mirror of
https://github.com/Heretek-AI/GDevelop-Unlocked.git
synced 2026-11-07 02:45:58 -10:00
Release: per-OS checksum files; no persisted checkout credentials
Raised in review: - A run-wide SHA256SUMS.txt went stale as soon as one OS was published into an existing release. Each build job now writes SHA256SUMS-<os>.txt for exactly the files it uploads; the publish job re-verifies them. - Workflows that run repository code no longer leave the checkout token on disk, and seam-tests/e2e get an explicit read-only token. - docs/release-signing.md claimed signing needed no workflow change. For macOS that is wrong: the ad-hoc step would replace a Developer ID signature. Corrected. - AUDIT_REPORT.md: say up front that it is append-only and §9 is current. Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
BillyOutlastandClaude Opus 5.5 committed
1 parent
2017aee1d3
commit
5131080a66
6 files changed
+69
-10
No files matched your search
@@ -24,12 +24,19 @@ on:
|
||||
env:
|
||||
UPSTREAM_RELEASE: v5.6.283
|
||||
|
||||
# These jobs run repository-controlled code (tests, scripts): read-only
|
||||
# token, and no credentials left in the checkout for that code to find.
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
tier1-smoke:
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 25
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 22
|
||||
@@ -69,6 +76,8 @@ jobs:
|
||||
timeout-minutes: 10
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 22
|
||||
@@ -110,6 +119,8 @@ jobs:
|
||||
- 11434:11434
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
persist-credentials: false
|
||||
- name: Wait for the Ollama server
|
||||
run: |
|
||||
for _ in $(seq 1 60); do
|
||||
|
||||
@@ -57,6 +57,7 @@ jobs:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
path: unlocked
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 22
|
||||
@@ -105,11 +106,17 @@ jobs:
|
||||
--disable-dev-shm-usage --user-data-dir="$REL/profile" \
|
||||
--heretek-smoke > "$REL/smoke.log" 2>&1 || true
|
||||
node unlocked/scripts/assert-smoke-verdict.mjs "$REL/smoke.log"
|
||||
- name: Checksums for exactly the files this job uploads
|
||||
run: |
|
||||
cd upstream/newIDE/electron-app/dist
|
||||
sha256sum -- *.zip > SHA256SUMS-linux.txt && cat SHA256SUMS-linux.txt
|
||||
- name: Upload installer artifact
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: gdevelop-unlocked-linux-x64-${{ inputs.upstream_ref }}
|
||||
path: upstream/newIDE/electron-app/dist/*.zip
|
||||
path: |
|
||||
upstream/newIDE/electron-app/dist/*.zip
|
||||
upstream/newIDE/electron-app/dist/SHA256SUMS-linux.txt
|
||||
if-no-files-found: error
|
||||
|
||||
build-windows:
|
||||
@@ -125,6 +132,7 @@ jobs:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
path: unlocked
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 22
|
||||
@@ -178,6 +186,10 @@ jobs:
|
||||
"$BIN" --no-sandbox --disable-gpu --user-data-dir="$REL/profile" \
|
||||
--heretek-smoke > "$REL/smoke.log" 2>&1 || true
|
||||
node unlocked/scripts/assert-smoke-verdict.mjs "$REL/smoke.log"
|
||||
- name: Checksums for exactly the files this job uploads
|
||||
run: |
|
||||
cd upstream/newIDE/electron-app/dist
|
||||
sha256sum -- *.exe *.zip > SHA256SUMS-windows.txt && cat SHA256SUMS-windows.txt
|
||||
- name: Upload installer artifacts
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
@@ -185,6 +197,7 @@ jobs:
|
||||
path: |
|
||||
upstream/newIDE/electron-app/dist/*.exe
|
||||
upstream/newIDE/electron-app/dist/*.zip
|
||||
upstream/newIDE/electron-app/dist/SHA256SUMS-windows.txt
|
||||
if-no-files-found: error
|
||||
|
||||
build-macos:
|
||||
@@ -195,6 +208,7 @@ jobs:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
path: unlocked
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 22
|
||||
@@ -261,11 +275,17 @@ jobs:
|
||||
OUT="upstream/newIDE/electron-app/dist/GDevelop-Unlocked-mac-universal.zip"
|
||||
ditto -c -k --sequesterRsrc --keepParent "$APP" "$OUT"
|
||||
ls -lh "$OUT"
|
||||
- name: Checksums for exactly the files this job uploads
|
||||
run: |
|
||||
cd upstream/newIDE/electron-app/dist
|
||||
shasum -a 256 GDevelop-Unlocked-mac-universal.zip > SHA256SUMS-macos.txt && cat SHA256SUMS-macos.txt
|
||||
- name: Upload installer artifact
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: gdevelop-unlocked-macos-universal-${{ inputs.upstream_ref }}
|
||||
path: upstream/newIDE/electron-app/dist/GDevelop-Unlocked-mac-universal.zip
|
||||
path: |
|
||||
upstream/newIDE/electron-app/dist/GDevelop-Unlocked-mac-universal.zip
|
||||
upstream/newIDE/electron-app/dist/SHA256SUMS-macos.txt
|
||||
if-no-files-found: error
|
||||
|
||||
publish:
|
||||
@@ -286,8 +306,14 @@ jobs:
|
||||
with:
|
||||
path: dist
|
||||
merge-multiple: true
|
||||
- name: List what will be published
|
||||
run: ls -lh dist && (cd dist && sha256sum -- * > SHA256SUMS.txt && cat SHA256SUMS.txt)
|
||||
# Each OS job ships its own SHA256SUMS-<os>.txt next to its files, so
|
||||
# publishing one OS later replaces that OS's files AND its sums
|
||||
# together and never leaves another OS's sums stale.
|
||||
- name: List and re-verify what will be published
|
||||
run: |
|
||||
ls -lh dist
|
||||
cd dist
|
||||
for sums in SHA256SUMS-*.txt; do sha256sum --check "$sums"; done
|
||||
- name: Publish GitHub release
|
||||
uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
|
||||
with:
|
||||
@@ -304,6 +330,6 @@ jobs:
|
||||
- **Unsigned.** These builds carry no publisher signature. Windows SmartScreen and macOS Gatekeeper will warn; on macOS, right-click → Open, or clear the quarantine flag (`xattr -dr com.apple.quarantine "GDevelop 5.app"`). The macOS app is ad-hoc signed only so Apple Silicon can launch it.
|
||||
- **Auto-update is disabled by design.** The build ships no update feed; a stock update would replace the patched app. Download each new release from this page.
|
||||
- Not affiliated with or supported by the GDevelop team. Analytics and other non-AI network behavior are unchanged from upstream.
|
||||
- Verify downloads against `SHA256SUMS.txt`.
|
||||
- Verify downloads against the `SHA256SUMS-<os>.txt` file for your platform.
|
||||
files: dist/*
|
||||
fail_on_unmatched_files: true
|
||||
@@ -8,11 +8,18 @@ on:
|
||||
- cron: '0 6 * * 1' # weekly drift check against upstream baseline
|
||||
workflow_dispatch: # lets the suite be run on a work branch before a PR
|
||||
|
||||
# These jobs run repository-controlled code (tests, scripts): read-only
|
||||
# token, and no credentials left in the checkout for that code to find.
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
seams:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 22 # package.json engines: >=22
|
||||
|
||||
@@ -33,7 +33,7 @@
|
||||
## Test commands
|
||||
|
||||
```bash
|
||||
npm test # everything (must be 129/129+)
|
||||
npm test # everything (must be 131/131+)
|
||||
npm run test:integration # tests/integration/ only
|
||||
node scripts/apply-patches.mjs --check # seam gate
|
||||
node scripts/apply-patches.mjs --verify-only --target <patched-tree> # marker contract, read-only
|
||||
|
||||
+6
-1
@@ -1,5 +1,10 @@
|
||||
# AUDIT REPORT — GDevelop-Unlocked adversarial audit (2026-10-11)
|
||||
|
||||
> **How to read this:** the report is append-only. §1–§6 are the original
|
||||
> audit and are kept as written — including a FAIL verdict and "OPEN"
|
||||
> rows that later sections close. **The current status is the last
|
||||
> addendum (§9)**; §7 and §8 are the steps in between.
|
||||
|
||||
- Audited commit: `13ddde2` (`feature/ci-e2e`) + remediation in working tree.
|
||||
- Fixtures: upstream `review/GDevelop @ 8301cdcaa4`, donor fork `review/GDevelop-Heretek @ f7d450a1d9a`.
|
||||
- Full suite at report time: **96/96 green** (32 suites), `apply-patches.mjs --check` green.
|
||||
@@ -209,7 +214,7 @@ loop (B) and live-browser XHR proof (D), both still open follow-ups;
|
||||
## 9. Verification + layer-3 addendum (2026-10-11, later session)
|
||||
|
||||
Work is on branch `handoff/verify-and-tracker-2026-10-11`; `main` is
|
||||
unchanged. Suite on the branch: **129/129** (39 suites); `main` re-verified
|
||||
unchanged. Suite on the branch: **131/131** (39 suites); `main` re-verified
|
||||
at 102/102 first. Layer-3 = the CI artifact from run `38106050979` driven
|
||||
headless over the DevTools protocol (Electron 32.3.3 / Chromium 128),
|
||||
logged out.
|
||||
|
||||
+13
-3
@@ -37,9 +37,19 @@ variables; this repo only sets `GD_PORTABLE_BUILD`:
|
||||
`APPLEIDPASS`, `APPLETEAMID` are set (it skips quietly when `APPLEID`
|
||||
is absent).
|
||||
|
||||
So signing is a matter of supplying credentials as GitHub Actions
|
||||
secrets and dropping `GD_PORTABLE_BUILD` for that OS job — no build
|
||||
code needs to change.
|
||||
So upstream's build code needs no change — but `release.yml` does, and
|
||||
differently per OS:
|
||||
|
||||
- **Windows:** supply the credentials as GitHub Actions secrets and drop
|
||||
`GD_PORTABLE_BUILD` for `build-windows`.
|
||||
- **macOS:** the same, **and remove the ad-hoc step.** `build-macos`
|
||||
builds the bare `.app` (`--mac dir`), then runs
|
||||
`codesign --force --deep --sign -`, which would *replace* a Developer
|
||||
ID signature with an ad-hoc one — after notarization, at that. A signed
|
||||
macOS job must build the normal targets, skip that step, and verify
|
||||
what it actually ships (`codesign --verify --deep --strict`,
|
||||
`spctl --assess --type execute`, `xcrun stapler validate`) before
|
||||
upload.
|
||||
|
||||
## Options
|
||||
|
||||
|
||||
Reference in new issue
Block a user