WEBDIENSTE/ECC
1
0
Fork 0
mirror of https://github.com/affaan-m/ECC.git synced 2026-10-21 07:21:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(release): bind privileged checkout to verified event commit

Browse Source 
Preserve contributor history and current-main behavior while resolving the exact reviewed follow-up.

Source-PR: https://github.com/affaan-m/ECC/pull/3195
Source-Parent: ffb69744b0
Review-Manifest-SHA256: f732b9a4ceb5adced2990690c3857227088bbcccbb5114fcaaa581ecf16eb13f
This commit is contained in:
affaan-m
2026-09-28 00:54:51 -04:00
parent ffb69744b0
commit f36b5d1fda
2 changed files with 37 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release.yml
+7 -1
View File
@@ -205,10 +205,16 @@ jobs:
ECC_RELEASE_SHA256: ${{ needs.verify.outputs.package_sha256 }}
run: node -e "const crypto = require('crypto'); const fs = require('fs'); const file = process.env.ECC_RELEASE_PACKAGE; const expected = process.env.ECC_RELEASE_SHA256; if (!/^ecc-universal-[0-9A-Za-z.+-]+\.tgz$/.test(file || '')) throw new Error('Unexpected packed filename'); if (!/^[a-f0-9]{64}$/.test(expected || '')) throw new Error('Invalid packed SHA-256'); const archives = fs.readdirSync('.').filter(name => name.endsWith('.tgz')); if (archives.length !== 1 || archives[0] !== file) throw new Error('Expected exactly one downloaded archive'); const actual = crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex'); if (actual !== expected) throw new Error('Downloaded publish artifact SHA-256 mismatch')"
- name: Bind gate source to triggering commit
env:
EVENT_SHA: ${{ github.sha }}
VERIFIED_RELEASE_SHA: ${{ needs.verify.outputs.release_sha }}
run: node -e "const actual = process.env.EVENT_SHA; const expected = process.env.VERIFIED_RELEASE_SHA; if (typeof actual !== 'string' || actual.length !== 40 || !/^[a-f0-9]{40}$/.test(actual) || expected !== actual) throw new Error('Verified release differs from triggering commit')"
- name: Checkout verified gate source
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ needs.verify.outputs.release_sha }}
ref: ${{ github.sha }}
path: release-gate-source
persist-credentials: false
sparse-checkout: scripts/ci/verify-release-gates.js