ci: validate release artifacts before publishing

.github/workflows/release.yml

@@ -4,12 +4,18 @@ on:
   push:
     tags:
       - 'v*'
+  pull_request:
+    branches: [master]
+    paths:
+      - '.github/workflows/release.yml'
+  workflow_dispatch:
 
 env:
   CARGO_TERM_COLOR: always
+  EXPECTED_RELEASE_ARTIFACTS: 5
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   build:
@@ -75,45 +81,73 @@ jobs:
           Compress-Archive -Path "target/${{ matrix.target }}/release/context-builder.exe" -DestinationPath "context-builder-${{ matrix.target }}.zip"
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: context-builder-${{ matrix.target }}
           path: context-builder-${{ matrix.target }}.${{ matrix.archive }}
 
-  release:
-    name: Create Release
+  validate:
+    name: Validate Release Artifacts
     needs: build
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts
 
-      - name: Generate SHA256SUMS
+      - name: Validate archives and generate SHA256SUMS
+        shell: bash
         run: |
-          cd artifacts
-          sha256sum \
-            context-builder-x86_64-unknown-linux-gnu/context-builder-x86_64-unknown-linux-gnu.tar.gz \
-            context-builder-aarch64-unknown-linux-gnu/context-builder-aarch64-unknown-linux-gnu.tar.gz \
-            context-builder-x86_64-apple-darwin/context-builder-x86_64-apple-darwin.tar.gz \
-            context-builder-aarch64-apple-darwin/context-builder-aarch64-apple-darwin.tar.gz \
-            context-builder-x86_64-pc-windows-msvc/context-builder-x86_64-pc-windows-msvc.zip \
-            | sed 's|[^ ]*/||' > ../SHA256SUMS
-          cd ..
+          set -euo pipefail
+          mapfile -d '' archives < <(find artifacts -type f \( -name '*.tar.gz' -o -name '*.zip' \) -print0 | sort -z)
+          if [[ "${#archives[@]}" -ne "$EXPECTED_RELEASE_ARTIFACTS" ]]; then
+            echo "Expected $EXPECTED_RELEASE_ARTIFACTS release archives, found ${#archives[@]}" >&2
+            exit 1
+          fi
+
+          : > SHA256SUMS
+          for archive in "${archives[@]}"; do
+            case "$archive" in
+              *.tar.gz)
+                [[ "$(tar -tzf "$archive")" == 'context-builder' ]]
+                ;;
+              *.zip)
+                [[ "$(unzip -Z1 "$archive")" == 'context-builder.exe' ]]
+                ;;
+            esac
+
+            checksum="$(sha256sum "$archive" | cut -d ' ' -f 1)"
+            printf '%s  %s\n' "$checksum" "$(basename "$archive")" >> SHA256SUMS
+          done
           cat SHA256SUMS
 
+      - name: Upload checksums
+        uses: actions/upload-artifact@v7
+        with:
+          name: release-checksums
+          path: SHA256SUMS
+
+  release:
+    name: Create Release
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    needs: validate
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Download all artifacts
+        uses: actions/download-artifact@v8
+        with:
+          path: artifacts
+
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:
           generate_release_notes: true
           files: |
-            artifacts/context-builder-x86_64-unknown-linux-gnu/context-builder-x86_64-unknown-linux-gnu.tar.gz
-            artifacts/context-builder-aarch64-unknown-linux-gnu/context-builder-aarch64-unknown-linux-gnu.tar.gz
-            artifacts/context-builder-x86_64-apple-darwin/context-builder-x86_64-apple-darwin.tar.gz
-            artifacts/context-builder-aarch64-apple-darwin/context-builder-aarch64-apple-darwin.tar.gz
-            artifacts/context-builder-x86_64-pc-windows-msvc/context-builder-x86_64-pc-windows-msvc.zip
-            SHA256SUMS
+            artifacts/context-builder-*/*
+            artifacts/release-checksums/SHA256SUMS