fix(release): execute publication request safely

.gitea/workflows/release.yml

@@ -194,13 +194,13 @@ jobs:
               ;;
           esac
           METHOD="$(printf '%s' "${REQUEST}" | python3 -c "import json,sys; print(json.load(sys.stdin)['method'])")"
-          PATH="$(printf '%s' "${REQUEST}" | python3 -c "import json,sys; print(json.load(sys.stdin)['path'])")"
+          RELEASE_PATH="$(printf '%s' "${REQUEST}" | python3 -c "import json,sys; print(json.load(sys.stdin)['path'])")"
           PAYLOAD="$(printf '%s' "${REQUEST}" | python3 -c "import json,sys; print(json.dumps(json.load(sys.stdin)['payload']))")"
           curl --fail --silent --show-error -X "${METHOD}" \
             -H "Authorization: token ${GITEA_PUBLISH_TOKEN}" \
             -H "Content-Type: application/json" \
             -d "${PAYLOAD}" \
-            "https://git.bongbetic.com/api/v1/repos/xavierk/Fenris${PATH}"
+            "https://git.bongbetic.com/api/v1/repos/xavierk/Fenris${RELEASE_PATH}"
 
       - name: Attach artifacts to release
         env:

packaging/release-footer.md

@@ -11,7 +11,7 @@ sudo zypper install fenris                       # openSUSE Tumbleweed
 ## Verify downloads
 
 ```bash
-gpg --verify SHA256SUMS.asc SHA256SUMS
+gpg --output SHA256SUMS --decrypt SHA256SUMS.asc
 sha256sum -c SHA256SUMS
 ```
 

tests/test_changelog.py

@@ -70,6 +70,15 @@ def test_checked_in_changelog_keeps_unreleased_first_and_categories_limited():
     assert set(categories) <= {"Added", "Changed", "Fixed"}
 
 
+def test_release_footer_verifies_the_clearsigned_checksum_asset():
+    footer = (REPO_ROOT / "packaging" / "release-footer.md").read_text(
+        encoding="utf-8"
+    )
+
+    assert "gpg --output SHA256SUMS --decrypt SHA256SUMS.asc" in footer
+    assert "sha256sum -c SHA256SUMS" in footer
+
+
 @pytest.mark.parametrize(
     ("changelog", "expected_error"),
     [

tests/test_release.py

@@ -337,6 +337,8 @@ class TestCIWorkflow:
             "Workflow must make the create-versus-update decision through the request seam"
         assert '"${METHOD}"' in content, \
             "Workflow must execute the helper-selected create-or-update request"
+        assert 'RELEASE_PATH="$(printf' in content and '\n          PATH="$(printf' not in content, \
+            "Workflow must not overwrite the shell PATH while preparing the request URL"
 
 
 # ---------------------------------------------------------------------------