Jatin K MalikandGitHub
1f121546fb
* fix(release): attach the snap to GitHub Releases v0.17.0 packed the snap, then Store review of uinput failed the job, so the file never reached the tag. Build and attach first. A Store hold is a warning, not a failed release. SHA256SUMS covers the .snap. snap-backfill.yml rebuilds an existing tag, appends the snap to the manifest, and attests only that file. * fix(release): keep snap tags out of the shell and fail real Store errors Pass the tag through the environment like verify-release.yml. Treat only an allow-installation review as a successful Store publish. snap-backfill runs verify_release.py after it rewrites SHA256SUMS. * style(test): format snap-backfill shell-injection guard with black
102 lines
3.1 KiB
YAML
102 lines
3.1 KiB
YAML
name: Attach snap to an existing release
|
|
|
|
# v0.17.0 built the snap and then lost it: Store review failed the job, and
|
|
# the workflow did not attach the .snap to the GitHub Release. Run this after
|
|
# that policy change for a tag that already exists:
|
|
# gh workflow run snap-backfill.yml -f tag=v0.17.0
|
|
#
|
|
# Attests only the snap. Other release assets keep the original provenance.
|
|
# Caller-supplied tag values stay in the environment, never in run: source.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: "Release tag to attach the snap to (e.g. v0.17.0)"
|
|
required: true
|
|
type: string
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
backfill:
|
|
name: Build, attach, checksum, attest
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
id-token: write
|
|
attestations: write
|
|
steps:
|
|
- name: Require a version tag
|
|
env:
|
|
TAG: ${{ inputs.tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
case "$TAG" in
|
|
v[0-9]*) ;;
|
|
*)
|
|
echo "refusing tag that is not v<digit>…: $TAG" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
if printf '%s' "$TAG" | grep -q '[^A-Za-z0-9._-]'; then
|
|
echo "refusing tag with unexpected characters: $TAG" >&2
|
|
exit 1
|
|
fi
|
|
|
|
- name: Checkout the tagged commit
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ inputs.tag }}
|
|
|
|
- name: Build snap
|
|
id: build
|
|
uses: snapcore/action-build@3bdaa03e1ba6bf59a65f84a751d943d549a54e79 # v1
|
|
|
|
- name: Stage the snap and extend SHA256SUMS
|
|
id: stage
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
TAG: ${{ inputs.tag }}
|
|
SNAP_PATH: ${{ steps.build.outputs.snap }}
|
|
run: |
|
|
set -euo pipefail
|
|
mkdir -p dist
|
|
test -f "$SNAP_PATH"
|
|
name=$(basename "$SNAP_PATH")
|
|
cp -v "$SNAP_PATH" "dist/$name"
|
|
echo "name=$name" >> "$GITHUB_OUTPUT"
|
|
gh release download "$TAG" --pattern SHA256SUMS --output dist/SHA256SUMS
|
|
grep -v " ${name}$" dist/SHA256SUMS > dist/SHA256SUMS.next || true
|
|
(cd dist && sha256sum -- "$name") >> dist/SHA256SUMS.next
|
|
mv dist/SHA256SUMS.next dist/SHA256SUMS
|
|
cat dist/SHA256SUMS
|
|
|
|
- name: Attest the snap
|
|
uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
|
|
with:
|
|
subject-path: dist/${{ steps.stage.outputs.name }}
|
|
|
|
- name: Attach snap and SHA256SUMS
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
TAG: ${{ inputs.tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
gh release upload "$TAG" dist/*.snap dist/SHA256SUMS --clobber
|
|
|
|
verify:
|
|
name: Verify the published release
|
|
needs: backfill
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
attestations: read
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
- env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
TAG: ${{ inputs.tag }}
|
|
run: python3 scripts/verify_release.py "$TAG"
|