46c7914639
* feat(ci): verify the published release, not just the workflow * fix(ci): filter attestations by predicate, name a missing distribution Two findings from review on #791. The attestations query accepted any predicate, so an SBOM would have read as build provenance while `gh attestation verify`, the command the notes hand users, rejected the artifact. It now sends the same `predicate_type=https://slsa.dev/provenance/v1`. Checked on a real digest: the SLSA filter returns the bundle, a foreign predicate returns 404. check_pypi compared whatever distributions were left, so a release that lost its sdist passed on the wheel alone. Each expected suffix is now named when absent. The lazy urllib import moved past the early return, where it belonged. The other two findings do not hold. `workflow_run.head_branch` carries the tag for a tag-triggered run: the last four release runs report v0.16.2, v0.16.1, v0.16.0 and v0.15.0. And `host_env()` is for the app spawning host binaries out of an AppImage; `scripts/` is in no `packages` entry and the AppImage build never references it, so this cannot run from a bundle. * fix(ci): read release digests from the REST API gh release view --json assets omits digest on gh 2.46, which is what many distros ship and what just verify-release often runs, so every asset failed as undigested. Pull the release through gh api instead, treat a null body as notes FAIL, and prefer removeprefix for the tag. * fix(ci): fail verify when PyPI has an extra distribution Matching release digests alone left a differently named wheel or sdist on PyPI unchecked. Reject those extras too, same suffixes. * fix(test): clear tempfile mock before urllib import Other suites leave a MagicMock in sys.modules['tempfile'], which breaks urllib.request import with a metaclass conflict in the extra PyPI distribution check. Drop the stub (and stale urllib modules) first, and assert the full problem list. * fix(ci): restore real tempfile before urllib in verify test The MagicMock tempfile left by recognition_manager still broke urllib.error on CI. Put the real module back and drop cached urllib packages before the import. --------- Co-authored-by: Jatin K Malik <jatinkrmalik@gmail.com>
35 lines
1.2 KiB
YAML
35 lines
1.2 KiB
YAML
name: Verify Published Release
|
|
|
|
# The guards in tests/ read workflow files, so none of them can see a release
|
|
# once its run has finished. This runs scripts/verify_release.py against the
|
|
# real thing. It cannot see a later hand edit either, so re-run it by hand
|
|
# after one: `just verify-release`.
|
|
on:
|
|
workflow_run:
|
|
workflows: [Release]
|
|
types: [completed]
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: 'Tag to verify (default: the latest stable release)'
|
|
required: false
|
|
type: string
|
|
|
|
permissions:
|
|
contents: read
|
|
attestations: read
|
|
|
|
jobs:
|
|
verify:
|
|
name: Verify the published release
|
|
runs-on: ubuntu-latest
|
|
# A failed release run has already said so, and half a release cannot verify.
|
|
if: github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success'
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
# Through the environment: a dispatch input is caller supplied text.
|
|
TAG: ${{ inputs.tag || github.event.workflow_run.head_branch }}
|
|
run: python3 scripts/verify_release.py "$TAG"
|