chore(install): fail-closed sha256 verification for the install scrip… #211
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Please | |
| # Maintains a rolling "release" PR that bumps the version and regenerates | |
| # CHANGELOG.md from Conventional Commits. Merging that PR cuts a GitHub Release | |
| # and tag, which then triggers the GoReleaser build (release.yml) to attach | |
| # binaries, checksums, SBOMs and the cosign signature. | |
| on: | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| release-please: | |
| name: Release Please | |
| runs-on: ubuntu-latest | |
| outputs: | |
| release_created: ${{ steps.rp.outputs.release_created }} | |
| tag_name: ${{ steps.rp.outputs.tag_name }} | |
| steps: | |
| # Mint a token for the gplay GitHub App so the release PR, tag and commits | |
| # are authored by gplay[bot] instead of github-actions[bot]. | |
| - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| id: app-token | |
| with: | |
| app-id: ${{ secrets.GPLAY_APP_ID }} | |
| private-key: ${{ secrets.GPLAY_APP_PRIVATE_KEY }} | |
| # Scope the App token to least privilege rather than inheriting the | |
| # installation's blanket permissions: this repo only, and just the two | |
| # scopes release-please needs (open/maintain the release PR, push the | |
| # release commit + tag). PRD #206 pipeline hygiene. | |
| owner: ${{ github.repository_owner }} | |
| repositories: ${{ github.event.repository.name }} | |
| permission-contents: write | |
| permission-pull-requests: write | |
| - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 | |
| id: rp | |
| with: | |
| token: ${{ steps.app-token.outputs.token }} | |
| # Drives versioning from release-please-config.json + | |
| # .release-please-manifest.json (single root package, type "simple"). | |
| config-file: release-please-config.json | |
| manifest-file: .release-please-manifest.json | |
| release: | |
| name: Publish artifacts | |
| needs: release-please | |
| if: ${{ needs.release-please.outputs.release_created == 'true' }} | |
| permissions: | |
| contents: write | |
| id-token: write | |
| # A called reusable workflow can only use permissions the caller grants. | |
| # release.yml's goreleaser job requests attestations:write to publish | |
| # build-provenance; without it here GitHub rejects the run at startup | |
| # ("requesting 'attestations: write', but is only allowed 'attestations: | |
| # none'") on every push to main, before the `if` is even evaluated. | |
| attestations: write | |
| # GITHUB_TOKEN is forwarded to called workflows automatically; only the tap | |
| # PAT needs to be passed explicitly. | |
| secrets: | |
| HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }} | |
| uses: ./.github/workflows/release.yml | |
| with: | |
| ref: ${{ needs.release-please.outputs.tag_name }} |