Skip to content

Commit 5d368ac

Browse files
ovitrifovitrif
committed
ci: fix reproducible workflow checks
1 parent e3e8a7a commit 5d368ac

3 files changed

Lines changed: 73 additions & 3 deletions

File tree

‎.github/workflows/reproducible-release.yml‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,14 @@ on:
77
description: Optional artifact name to compare against with diffoscope
88
required: false
99
default: ''
10+
comparison_run_id:
11+
description: Workflow run id that produced the comparison artifact
12+
required: false
13+
default: ''
14+
comparison_repository:
15+
description: Optional owner/repo for the comparison artifact
16+
required: false
17+
default: ''
1018
push:
1119
tags:
1220
- 'v*'
@@ -27,6 +35,7 @@ jobs:
2735
environment: release-store
2836

2937
permissions:
38+
actions: read
3039
contents: read
3140
packages: read
3241

@@ -63,12 +72,23 @@ jobs:
6372
printf '%s' "$BITKIT_KEYSTORE_BASE64" | base64 --decode > "$keystore_path"
6473
echo "KEYSTORE_FILE=$keystore_path" >> "$GITHUB_ENV"
6574
75+
- name: Validate comparison inputs
76+
if: ${{ github.event_name == 'workflow_dispatch' && inputs.comparison_artifact_name != '' }}
77+
env:
78+
COMPARISON_RUN_ID: ${{ inputs.comparison_run_id }}
79+
run: |
80+
set -euo pipefail
81+
test -n "$COMPARISON_RUN_ID"
82+
6683
- name: Download comparison artifact
6784
if: ${{ github.event_name == 'workflow_dispatch' && inputs.comparison_artifact_name != '' }}
6885
uses: actions/download-artifact@v6
6986
with:
7087
name: ${{ inputs.comparison_artifact_name }}
7188
path: ${{ runner.temp }}/comparison
89+
github-token: ${{ github.token }}
90+
repository: ${{ inputs.comparison_repository || github.repository }}
91+
run-id: ${{ inputs.comparison_run_id }}
7292

7393
- name: Install diffoscope
7494
if: ${{ github.event_name == 'workflow_dispatch' && inputs.comparison_artifact_name != '' }}
@@ -99,4 +119,3 @@ jobs:
99119
name: bitkit-reproducible-release-${{ github.run_number }}
100120
path: ${{ runner.temp }}/reproducible-release
101121
retention-days: 30
102-

‎docs/reproducible-builds.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ SKIP_GRADLE_BUILD=true AAB_PATH=/path/to/bitkit-mainnet-release-181.aab scripts/
6060

6161
The `Reproducible Release` workflow builds `bundleMainnetRelease`, recreates APK splits with bundletool, extracts the `arm64-v8a` native libraries, and uploads checksums plus reproduction artifacts. Workflow behavior can only be fully verified after merge because GitHub Actions workflow changes are only active for PRs opened after the workflow change is merged.
6262

63-
If a comparison artifact is available in GitHub Actions, pass its artifact name to the manual workflow input. The workflow installs `diffoscope` and writes `diffoscope.html` and `diffoscope.txt` when possible.
63+
If a comparison artifact is available in GitHub Actions, pass its artifact name and source workflow run id to the manual workflow inputs. The optional repository input can point at a different `owner/repo` when the artifact is not in the current repository. The workflow installs `diffoscope` and writes `diffoscope.html` and `diffoscope.txt` when possible.
6464

6565
## Manual diffoscope checks
6666

@@ -103,4 +103,3 @@ For Rust/native Android artifacts, the upstream repositories should publish repr
103103
- path remapping
104104
- deterministic stripping
105105
- published AAR and native `.so` checksums
106-

‎gradle/verification-metadata.xml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3397,6 +3397,11 @@
33973397
<sha256 value="9095f6d8ee3765950207510785830cc2280e781067915fa99cfe1740d4865c14" origin="Generated by Gradle"/>
33983398
</artifact>
33993399
</component>
3400+
<component group="com.google.guava" name="guava-parent" version="33.3.1-jre">
3401+
<artifact name="guava-parent-33.3.1-jre.pom">
3402+
<sha256 value="55441db27e8869dfefe053059bdf478bdc7e95585642bf391f0023345fd56287" origin="Generated by Gradle"/>
3403+
</artifact>
3404+
</component>
34003405
<component group="com.google.guava" name="guava-parent" version="33.4.0-android">
34013406
<artifact name="guava-parent-33.4.0-android.pom">
34023407
<sha256 value="7220ede61026596fbc720ee4b93246fa2d14f328058532b59ef053de397c7d83" origin="Generated by Gradle"/>
@@ -3882,6 +3887,14 @@
38823887
<sha256 value="56bf7c0a22c1b226c16e70aee604fdd692b0c6f6be2eec2097451f3046bd6469" origin="Generated by Gradle"/>
38833888
</artifact>
38843889
</component>
3890+
<component group="com.synonym" name="vss-client-android" version="0.5.12">
3891+
<artifact name="vss-client-android-0.5.12.aar">
3892+
<sha256 value="caec6d83efd5b597d56697953ae39eafd86c84dfa09e464ab8d8cfc1603b32af" origin="Generated by Gradle"/>
3893+
</artifact>
3894+
<artifact name="vss-client-android-0.5.12.module">
3895+
<sha256 value="9250921a53219719f4d201d470af615ca46e70067dd96b6607a2ebc9191c0b15" origin="Generated by Gradle"/>
3896+
</artifact>
3897+
</component>
38853898
<component group="commons-codec" name="commons-codec" version="1.11">
38863899
<artifact name="commons-codec-1.11.jar">
38873900
<sha256 value="e599d5318e97aa48f42136a2927e6dfa4e8881dff0e6c8e3109ddbbff51d7b7d" origin="Generated by Gradle"/>
@@ -6515,6 +6528,11 @@
65156528
<sha256 value="5c876ef7e1ee07dd30721c43b46ead8eda23ce2b22260e70f933cbe004e80607" origin="Generated by Gradle"/>
65166529
</artifact>
65176530
</component>
6531+
<component group="org.jetbrains.kotlinx" name="atomicfu" version="0.23.1">
6532+
<artifact name="atomicfu-0.23.1.module">
6533+
<sha256 value="3e891fe636b55108192100fcf38b1a39bcd1c2533e23c462fc07644eeafcb20f" origin="Generated by Gradle"/>
6534+
</artifact>
6535+
</component>
65186536
<component group="org.jetbrains.kotlinx" name="atomicfu" version="0.27.0">
65196537
<artifact name="atomicfu-0.27.0.module">
65206538
<sha256 value="ba679c0757e399e68a99f97d738428b2fb7007717ddff0f1deeba862baf44690" origin="Generated by Gradle"/>
@@ -6531,6 +6549,14 @@
65316549
<sha256 value="35070f923ce69f87c6f90e5305720e2704409b69a2374492ac45be70075ee49a" origin="Generated by Gradle"/>
65326550
</artifact>
65336551
</component>
6552+
<component group="org.jetbrains.kotlinx" name="atomicfu-jvm" version="0.23.1">
6553+
<artifact name="atomicfu-jvm-0.23.1.jar">
6554+
<sha256 value="101ff43ff563fca167af5ade98c3b69bf569010eab745013b84d8955034d3b3c" origin="Generated by Gradle"/>
6555+
</artifact>
6556+
<artifact name="atomicfu-jvm-0.23.1.module">
6557+
<sha256 value="ffc62a02de0163073f83c7ff4c50ee1e6351b8822d1386d00e66212fd924e114" origin="Generated by Gradle"/>
6558+
</artifact>
6559+
</component>
65346560
<component group="org.jetbrains.kotlinx" name="atomicfu-jvm" version="0.27.0">
65356561
<artifact name="atomicfu-jvm-0.27.0.jar">
65366562
<sha256 value="2b68464170070a8b085d8a7224c7c002dbd65ea14e1f8b97a9605115a252f7fb" origin="Generated by Gradle"/>
@@ -6796,6 +6822,16 @@
67966822
<sha256 value="8b001180fe038611e7c7c477cbea6c035be877553af080bc9d7717bedc7c7258" origin="Generated by Gradle"/>
67976823
</artifact>
67986824
</component>
6825+
<component group="org.jetbrains.kotlinx" name="kotlinx-serialization-bom" version="1.6.0">
6826+
<artifact name="kotlinx-serialization-bom-1.6.0.pom">
6827+
<sha256 value="6ca648753b81e4ee0bf7f376c0636b78cafaa3b0716c1ca45ccd00cd94977477" origin="Generated by Gradle"/>
6828+
</artifact>
6829+
</component>
6830+
<component group="org.jetbrains.kotlinx" name="kotlinx-serialization-bom" version="1.6.2">
6831+
<artifact name="kotlinx-serialization-bom-1.6.2.pom">
6832+
<sha256 value="7b0e1d75ee8621499cf95430ca12fdaa32f4a7f920d5c301bfe95fa187f27337" origin="Generated by Gradle"/>
6833+
</artifact>
6834+
</component>
67996835
<component group="org.jetbrains.kotlinx" name="kotlinx-serialization-bom" version="1.7.3">
68006836
<artifact name="kotlinx-serialization-bom-1.7.3.pom">
68016837
<sha256 value="4226a491c5b59ce909f73b65aa98944191c8dcac3825637c6be1069e6b589a46" origin="Generated by Gradle"/>
@@ -6879,6 +6915,11 @@
68796915
<sha256 value="e9922300aff663e55ecef7d3fca305cb60a14755b1f980d94039e3c1cab645cc" origin="Generated by Gradle"/>
68806916
</artifact>
68816917
</component>
6918+
<component group="org.jetbrains.kotlinx" name="kotlinx-serialization-json" version="1.6.0">
6919+
<artifact name="kotlinx-serialization-json-1.6.0.module">
6920+
<sha256 value="21a81035213c9cd8800c76d76057cf45aa89c69da3b1292a9f8cd07fe0da2d07" origin="Generated by Gradle"/>
6921+
</artifact>
6922+
</component>
68826923
<component group="org.jetbrains.kotlinx" name="kotlinx-serialization-json" version="1.8.1">
68836924
<artifact name="kotlinx-serialization-json-1.8.1.module">
68846925
<sha256 value="7f7df005433ddf604f52aabd6afb21eb96093197cb4bdd0793c484c9d3c4b675" origin="Generated by Gradle"/>
@@ -6919,6 +6960,11 @@
69196960
<sha256 value="c8fbfde4b5ee1e41a69175165e839991d1501665a7590e23162326501ac6122c" origin="Generated by Gradle"/>
69206961
</artifact>
69216962
</component>
6963+
<component group="org.jetbrains.kotlinx" name="kotlinx-serialization-json-jvm" version="1.6.0">
6964+
<artifact name="kotlinx-serialization-json-jvm-1.6.0.module">
6965+
<sha256 value="386f5ae018615f4700204710d1cf09878327727ceb0130438e0f564f08add4c2" origin="Generated by Gradle"/>
6966+
</artifact>
6967+
</component>
69226968
<component group="org.jetbrains.kotlinx" name="kotlinx-serialization-json-jvm" version="1.8.1">
69236969
<artifact name="kotlinx-serialization-json-jvm-1.8.1.jar">
69246970
<sha256 value="8769e5647557e3700919c32d508f5c5dad53c5d8234cd10846354fbcff14aa24" origin="Generated by Gradle"/>
@@ -6968,11 +7014,17 @@
69687014
</artifact>
69697015
</component>
69707016
<component group="org.junit" name="junit-bom" version="5.10.2">
7017+
<artifact name="junit-bom-5.10.2.module">
7018+
<sha256 value="de23b114b3e4119a8fe6eb17bed5a3852816698bace67071579d6d927ebb080a" origin="Generated by Gradle"/>
7019+
</artifact>
69717020
<artifact name="junit-bom-5.10.2.pom">
69727021
<sha256 value="169dd904a4b0f6520cffe658cc62292bfe9f3c14a989fa92120724cde43a9968" origin="Generated by Gradle"/>
69737022
</artifact>
69747023
</component>
69757024
<component group="org.junit" name="junit-bom" version="5.9.2">
7025+
<artifact name="junit-bom-5.9.2.module">
7026+
<sha256 value="ab137ba5a8e32c9b066bf9126a1c76dd5614b724ba5c0b02549772b5e9f4cf1f" origin="Generated by Gradle"/>
7027+
</artifact>
69767028
<artifact name="junit-bom-5.9.2.pom">
69777029
<sha256 value="2ed07d65845131f5336a86476c9a4056b59d0b58b9815ab3679bb0f36f35f705" origin="Generated by Gradle"/>
69787030
</artifact>

0 commit comments

Comments
 (0)