mirror of
https://github.com/esengine/DeepSeek-Reasonix.git
synced 2026-11-07 10:45:59 -10:00
SivanCola
b6da01dbdc
Context: Stable and Preview need independent reviewed identities while CLI, Desktop, npm, and changelog publication remain one protected release event. Changes: - Add a protected Preview orchestrator with a shared ordinal and SignPath preflight. - Bind reviewed release notes to immutable all-surface publication markers. - Route downloads and changelog archives by channel with accessible theme-aware navigation. - Harden release authorization, manifests, tests, and operator documentation. Compatibility: - Legacy catalog entries without managed status remain readable and public. - Existing Stable pointers remain unchanged, and Preview continues mirroring the legacy canary pointer for older Desktop clients. - No persisted user state or Wails JSON contract changes. Verification: - bash scripts/release-workflows.test.sh - node --test scripts/release-notes.test.mjs - cd desktop && go test ./cmd/sign ./internal/update - cd site && npm test - cd site && npm run build - actionlint for all release workflows
71 lines
2.7 KiB
Bash
Executable File
71 lines
2.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Verify the non-forgeable GitHub context behind an orchestrated stable release.
|
|
# Inputs arrive through environment variables so workflow expressions never
|
|
# become shell source.
|
|
set -euo pipefail
|
|
|
|
actual_caller="${ACTUAL_CALLER_WORKFLOW_REF:?ACTUAL_CALLER_WORKFLOW_REF is required}"
|
|
expected_caller="${EXPECTED_CALLER_WORKFLOW_REF:?EXPECTED_CALLER_WORKFLOW_REF is required}"
|
|
caller_event="${CALLER_EVENT_NAME:?CALLER_EVENT_NAME is required}"
|
|
caller_ref="${CALLER_REF:?CALLER_REF is required}"
|
|
caller_ref_protected="${CALLER_REF_PROTECTED:?CALLER_REF_PROTECTED is required}"
|
|
caller_workflow_sha="${CALLER_WORKFLOW_SHA:?CALLER_WORKFLOW_SHA is required}"
|
|
caller_sha="${CALLER_SHA:?CALLER_SHA is required}"
|
|
approved_cli_tag="${APPROVED_CLI_TAG:?APPROVED_CLI_TAG is required}"
|
|
approved_sha="${APPROVED_SHA:?APPROVED_SHA is required}"
|
|
approved_channel="${APPROVED_CHANNEL:-stable}"
|
|
|
|
if [ "$actual_caller" != "$expected_caller" ]; then
|
|
echo "::error::orchestrated release caller is $actual_caller, expected $expected_caller" >&2
|
|
exit 1
|
|
fi
|
|
if [ "$caller_ref_protected" != "true" ]; then
|
|
echo "::error::orchestrated release caller ref is not protected: $caller_ref" >&2
|
|
exit 1
|
|
fi
|
|
case "$approved_channel" in
|
|
stable)
|
|
approved_tag_pattern='^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$'
|
|
approved_tag_description='vMAJOR.MINOR.PATCH'
|
|
;;
|
|
preview)
|
|
approved_tag_pattern='^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)-preview\.([1-9][0-9]*)$'
|
|
approved_tag_description='vMAJOR.MINOR.PATCH-preview.N'
|
|
;;
|
|
*)
|
|
echo "::error::approved release channel must be stable or preview, got: $approved_channel" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
if [[ ! "$approved_cli_tag" =~ $approved_tag_pattern ]]; then
|
|
echo "::error::approved CLI tag must be $approved_tag_description, got: $approved_cli_tag" >&2
|
|
exit 1
|
|
fi
|
|
|
|
case "$caller_event" in
|
|
push)
|
|
expected_ref="refs/tags/$approved_cli_tag"
|
|
if [ "$caller_workflow_sha" != "$approved_sha" ] || [ "$caller_sha" != "$approved_sha" ]; then
|
|
echo "::error::tag-push caller SHA/workflow SHA must equal approved SHA $approved_sha (caller=$caller_sha workflow=$caller_workflow_sha)" >&2
|
|
exit 1
|
|
fi
|
|
;;
|
|
workflow_dispatch)
|
|
expected_ref="refs/heads/main-v2"
|
|
if [ "$caller_workflow_sha" != "$caller_sha" ]; then
|
|
echo "::error::recovery caller workflow SHA is $caller_workflow_sha, expected protected main-v2 SHA $caller_sha" >&2
|
|
exit 1
|
|
fi
|
|
;;
|
|
*)
|
|
echo "::error::unsupported orchestrated release caller event: $caller_event" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
if [ "$caller_ref" != "$expected_ref" ]; then
|
|
echo "::error::orchestrated release caller ref is $caller_ref, expected $expected_ref" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "release authorization verified: caller=$actual_caller sha=$approved_sha"
|