ci(release): verify selected prepare artifacts

Author: presempathy-awb

.github/workflows/release.yml

@@ -126,6 +126,23 @@ jobs:
           ref: ${{ inputs.tag }}
           fetch-depth: 0
 
+      - name: Read prepare run metadata
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          PREPARE_RUN_ID: ${{ inputs.prepare_run_id }}
+        run: |
+          set -euo pipefail
+          [[ "$PREPARE_RUN_ID" =~ ^[0-9]+$ ]] || {
+            echo "::error::prepare_run_id must be numeric"
+            exit 1
+          }
+          curl --fail --location --silent --show-error \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            "https://api.github.com/repos/${GITHUB_REPOSITORY}/actions/runs/${PREPARE_RUN_ID}" \
+            --output "$RUNNER_TEMP/prepare-run.json"
+
       - name: Download fsck artifacts
         uses: actions/download-artifact@v8
         with:
@@ -135,6 +152,17 @@ jobs:
           path: ./artifacts
           merge-multiple: true
 
+      - name: Verify prepared release
+        env:
+          VERSION: ${{ needs.validate-version.outputs.version }}
+        run: |
+          set -euo pipefail
+          bash scripts/ci/verify_release_artifacts.sh \
+            "$RUNNER_TEMP/prepare-run.json" \
+            ./artifacts \
+            "$VERSION" \
+            "$(git rev-parse HEAD)"
+
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v3
         with:

.github/workflows/test.yml

@@ -102,6 +102,9 @@ jobs:
             exit 1
           fi
 
+      - name: Release artifact verification
+        run: bash scripts/test-release-artifacts.sh
+
   # ─────────────────────────────────────────────────────────────────────────
   test:
     name: Test (${{ matrix.os }})

scripts/ci/verify_release_artifacts.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Verify that a successful Release Prepare run produced the exact release set.
+
+set -euo pipefail
+
+die() {
+  printf 'release artifacts: %s\n' "$*" >&2
+  exit 1
+}
+
+run_json="${1:?usage: verify_release_artifacts.sh <run.json> <artifact-dir> <version> <commit>}"
+artifact_dir="${2:?usage: verify_release_artifacts.sh <run.json> <artifact-dir> <version> <commit>}"
+version="${3:?usage: verify_release_artifacts.sh <run.json> <artifact-dir> <version> <commit>}"
+commit="${4:?usage: verify_release_artifacts.sh <run.json> <artifact-dir> <version> <commit>}"
+
+test -f "$run_json" || die "missing workflow-run metadata: $run_json"
+test -d "$artifact_dir" || die "missing artifact directory: $artifact_dir"
+[[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z][A-Za-z0-9-]*\.[0-9]+)?$ ]] ||
+  die "invalid release version: $version"
+[[ "$commit" =~ ^[0-9a-f]{40}$ ]] || die "invalid release commit: $commit"
+
+jq -e \
+  --arg commit "$commit" \
+  '.head_sha == $commit
+   and .path == ".github/workflows/release-prepare.yml"
+   and .event == "push"
+   and .status == "completed"
+   and .conclusion == "success"' \
+  "$run_json" >/dev/null ||
+  die "selected run is not a successful Release Prepare run for the tag commit"
+
+expected=(
+  "pagedb-fsck-${version}-linux-x64.tar.gz"
+  "pagedb-fsck-${version}-linux-arm64.tar.gz"
+  "pagedb-fsck-${version}-macos-arm64.tar.gz"
+  "pagedb-fsck-${version}-macos-x64.tar.gz"
+  "pagedb-fsck-${version}-windows-x64.zip"
+)
+
+shopt -s nullglob dotglob
+entries=("$artifact_dir"/*)
+shopt -u nullglob dotglob
+test "${#entries[@]}" -eq "${#expected[@]}" ||
+  die "expected exactly ${#expected[@]} release archives"
+
+for entry in "${entries[@]}"; do
+  test -f "$entry" && test ! -L "$entry" ||
+    die "unexpected release artifact: $entry"
+done
+for archive in "${expected[@]}"; do
+  test -f "$artifact_dir/$archive" ||
+    die "missing release archive: $archive"
+done
+
+printf 'release artifacts: ok\n'

scripts/test-release-artifacts.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+verifier="$repo_root/scripts/ci/verify_release_artifacts.sh"
+work_dir="$(mktemp -d)"
+trap 'rm -rf "$work_dir"' EXIT
+
+version="0.2.0-beta.1"
+commit="0123456789abcdef0123456789abcdef01234567"
+run_json="$work_dir/run.json"
+artifacts="$work_dir/artifacts"
+
+expect_failure() {
+  local label="$1" metadata="$2" expected_commit="$3"
+  shift
+  shift 2
+  if bash "$verifier" "$metadata" "$artifacts" "$version" "$expected_commit" \
+    >"$work_dir/failure.log" 2>&1; then
+    printf 'expected failure: %s\n' "$label" >&2
+    exit 1
+  fi
+}
+
+jq -n --arg head_sha "$commit" \
+  '{head_sha:$head_sha, path:".github/workflows/release-prepare.yml",
+    event:"push", status:"completed", conclusion:"success"}' >"$run_json"
+mkdir "$artifacts"
+touch \
+  "$artifacts/pagedb-fsck-${version}-linux-x64.tar.gz" \
+  "$artifacts/pagedb-fsck-${version}-linux-arm64.tar.gz" \
+  "$artifacts/pagedb-fsck-${version}-macos-arm64.tar.gz" \
+  "$artifacts/pagedb-fsck-${version}-macos-x64.tar.gz" \
+  "$artifacts/pagedb-fsck-${version}-windows-x64.zip"
+
+bash "$verifier" "$run_json" "$artifacts" "$version" "$commit"
+
+expect_failure "different tag commit" "$run_json" \
+  "ffffffffffffffffffffffffffffffffffffffff"
+
+jq '.conclusion = "failure"' "$run_json" >"$work_dir/failed-run.json"
+expect_failure "failed prepare run" "$work_dir/failed-run.json" "$commit"
+
+touch "$artifacts/unexpected.txt"
+expect_failure "extra artifact" "$run_json" "$commit"
+
+rm "$artifacts/unexpected.txt" "$artifacts/pagedb-fsck-${version}-windows-x64.zip"
+expect_failure "missing archive" "$run_json" "$commit"
+
+printf 'release artifact verification: tests passed\n'