terraphim-cursor-plugin/.github/workflows/verify-published.yml at main · terraphim/terraphim-cursor-plugin · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
name: Verify published marketplace pack

on:
  workflow_dispatch:
    inputs:
      tag:
        description: Existing immutable signed release tag to verify
        required: true
        type: string

permissions:
  contents: read

jobs:
  readback:
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"
      - name: Resolve and verify the original signed release
        id: source
        env:
          RELEASE_TAG: ${{ inputs.tag }}
        shell: bash
        run: |
          set -euo pipefail
          [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9.-]+)?$ ]]
          release_ref="refs/release-readback/$RELEASE_TAG"
          git fetch --no-tags origin "refs/tags/$RELEASE_TAG:$release_ref"
          git -c gpg.format=ssh \
            -c gpg.ssh.allowedSignersFile="$GITHUB_WORKSPACE/.github/trusted-release-signers" \
            verify-tag "$release_ref"
          mkdir "$RUNNER_TEMP/release-source"
          git archive "$release_ref" | tar -x -C "$RUNNER_TEMP/release-source"
          echo "commit=$(git rev-list -n 1 "$release_ref")" >> "$GITHUB_OUTPUT"
      - name: Read back public release bytes
        env:
          RELEASE_TAG: ${{ inputs.tag }}
        run: |
          extra=()
          source="$RUNNER_TEMP/release-source"
          if python3 -c 'import json,sys; sys.exit("cursor_integration" not in json.load(open(sys.argv[1])))' "$source/distribution/metadata.json"; then
            python3 - "$source" "$RUNNER_TEMP/cursor-readback" "${{ steps.source.outputs.commit }}" <<'PYTHON'
          import importlib.util, pathlib, sys
          spec = importlib.util.spec_from_file_location("generator", "scripts/generate_distribution.py")
          module = importlib.util.module_from_spec(spec); spec.loader.exec_module(module)
          root = pathlib.Path(sys.argv[1])
          module.build_cursor_archive(root, module.load_metadata(root), pathlib.Path(sys.argv[2]), sys.argv[3])
          PYTHON
            extra=(--cursor-archive "$RUNNER_TEMP/cursor-readback/terraphim-cursor-integration-${RELEASE_TAG#v}.zip" --source-commit "${{ steps.source.outputs.commit }}")
          fi
          python3 scripts/verify_published_release.py \
            --root "$source" --tag "$RELEASE_TAG" "${extra[@]}" \
            --receipt "$RUNNER_TEMP/published-release.json"
      - name: Retain actual public readback
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: published-release-readback
          path: ${{ runner.temp }}/published-release.json
          if-no-files-found: error