Skip to content

Commit aeb5539

Browse files
altaywtfaltaywtf
committed
fix(ci): harden release supply chain
1 parent 9f34174 commit aeb5539

4 files changed

Lines changed: 192 additions & 64 deletions

File tree

‎.github/workflows/backfill-release-assets.yml‎

Lines changed: 55 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,27 @@ on:
99
type: string
1010

1111
jobs:
12+
validate-release-tag:
13+
name: Validate release tag
14+
runs-on: ubuntu-latest
15+
timeout-minutes: 5
16+
permissions:
17+
contents: read
18+
19+
steps:
20+
- name: Validate tag name
21+
env:
22+
TAG_NAME: ${{ inputs.tag_name }}
23+
run: |
24+
if [[ ! "$TAG_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.-]+)?$ ]]; then
25+
echo "Invalid release tag: $TAG_NAME" >&2
26+
exit 1
27+
fi
28+
1229
build-unix-binaries:
1330
name: Build ${{ matrix.os }} release assets
31+
needs:
32+
- validate-release-tag
1433
runs-on: ${{ matrix.os }}
1534
timeout-minutes: 30
1635
permissions:
@@ -28,29 +47,35 @@ jobs:
2847

2948
steps:
3049
- name: Check out repository
31-
uses: actions/checkout@v6
50+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
3251
with:
3352
fetch-depth: 0
53+
ref: ${{ inputs.tag_name }}
3454

35-
- name: Check out release tag
36-
run: git checkout ${{ inputs.tag_name }}
37-
38-
- name: Set up Vite+
39-
uses: voidzero-dev/setup-vp@v1
55+
- name: Set up Node.js
56+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
4057
with:
4158
node-version-file: ".node-version"
42-
cache: true
59+
cache: pnpm
60+
61+
- name: Enable Corepack
62+
run: corepack enable
63+
64+
- name: Install dependencies
65+
run: pnpm install --frozen-lockfile
4366

4467
- name: Build SEA binary
45-
run: vp run build:sea
68+
run: pnpm run build:sea
4669

4770
- name: Verify SEA binary
48-
run: vp run verify:sea
71+
run: pnpm run verify:sea
4972

5073
- name: Package release assets
5174
shell: pwsh
75+
env:
76+
TAG_NAME: ${{ inputs.tag_name }}
5277
run: |
53-
$version = "${{ inputs.tag_name }}".TrimStart("v")
78+
$version = $env:TAG_NAME.TrimStart("v")
5479
$assetBase = "putio-cli-$version-${{ matrix.asset_os }}-${{ matrix.asset_arch }}"
5580
$releaseDir = ".artifacts/release"
5681
New-Item -ItemType Directory -Force -Path $releaseDir | Out-Null
@@ -70,44 +95,52 @@ jobs:
7095
run: Get-ChildItem .artifacts/release
7196

7297
- name: Upload binary assets to the GitHub release
73-
uses: softprops/action-gh-release@v3
98+
uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
7499
with:
75100
tag_name: ${{ inputs.tag_name }}
76101
files: |
77102
.artifacts/release/*
78103
79104
build-windows-binary:
80105
name: Build windows-latest release assets
106+
needs:
107+
- validate-release-tag
81108
runs-on: windows-latest
82109
timeout-minutes: 30
83110
permissions:
84111
contents: write
85112

86113
steps:
87114
- name: Check out repository
88-
uses: actions/checkout@v6
115+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
89116
with:
90117
fetch-depth: 0
118+
ref: ${{ inputs.tag_name }}
91119

92-
- name: Check out release tag
93-
run: git checkout ${{ inputs.tag_name }}
94-
95-
- name: Set up Vite+
96-
uses: voidzero-dev/setup-vp@v1
120+
- name: Set up Node.js
121+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
97122
with:
98123
node-version-file: ".node-version"
99-
cache: true
124+
cache: pnpm
125+
126+
- name: Enable Corepack
127+
run: corepack enable
128+
129+
- name: Install dependencies
130+
run: pnpm install --frozen-lockfile
100131

101132
- name: Build SEA binary
102-
run: vp run build:sea
133+
run: pnpm run build:sea
103134

104135
- name: Verify SEA binary
105-
run: vp run verify:sea
136+
run: pnpm run verify:sea
106137

107138
- name: Package release assets
108139
shell: pwsh
140+
env:
141+
TAG_NAME: ${{ inputs.tag_name }}
109142
run: |
110-
$version = "${{ inputs.tag_name }}".TrimStart("v")
143+
$version = $env:TAG_NAME.TrimStart("v")
111144
$assetBase = "putio-cli-$version-windows-amd64"
112145
$releaseDir = ".artifacts/release"
113146
New-Item -ItemType Directory -Force -Path $releaseDir | Out-Null
@@ -122,7 +155,7 @@ jobs:
122155
run: Get-ChildItem .artifacts/release
123156

124157
- name: Upload binary assets to the GitHub release
125-
uses: softprops/action-gh-release@v3
158+
uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
126159
with:
127160
tag_name: ${{ inputs.tag_name }}
128161
files: |

‎.github/workflows/ci.yml‎

Lines changed: 53 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -21,21 +21,27 @@ jobs:
2121

2222
steps:
2323
- name: Check out repository
24-
uses: actions/checkout@v6
24+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
2525
with:
2626
fetch-depth: 0
2727

28-
- name: Set up Vite+
29-
uses: voidzero-dev/setup-vp@v1
28+
- name: Set up Node.js
29+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
3030
with:
3131
node-version-file: ".node-version"
32-
cache: true
32+
cache: pnpm
33+
34+
- name: Enable Corepack
35+
run: corepack enable
36+
37+
- name: Install dependencies
38+
run: pnpm install --frozen-lockfile
3339

3440
- name: Verify repository
35-
run: vp run verify
41+
run: pnpm run verify
3642

3743
- name: Smoke test packed install surface
38-
run: vp run smoke:pack
44+
run: pnpm run smoke:pack
3945

4046
release:
4147
if: github.event_name == 'push' && github.ref == 'refs/heads/main' && !contains(github.event.head_commit.message, '[skip ci]')
@@ -55,22 +61,28 @@ jobs:
5561

5662
steps:
5763
- name: Check out repository
58-
uses: actions/checkout@v6
64+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
5965
with:
6066
fetch-depth: 0
6167

62-
- name: Set up Vite+
63-
uses: voidzero-dev/setup-vp@v1
68+
- name: Set up Node.js
69+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
6470
with:
6571
node-version-file: ".node-version"
66-
cache: true
72+
cache: pnpm
73+
74+
- name: Enable Corepack
75+
run: corepack enable
76+
77+
- name: Install dependencies
78+
run: pnpm install --frozen-lockfile
6779

6880
- name: Build package
69-
run: vp pack
81+
run: pnpm run build
7082

7183
- name: Release package
7284
id: semantic
73-
uses: cycjimmy/semantic-release-action@v6
85+
uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90 # v6.0.0
7486
with:
7587
extra_plugins: |
7688
@semantic-release/commit-analyzer
@@ -109,24 +121,28 @@ jobs:
109121

110122
steps:
111123
- name: Check out repository
112-
uses: actions/checkout@v6
124+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
113125
with:
114126
fetch-depth: 0
127+
ref: ${{ needs.release.outputs.new_release_git_tag }}
115128

116-
- name: Check out release tag
117-
run: git checkout ${{ needs.release.outputs.new_release_git_tag }}
118-
119-
- name: Set up Vite+
120-
uses: voidzero-dev/setup-vp@v1
129+
- name: Set up Node.js
130+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
121131
with:
122132
node-version-file: ".node-version"
123-
cache: true
133+
cache: pnpm
134+
135+
- name: Enable Corepack
136+
run: corepack enable
137+
138+
- name: Install dependencies
139+
run: pnpm install --frozen-lockfile
124140

125141
- name: Build SEA binary
126-
run: vp run build:sea
142+
run: pnpm run build:sea
127143

128144
- name: Verify SEA binary
129-
run: vp run verify:sea
145+
run: pnpm run verify:sea
130146

131147
- name: Package release assets
132148
shell: pwsh
@@ -151,7 +167,7 @@ jobs:
151167
run: Get-ChildItem .artifacts/release
152168

153169
- name: Upload binary assets to the GitHub release
154-
uses: softprops/action-gh-release@v3
170+
uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
155171
with:
156172
tag_name: ${{ needs.release.outputs.new_release_git_tag }}
157173
files: |
@@ -169,24 +185,28 @@ jobs:
169185

170186
steps:
171187
- name: Check out repository
172-
uses: actions/checkout@v6
188+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
173189
with:
174190
fetch-depth: 0
191+
ref: ${{ needs.release.outputs.new_release_git_tag }}
175192

176-
- name: Check out release tag
177-
run: git checkout ${{ needs.release.outputs.new_release_git_tag }}
178-
179-
- name: Set up Vite+
180-
uses: voidzero-dev/setup-vp@v1
193+
- name: Set up Node.js
194+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
181195
with:
182196
node-version-file: ".node-version"
183-
cache: true
197+
cache: pnpm
198+
199+
- name: Enable Corepack
200+
run: corepack enable
201+
202+
- name: Install dependencies
203+
run: pnpm install --frozen-lockfile
184204

185205
- name: Build SEA binary
186-
run: vp run build:sea
206+
run: pnpm run build:sea
187207

188208
- name: Verify SEA binary
189-
run: vp run verify:sea
209+
run: pnpm run verify:sea
190210

191211
- name: Package release assets
192212
shell: pwsh
@@ -206,7 +226,7 @@ jobs:
206226
run: Get-ChildItem .artifacts/release
207227

208228
- name: Upload binary assets to the GitHub release
209-
uses: softprops/action-gh-release@v3
229+
uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
210230
with:
211231
tag_name: ${{ needs.release.outputs.new_release_git_tag }}
212232
files: |
@@ -225,7 +245,7 @@ jobs:
225245

226246
steps:
227247
- name: Release to Homebrew tap
228-
uses: Justintime50/homebrew-releaser@v3
248+
uses: Justintime50/homebrew-releaser@a62d7a359683bfc047cdb2431f53ee58241464d1 # v3
229249
with:
230250
homebrew_owner: putdotio
231251
homebrew_tap: homebrew-tap

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@
3030
},
3131
"scripts": {
3232
"build": "vp pack",
33-
"build:sea": "node ./scripts/build-sea.mjs",
33+
"build:sea": "node ./scripts/build-sea.mts",
3434
"check": "vp check .",
3535
"coverage": "vp test --coverage",
3636
"dev": "vp pack --watch",

0 commit comments

Comments
 (0)