Skip to content

Proposed checksum verification #2053

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bansodejoyce wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Proposed checksum verification #2053

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0e2e073
checksum build
bansodejoyce Oct 13, 2026
976c2ca
updated the workflows
bansodejoyce Oct 14, 2026
7fda3ec
Merge branch 'main' into feature/checksum-build
bansodejoyce Oct 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 61 additions & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,14 +183,71 @@ jobs:
- name: "Upload Artifact"
uses: actions/upload-artifact@v7
with:
path: acli
path: native-acli-${{ matrix.platform }}.tar.gz
name: native-acli-${{ matrix.platform }}
- name: Release
uses: softprops/action-gh-release@v3
if: startsWith(github.ref, 'refs/tags/')
with:
files: native-acli-${{ matrix.platform }}.tar.gz

build-checksums:
runs-on: ubuntu-24.04
if: startsWith(github.ref, 'refs/tags/')
needs:
- build-release
- build-native
permissions:
contents: write
# No checkout in this job, so gh needs an explicit repo and token.
env:
GH_TOKEN: ${{ github.token }}
GH_REPO: ${{ github.repository }}
steps:
- name: Download PHAR artifact
uses: actions/download-artifact@v8
with:
name: acli.phar
path: manifest
- name: Download Linux artifact
uses: actions/download-artifact@v8
with:
name: native-acli-linux-x86_64
path: manifest
- name: Download macOS artifact
uses: actions/download-artifact@v8
with:
name: native-acli-macos-aarch64
path: manifest
- name: Generate SHA256SUMS
run: |
(cd manifest && sha256sum * > ../SHA256SUMS)
- name: Download published release assets
run: gh release download "$GITHUB_REF_NAME" --dir released
- name: Verify manifest against published assets
working-directory: released
run: |
sha256sum --check ../SHA256SUMS
# shasum is the macOS tool; this exercises its parser without a macOS runner.
shasum -a 256 --check ../SHA256SUMS
- name: Assert manifest lists exactly the release assets
run: |
gh release view "$GITHUB_REF_NAME" --json assets --jq '.assets[].name' | grep -vx SHA256SUMS | sort > assets.txt
awk '{print $2}' SHA256SUMS | sort > listed.txt
diff assets.txt listed.txt
- name: Store checksum manifest in Actions
uses: actions/upload-artifact@v7
with:
name: SHA256SUMS
path: SHA256SUMS
overwrite: true
- name: Attach SHA256SUMS to release
uses: softprops/action-gh-release@v3
with:
files: SHA256SUMS
- name: Assert SHA256SUMS is attached to the release
run: gh release view "$GITHUB_REF_NAME" --json assets --jq '.assets[].name' | grep -qx SHA256SUMS

# Require all checks to pass without having to enumerate them in the branch protection UI.
# @see https://github.community/t/is-it-possible-to-require-all-github-actions-tasks-to-pass-without-enumerating-them/117957
check:
Expand All @@ -199,9 +256,12 @@ jobs:
- test
- build-release
- build-native
- build-checksums
runs-on: ubuntu-24.04
steps:
- name: Decide whether the needed jobs succeeded or failed
uses: re-actors/alls-green@release/v1
with:
jobs: ${{ toJSON(needs) }}
# build-checksums only runs for tags, so it is skipped on every PR and push.
allowed-skips: build-checksums
Loading