From 0e2e07370cf17e692e008fd369c73ba0f275208e Mon Sep 17 00:00:00 2001 From: Joyce Bansode Date: Tue, 13 Oct 2026 16:37:23 +0530 Subject: [PATCH 1/3] checksum build --- .github/workflows/ci.yml | 65 +++++++++++++++++++++++++++++++++++++++- 1 file changed, 64 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bb13c8b63..e04a6a24c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -183,7 +183,7 @@ jobs: - name: "Upload Artifact" uses: actions/upload-artifact@v7 with: - path: acli + path: native-acli-${{ matrix.platform }}.tar.gz name: native-acli-${{ matrix.platform }} - name: Release uses: softprops/action-gh-release@v3 @@ -191,6 +191,66 @@ jobs: with: files: native-acli-${{ matrix.platform }}.tar.gz + build-checksums: + runs-on: ubuntu-24.04 + if: startsWith(github.ref, 'refs/tags/') + needs: + - build-release + - build-native + permissions: + contents: write + # No checkout in this job, so gh needs an explicit repo and token. + env: + GH_TOKEN: ${{ github.token }} + GH_REPO: ${{ github.repository }} + steps: + - name: Download release artifacts + uses: actions/download-artifact@v8 + with: + path: artifacts + - name: Assert release artifact basenames are unique + run: | + # Excludes SHA256SUMS: on a re-run, the artifact from the previous attempt is present. + dupes=$(find artifacts -type f ! -name SHA256SUMS -printf '%f\n' | sort | uniq -d) + if [ -n "$dupes" ]; then + echo "::error::Release artifacts share a basename: $dupes" + exit 1 + fi + - name: Generate SHA256SUMS + run: | + # Flatten into a sibling directory; flattening in place collides on acli.phar/acli.phar. + mkdir manifest + find artifacts -type f ! -name SHA256SUMS -exec mv {} manifest/ \; + (cd manifest && sha256sum * > ../SHA256SUMS) + cat SHA256SUMS + - name: Download published release assets + run: gh release download "$GITHUB_REF_NAME" --dir released + - name: Verify manifest against published assets + working-directory: released + run: | + sha256sum --check ../SHA256SUMS + # shasum is the macOS tool; this exercises its parser without a macOS runner. + shasum -a 256 --check ../SHA256SUMS + - name: Assert manifest lists exactly the release assets + run: | + gh release view "$GITHUB_REF_NAME" --json assets --jq '.assets[].name' | grep -vx SHA256SUMS | sort > assets.txt + awk '{print $2}' SHA256SUMS | sort > listed.txt + diff assets.txt listed.txt + # Upload before attaching: if the attach step fails, this is the only surviving + # copy of the verified manifest (a rebuild would not reproduce the same tarballs). + - name: Store checksum manifest in Actions + uses: actions/upload-artifact@v7 + with: + name: SHA256SUMS + path: SHA256SUMS + overwrite: true + - name: Attach SHA256SUMS to release + uses: softprops/action-gh-release@v3 + with: + files: SHA256SUMS + - name: Assert SHA256SUMS is attached to the release + run: gh release view "$GITHUB_REF_NAME" --json assets --jq '.assets[].name' | grep -qx SHA256SUMS + # Require all checks to pass without having to enumerate them in the branch protection UI. # @see https://github.community/t/is-it-possible-to-require-all-github-actions-tasks-to-pass-without-enumerating-them/117957 check: @@ -199,9 +259,12 @@ jobs: - test - build-release - build-native + - build-checksums runs-on: ubuntu-24.04 steps: - name: Decide whether the needed jobs succeeded or failed uses: re-actors/alls-green@release/v1 with: jobs: ${{ toJSON(needs) }} + # build-checksums only runs for tags, so it is skipped on every PR and push. + allowed-skips: build-checksums From 976c2ca1e1d6634b189691c04065186ba3258d96 Mon Sep 17 00:00:00 2001 From: Joyce Bansode Date: Wed, 14 Oct 2026 16:27:11 +0530 Subject: [PATCH 2/3] updated the workflows --- .github/workflows/ci.yml | 29 +++++++++++++---------------- 1 file changed, 13 insertions(+), 16 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e04a6a24c..ae02f06f4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -204,25 +204,24 @@ jobs: GH_TOKEN: ${{ github.token }} GH_REPO: ${{ github.repository }} steps: - - name: Download release artifacts + - name: Download PHAR artifact uses: actions/download-artifact@v8 with: - path: artifacts - - name: Assert release artifact basenames are unique - run: | - # Excludes SHA256SUMS: on a re-run, the artifact from the previous attempt is present. - dupes=$(find artifacts -type f ! -name SHA256SUMS -printf '%f\n' | sort | uniq -d) - if [ -n "$dupes" ]; then - echo "::error::Release artifacts share a basename: $dupes" - exit 1 - fi + name: acli.phar + path: manifest + - name: Download Linux artifact + uses: actions/download-artifact@v8 + with: + name: native-acli-linux-x86_64 + path: manifest + - name: Download macOS artifact + uses: actions/download-artifact@v8 + with: + name: native-acli-macos-aarch64 + path: manifest - name: Generate SHA256SUMS run: | - # Flatten into a sibling directory; flattening in place collides on acli.phar/acli.phar. - mkdir manifest - find artifacts -type f ! -name SHA256SUMS -exec mv {} manifest/ \; (cd manifest && sha256sum * > ../SHA256SUMS) - cat SHA256SUMS - name: Download published release assets run: gh release download "$GITHUB_REF_NAME" --dir released - name: Verify manifest against published assets @@ -236,8 +235,6 @@ jobs: gh release view "$GITHUB_REF_NAME" --json assets --jq '.assets[].name' | grep -vx SHA256SUMS | sort > assets.txt awk '{print $2}' SHA256SUMS | sort > listed.txt diff assets.txt listed.txt - # Upload before attaching: if the attach step fails, this is the only surviving - # copy of the verified manifest (a rebuild would not reproduce the same tarballs). - name: Store checksum manifest in Actions uses: actions/upload-artifact@v7 with: From 394e74fb32608ae97b43b8578f41107c6597a719 Mon Sep 17 00:00:00 2001 From: Joyce Bansode Date: Thu, 22 Oct 2026 20:58:33 +0530 Subject: [PATCH 3/3] Scope checksum artifact download --- .github/workflows/ci.yml | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ae02f06f4..4e60f49c1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -204,21 +204,21 @@ jobs: GH_TOKEN: ${{ github.token }} GH_REPO: ${{ github.repository }} steps: - - name: Download PHAR artifact + - name: Download release artifacts uses: actions/download-artifact@v8 with: - name: acli.phar - path: manifest - - name: Download Linux artifact - uses: actions/download-artifact@v8 - with: - name: native-acli-linux-x86_64 - path: manifest - - name: Download macOS artifact - uses: actions/download-artifact@v8 - with: - name: native-acli-macos-aarch64 - path: manifest + pattern: '{acli.phar,native-acli-*}' + path: artifacts + - name: Assert unique basenames and flatten + run: | + dupes=$(find artifacts -type f -printf '%f\n' | sort | uniq -d) + if [ -n "$dupes" ]; then + echo "::error::Artifact basename collision: $dupes" + exit 1 + fi + # Flatten into a sibling directory; flattening in place collides on acli.phar/acli.phar. + mkdir manifest + find artifacts -type f -exec mv {} manifest/ \; - name: Generate SHA256SUMS run: | (cd manifest && sha256sum * > ../SHA256SUMS)