The branch to build"
         required: true
         type: string
+      force-candidate:
+        description: "Force building against the Firefox release candidate"
+        required: false
+        type: boolean
+        default: false
+
+env:
+  SURFER_FORCE_CANDIDATE: ${{ inputs.force-candidate && '1' || '' }}
 
 jobs:
   mac-build:

.github/workflows/windows-profile-build.yml

@@ -18,6 +18,14 @@ on:
         description: "The branch to build"
         required: true
         type: string
+      force-candidate:
+        description: "Force building against the Firefox release candidate"
+        required: false
+        type: boolean
+        default: false
+
+env:
+  SURFER_FORCE_CANDIDATE: ${{ inputs.force-candidate && '1' || '' }}
 
 jobs:
   windows-profile-build:

.github/workflows/windows-release-build.yml

@@ -10,6 +10,11 @@ on:
         required: true
         type: boolean
         default: false
+      disable-pgo:
+        description: "Build without PGO at all"
+        required: false
+        type: boolean
+        default: false
       build-version:
         description: "The version to build"
         required: true
@@ -30,6 +35,13 @@ on:
         required: true
         type: boolean
         default: false
+      force-candidate:
+        description: "Force building against the Firefox release candidate"
+        required: false
+        type: boolean
+        default: false
+env:
+  SURFER_FORCE_CANDIDATE: ${{ inputs.force-candidate && '1' || '' }}
 
 jobs:
   windows-build:
@@ -215,13 +227,13 @@ jobs:
 
       - name: Download artifact (if use profdata)
         uses: actions/download-artifact@v4
-        if: ${{ !inputs.generate-pgo && matrix.arch == 'x86_64' }}
+        if: ${{ !inputs.generate-pgo && !inputs.disable-pgo && matrix.arch == 'x86_64' }}
         with:
           path: ~/artifact
           name: windows-profdata-${{ matrix.arch == 'aarch64' && 'arm64' || matrix.arch }}
 
       - name: Show artifact info
-        if: ${{ !inputs.generate-pgo && matrix.arch == 'x86_64' }}
+        if: ${{ !inputs.generate-pgo && !inputs.disable-pgo && matrix.arch == 'x86_64' }}
         run: |
           ls ~/artifact
           ls ~/artifact/en-US.log
@@ -246,6 +258,9 @@ jobs:
           if test ${{ inputs.generate-pgo }} = true; then
             export ZEN_GA_GENERATE_PROFILE=1
           fi
+          if test ${{ inputs.disable-pgo }} = true; then
+            export ZEN_GA_DISABLE_PGO=1
+          fi
           if [[ -n ${{ inputs.MOZ_BUILD_DATE }} ]];then
             export MOZ_BUILD_DATE=${{ inputs.MOZ_BUILD_DATE }}
           fi