Sergey SilaevandGitHub
923bc42708
* fix(ci): verify a release whose run failed after publishing * fix(ci): only forgive a confirmed 404 when verifying a published release
37 lines
1.3 KiB
YAML
37 lines
1.3 KiB
YAML
name: Verify Published Release
|
|
|
|
# The guards in tests/ read workflow files, so none of them can see a release
|
|
# once its run has finished. This runs scripts/verify_release.py against the
|
|
# real thing. It cannot see a later hand edit either, so re-run it by hand
|
|
# after one: `just verify-release`.
|
|
on:
|
|
workflow_run:
|
|
workflows: [Release]
|
|
types: [completed]
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: 'Tag to verify (default: the latest stable release)'
|
|
required: false
|
|
type: string
|
|
|
|
permissions:
|
|
contents: read
|
|
attestations: read
|
|
|
|
jobs:
|
|
verify:
|
|
name: Verify the published release
|
|
runs-on: ubuntu-latest
|
|
# No conclusion guard: v0.17.0 published seven assets from a run that
|
|
# failed on publish-snap, and the guard skipped it. --if-published covers
|
|
# the other direction, a run that published nothing.
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
# Through the environment: a dispatch input is caller supplied text.
|
|
TAG: ${{ inputs.tag || github.event.workflow_run.head_branch }}
|
|
IF_PUBLISHED: ${{ github.event_name == 'workflow_run' && '--if-published' || '' }}
|
|
run: python3 scripts/verify_release.py "$TAG" ${IF_PUBLISHED:+"$IF_PUBLISHED"}
|