Skip to content

Commit e41b8c5

Browse files
SimonDarksideJSimonDarksideJ
authored
Release V3 - take 3 :D (#525)
* Add hardening to workflows
1 parent 5126037 commit e41b8c5

4 files changed

Lines changed: 93 additions & 4 deletions

File tree

‎.github/workflows/main-publish.yml‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,10 @@ jobs:
5757
secrets: inherit
5858

5959
release-Complete:
60-
if: ${{ always() }}
60+
# Only succeed if no upstream release job actually failed. Skipped siblings
61+
# (the build-types that didn't match the PR title) are tolerated; a real
62+
# failure makes this job skip so it can no longer report a false "success".
63+
if: ${{ !failure() && !cancelled() }}
6164
needs: [upversion-major-Package, upversion-minor-Package, upversion-patch-Package, release-Package-only]
6265
name: Release complete
6366
runs-on: ubuntu-latest
@@ -67,19 +70,24 @@ jobs:
6770

6871
# Refresh the development branch with the main publish
6972
refresh-development:
70-
if: ${{ always() }}
73+
# Skip if the release didn't actually complete, so we never refresh
74+
# development from a half-finished or failed release.
75+
if: ${{ needs.release-Complete.result == 'success' }}
7176
needs: [release-Complete]
7277
name: Refresh development branch
7378
uses: ./.github/workflows/refreshbranch.yml
7479
with:
7580
build-host: ubuntu-latest
7681
target-branch: development
77-
source-branch: main
82+
# The branch this release PR merged into (the trigger pins this to the
83+
# release branch). Avoids hardcoding a branch name that doesn't exist.
84+
source-branch: ${{ github.event.pull_request.base.ref }}
7885
secrets: inherit
7986

8087
# Up version the development branch ready for future development
8188
upversion-development:
82-
if: ${{ always() }}
89+
# Only re-version development once it has been refreshed successfully.
90+
if: ${{ needs.refresh-development.result == 'success' }}
8391
needs: [refresh-development]
8492
name: UpVersion the development branch for the next release
8593
uses: ./.github/workflows/upversionandtagrelease.yml

‎.github/workflows/refreshbranch.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,33 @@ jobs:
2929
echo "Build Script Version: $scriptVersion"
3030
echo "::endgroup::"
3131
shell: pwsh
32+
- name: Validate GIT_PAT
33+
env:
34+
GIT_PAT: ${{ secrets.GIT_PAT }}
35+
shell: pwsh
36+
run: |
37+
if ([string]::IsNullOrWhiteSpace($env:GIT_PAT)) {
38+
Write-Error "GIT_PAT secret is empty or not set. Add a valid Personal Access Token to the repository/org secrets and re-run."
39+
exit 1
40+
}
41+
$headers = @{
42+
Authorization = "Bearer $env:GIT_PAT"
43+
"User-Agent" = "uiextensions-release-preflight"
44+
Accept = "application/vnd.github+json"
45+
}
46+
try {
47+
$repo = Invoke-RestMethod -Uri "https://api.github.com/repos/$env:GITHUB_REPOSITORY" -Headers $headers -ErrorAction Stop
48+
}
49+
catch {
50+
$code = if ($_.Exception.Response) { [int]$_.Exception.Response.StatusCode } else { "unknown" }
51+
Write-Error "GIT_PAT was rejected by GitHub (HTTP $code). It is likely expired, revoked, or lacks access to $env:GITHUB_REPOSITORY. Regenerate the token and update the GIT_PAT secret. Details: $($_.Exception.Message)"
52+
exit 1
53+
}
54+
if ($null -ne $repo.permissions -and -not $repo.permissions.push) {
55+
Write-Error "GIT_PAT authenticated but does not have push access to $env:GITHUB_REPOSITORY. Grant 'repo' (classic PAT) or Contents: read & write (fine-grained PAT)."
56+
exit 1
57+
}
58+
Write-Host "GIT_PAT validated: authenticated with push access to $env:GITHUB_REPOSITORY."
3259
- uses: actions/checkout@v7
3360
with:
3461
ref: ${{ inputs.target-branch }}

‎.github/workflows/tagrelease.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,33 @@ jobs:
2929
echo "Build Script Version: $scriptVersion"
3030
echo "::endgroup::"
3131
shell: pwsh
32+
- name: Validate GIT_PAT
33+
env:
34+
GIT_PAT: ${{ secrets.GIT_PAT }}
35+
shell: pwsh
36+
run: |
37+
if ([string]::IsNullOrWhiteSpace($env:GIT_PAT)) {
38+
Write-Error "GIT_PAT secret is empty or not set. Add a valid Personal Access Token to the repository/org secrets and re-run."
39+
exit 1
40+
}
41+
$headers = @{
42+
Authorization = "Bearer $env:GIT_PAT"
43+
"User-Agent" = "uiextensions-release-preflight"
44+
Accept = "application/vnd.github+json"
45+
}
46+
try {
47+
$repo = Invoke-RestMethod -Uri "https://api.github.com/repos/$env:GITHUB_REPOSITORY" -Headers $headers -ErrorAction Stop
48+
}
49+
catch {
50+
$code = if ($_.Exception.Response) { [int]$_.Exception.Response.StatusCode } else { "unknown" }
51+
Write-Error "GIT_PAT was rejected by GitHub (HTTP $code). It is likely expired, revoked, or lacks access to $env:GITHUB_REPOSITORY. Regenerate the token and update the GIT_PAT secret. Details: $($_.Exception.Message)"
52+
exit 1
53+
}
54+
if ($null -ne $repo.permissions -and -not $repo.permissions.push) {
55+
Write-Error "GIT_PAT authenticated but does not have push access to $env:GITHUB_REPOSITORY. Grant 'repo' (classic PAT) or Contents: read & write (fine-grained PAT)."
56+
exit 1
57+
}
58+
Write-Host "GIT_PAT validated: authenticated with push access to $env:GITHUB_REPOSITORY."
3259
- uses: actions/checkout@v7
3360
with:
3461
fetch-depth: 0

‎.github/workflows/upversionandtagrelease.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,33 @@ jobs:
4848
echo "Build Script Version: $scriptVersion"
4949
echo "::endgroup::"
5050
shell: pwsh
51+
- name: Validate GIT_PAT
52+
env:
53+
GIT_PAT: ${{ secrets.GIT_PAT }}
54+
shell: pwsh
55+
run: |
56+
if ([string]::IsNullOrWhiteSpace($env:GIT_PAT)) {
57+
Write-Error "GIT_PAT secret is empty or not set. Add a valid Personal Access Token to the repository/org secrets and re-run."
58+
exit 1
59+
}
60+
$headers = @{
61+
Authorization = "Bearer $env:GIT_PAT"
62+
"User-Agent" = "uiextensions-release-preflight"
63+
Accept = "application/vnd.github+json"
64+
}
65+
try {
66+
$repo = Invoke-RestMethod -Uri "https://api.github.com/repos/$env:GITHUB_REPOSITORY" -Headers $headers -ErrorAction Stop
67+
}
68+
catch {
69+
$code = if ($_.Exception.Response) { [int]$_.Exception.Response.StatusCode } else { "unknown" }
70+
Write-Error "GIT_PAT was rejected by GitHub (HTTP $code). It is likely expired, revoked, or lacks access to $env:GITHUB_REPOSITORY. Regenerate the token and update the GIT_PAT secret. Details: $($_.Exception.Message)"
71+
exit 1
72+
}
73+
if ($null -ne $repo.permissions -and -not $repo.permissions.push) {
74+
Write-Error "GIT_PAT authenticated but does not have push access to $env:GITHUB_REPOSITORY. Grant 'repo' (classic PAT) or Contents: read & write (fine-grained PAT)."
75+
exit 1
76+
}
77+
Write-Host "GIT_PAT validated: authenticated with push access to $env:GITHUB_REPOSITORY."
5178
- uses: actions/checkout@v7
5279
with:
5380
ref: ${{ inputs.target-branch }}

0 commit comments

Comments
 (0)