How to interpret the Build Number?

[Unknown78]

Based on https://www.systeminformer.com/canary

It states that

Build: 3.2.25070.332
Built: Tuesday, 11th of March, 2025

---

1. What are the digits separated by the dot represents?
2. How does that relates to the workflow number and commit hash?
3. Where to find its build artifacts within the actions page?

[jxy-s]

3.2.25070.332

Value	Moniker	Description
3	Major	Major Version
2	Minor	Minor Version
25070	YYDDD	YY = year, DDD = day of year
332	hhMM	hh = hour, MM = minute

1. As above, times are UTC.
2. Not related to commit hash, but this can be found in Help > About
3. Builds are here: https://github.com/winsiderss/si-builds

[tildebyte]

Builds are here: winsiderss/si-builds

It might be helpful to new users to surface this in the readme (for that matter, maybe even https://github.com/winsiderss/si-builds/releases instead).

I was very confused at seeing that the last build in this repo was nearly a decade ago 😛

P.S. I don't know why I've never considered having a separate build repo - it's actually a very good idea.

[dmex]

@Unknown78 If you review the permissions required for CI and other services like Actions, you'll notice they allow write access to your repository. So you need a separate repo to isolate third party services like CI (and it also has the benefit of separate release notifications with master containing only stable releases while the other repo containing daily spam of canary builds).

[Unknown78]

@dmex Has there ever been a real case where third-party services wrecked any repositories?

[tildebyte]

@Unknown78 Do you read the news?

[Unknown78]

@tildebyte Ah, okay. I just did. Those supply chain attacks were disastrous.

[dmex]

@Unknown78

There's been several hundred major incidents? Some very recent cases include:

• The SolarWinds cyber attack inserted malicious code into source repositories used by the company and over several months the attackers were able to compromise security of several thousand organizations including Microsoft and multiple governments. This case is well documented and you can google the details.
• 2 months ago... tokens with write access to a source repository were used to insert malicious code into a repository of a github action and compromised the tokens and keys for 23,000 projects, repositories, and libraries hosted on Github: https://www.bleepingcomputer.com/news/security/supply-chain-attack-on-popular-github-action-exposes-ci-cd-secrets/
• 18 days ago... an "attack that compromised at least three software providers with malware that remained dormant for six years" and "500 e-commerce sites that rely on the backdoored software were infected, and it’s possible that the true number is double that" https://arstechnica.com/security/2025/05/hundreds-of-e-commerce-sites-hacked-in-supply-chain-attack/