From 4cf12735d767e5636bb687c115728aba22194e97 Mon Sep 17 00:00:00 2001 From: Igor Lins e Silva <4753812+igorls@users.noreply.github.com> Date: Mon, 31 Aug 2026 07:56:51 -0300 Subject: [PATCH 1/2] ci: validate release artifacts before publishing --- .github/workflows/release.yml | 46 ++++++++++++++++++++++++++++++----- 1 file changed, 40 insertions(+), 6 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e3c3bbc..d8c0f39 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,12 +4,17 @@ on: push: tags: - 'v*' + pull_request: + branches: [master] + paths: + - '.github/workflows/release.yml' + workflow_dispatch: env: CARGO_TERM_COLOR: always permissions: - contents: write + contents: read jobs: build: @@ -75,13 +80,13 @@ jobs: Compress-Archive -Path "target/${{ matrix.target }}/release/context-builder.exe" -DestinationPath "context-builder-${{ matrix.target }}.zip" - name: Upload artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: context-builder-${{ matrix.target }} path: context-builder-${{ matrix.target }}.${{ matrix.archive }} - release: - name: Create Release + validate: + name: Validate Release Artifacts needs: build runs-on: ubuntu-latest steps: @@ -89,7 +94,7 @@ jobs: uses: actions/checkout@v7 - name: Download all artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: path: artifacts @@ -106,6 +111,35 @@ jobs: cd .. cat SHA256SUMS + - name: Verify archive contents + shell: bash + run: | + set -euo pipefail + tar -tzf artifacts/context-builder-x86_64-unknown-linux-gnu/context-builder-x86_64-unknown-linux-gnu.tar.gz | grep -qx 'context-builder' + tar -tzf artifacts/context-builder-aarch64-unknown-linux-gnu/context-builder-aarch64-unknown-linux-gnu.tar.gz | grep -qx 'context-builder' + tar -tzf artifacts/context-builder-x86_64-apple-darwin/context-builder-x86_64-apple-darwin.tar.gz | grep -qx 'context-builder' + tar -tzf artifacts/context-builder-aarch64-apple-darwin/context-builder-aarch64-apple-darwin.tar.gz | grep -qx 'context-builder' + unzip -Z1 artifacts/context-builder-x86_64-pc-windows-msvc/context-builder-x86_64-pc-windows-msvc.zip | grep -qx 'context-builder.exe' + + - name: Upload checksums + uses: actions/upload-artifact@v7 + with: + name: release-checksums + path: SHA256SUMS + + release: + name: Create Release + if: startsWith(github.ref, 'refs/tags/v') + needs: validate + runs-on: ubuntu-latest + permissions: + contents: write + steps: + - name: Download all artifacts + uses: actions/download-artifact@v8 + with: + path: artifacts + - name: Create GitHub Release uses: softprops/action-gh-release@v2 with: @@ -116,4 +150,4 @@ jobs: artifacts/context-builder-x86_64-apple-darwin/context-builder-x86_64-apple-darwin.tar.gz artifacts/context-builder-aarch64-apple-darwin/context-builder-aarch64-apple-darwin.tar.gz artifacts/context-builder-x86_64-pc-windows-msvc/context-builder-x86_64-pc-windows-msvc.zip - SHA256SUMS + artifacts/release-checksums/SHA256SUMS From 189d72695d1b37f259fe66de2976357f7f8c8914 Mon Sep 17 00:00:00 2001 From: Igor Lins e Silva <4753812+igorls@users.noreply.github.com> Date: Mon, 31 Aug 2026 08:04:04 -0300 Subject: [PATCH 2/2] ci: harden release validation guard --- .github/workflows/release.yml | 50 +++++++++++++++++------------------ 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d8c0f39..998f938 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -12,6 +12,7 @@ on: env: CARGO_TERM_COLOR: always + EXPECTED_RELEASE_ARTIFACTS: 5 permissions: contents: read @@ -98,28 +99,31 @@ jobs: with: path: artifacts - - name: Generate SHA256SUMS - run: | - cd artifacts - sha256sum \ - context-builder-x86_64-unknown-linux-gnu/context-builder-x86_64-unknown-linux-gnu.tar.gz \ - context-builder-aarch64-unknown-linux-gnu/context-builder-aarch64-unknown-linux-gnu.tar.gz \ - context-builder-x86_64-apple-darwin/context-builder-x86_64-apple-darwin.tar.gz \ - context-builder-aarch64-apple-darwin/context-builder-aarch64-apple-darwin.tar.gz \ - context-builder-x86_64-pc-windows-msvc/context-builder-x86_64-pc-windows-msvc.zip \ - | sed 's|[^ ]*/||' > ../SHA256SUMS - cd .. - cat SHA256SUMS - - - name: Verify archive contents + - name: Validate archives and generate SHA256SUMS shell: bash run: | set -euo pipefail - tar -tzf artifacts/context-builder-x86_64-unknown-linux-gnu/context-builder-x86_64-unknown-linux-gnu.tar.gz | grep -qx 'context-builder' - tar -tzf artifacts/context-builder-aarch64-unknown-linux-gnu/context-builder-aarch64-unknown-linux-gnu.tar.gz | grep -qx 'context-builder' - tar -tzf artifacts/context-builder-x86_64-apple-darwin/context-builder-x86_64-apple-darwin.tar.gz | grep -qx 'context-builder' - tar -tzf artifacts/context-builder-aarch64-apple-darwin/context-builder-aarch64-apple-darwin.tar.gz | grep -qx 'context-builder' - unzip -Z1 artifacts/context-builder-x86_64-pc-windows-msvc/context-builder-x86_64-pc-windows-msvc.zip | grep -qx 'context-builder.exe' + mapfile -d '' archives < <(find artifacts -type f \( -name '*.tar.gz' -o -name '*.zip' \) -print0 | sort -z) + if [[ "${#archives[@]}" -ne "$EXPECTED_RELEASE_ARTIFACTS" ]]; then + echo "Expected $EXPECTED_RELEASE_ARTIFACTS release archives, found ${#archives[@]}" >&2 + exit 1 + fi + + : > SHA256SUMS + for archive in "${archives[@]}"; do + case "$archive" in + *.tar.gz) + [[ "$(tar -tzf "$archive")" == 'context-builder' ]] + ;; + *.zip) + [[ "$(unzip -Z1 "$archive")" == 'context-builder.exe' ]] + ;; + esac + + checksum="$(sha256sum "$archive" | cut -d ' ' -f 1)" + printf '%s %s\n' "$checksum" "$(basename "$archive")" >> SHA256SUMS + done + cat SHA256SUMS - name: Upload checksums uses: actions/upload-artifact@v7 @@ -129,7 +133,7 @@ jobs: release: name: Create Release - if: startsWith(github.ref, 'refs/tags/v') + if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') needs: validate runs-on: ubuntu-latest permissions: @@ -145,9 +149,5 @@ jobs: with: generate_release_notes: true files: | - artifacts/context-builder-x86_64-unknown-linux-gnu/context-builder-x86_64-unknown-linux-gnu.tar.gz - artifacts/context-builder-aarch64-unknown-linux-gnu/context-builder-aarch64-unknown-linux-gnu.tar.gz - artifacts/context-builder-x86_64-apple-darwin/context-builder-x86_64-apple-darwin.tar.gz - artifacts/context-builder-aarch64-apple-darwin/context-builder-aarch64-apple-darwin.tar.gz - artifacts/context-builder-x86_64-pc-windows-msvc/context-builder-x86_64-pc-windows-msvc.zip + artifacts/context-builder-*/* artifacts/release-checksums/SHA256SUMS