fix: provision cosign and automate release verification #43

Merged

ochenstarik-ui merged 1 commit from codex/cosign-provisioning into main

2026-08-17 16:26:56 +00:00

ochenstarik-ui commented

2026-08-15 16:30:10 +00:00

(Migrated from github.com)

Summary

provision pinned cosign v3.1.3 for amd64 and arm64, verify its fixed SHA-256 before execution, and install it at /usr/local/bin/cosign with mode 0755;
preserve a working cosign already in PATH and fail with actionable version, checksum, and path details on download or checksum failure;
exercise clean-host install-hub and install-node paths and keep the signed-release negative tests;
trigger Release Verification from successful tag runs of Release pipeline via workflow_run while preserving manual workflow_dispatch(tag);
record alpha.14 as verifiable but not clean-host installable and alpha.15 as the first clean-host installable release.

Autostart design

workflow_run keeps release verification separate from the sole publishing workflow. It is emitted when Release pipeline completes even when that pipeline published through GITHUB_TOKEN. The verify job accepts only successful runs whose head branch is a v* tag; workflow_dispatch remains available for explicit re-verification.

Local verification

bash syntax checks for all changed shell scripts — passed;
tests/bootstrap/test-cosign-provisioning.sh — passed (COSIGN_PROVISIONING=PASS);
tests/bootstrap/test-release-contract.sh — passed (RELEASE_CONTRACT=PASS);
tests/bootstrap/test-bootstrap-contract.sh — passed (BOOTSTRAP_CONTRACT=PASS);
release-verification.yml YAML parse — passed;
shellcheck was unavailable locally; the Release pipeline bootstrap job ran it successfully.

CI verification

Release safety

The dry run used branch codex/cosign-provisioning at 6bd58abe2f. Build, packaging, manifest generation, and keyless signing passed; publication was skipped because the ref was not a tag. PR #43 is not merged and v0.1.0-alpha.15 has not been created.

Not verified

Physical acceptance on real servers is intentionally outside this task and remains for the owner after release.

## Summary - provision pinned cosign v3.1.3 for amd64 and arm64, verify its fixed SHA-256 before execution, and install it at /usr/local/bin/cosign with mode 0755; - preserve a working cosign already in PATH and fail with actionable version, checksum, and path details on download or checksum failure; - exercise clean-host install-hub and install-node paths and keep the signed-release negative tests; - trigger Release Verification from successful tag runs of Release pipeline via workflow_run while preserving manual workflow_dispatch(tag); - record alpha.14 as verifiable but not clean-host installable and alpha.15 as the first clean-host installable release. ## Autostart design workflow_run keeps release verification separate from the sole publishing workflow. It is emitted when Release pipeline completes even when that pipeline published through GITHUB_TOKEN. The verify job accepts only successful runs whose head branch is a v* tag; workflow_dispatch remains available for explicit re-verification. ## Local verification - bash syntax checks for all changed shell scripts — passed; - tests/bootstrap/test-cosign-provisioning.sh — passed (COSIGN_PROVISIONING=PASS); - tests/bootstrap/test-release-contract.sh — passed (RELEASE_CONTRACT=PASS); - tests/bootstrap/test-bootstrap-contract.sh — passed (BOOTSTRAP_CONTRACT=PASS); - release-verification.yml YAML parse — passed; - shellcheck was unavailable locally; the Release pipeline bootstrap job ran it successfully. ## CI verification - [Linux control and agent — passed](https://github.com/ochenstarik-ui/server-monitor-manager/actions/runs/31895679704) - [Windows build — passed](https://github.com/ochenstarik-ui/server-monitor-manager/actions/runs/31895679681) - [Linux platform matrix — passed](https://github.com/ochenstarik-ui/server-monitor-manager/actions/runs/31895679691) - [Release pipeline workflow_dispatch dry run — passed](https://github.com/ochenstarik-ui/server-monitor-manager/actions/runs/31896047151) ## Release safety The dry run used branch codex/cosign-provisioning at 6bd58abe2f8e38e1cc0f0be6f4d84563298cfa60. Build, packaging, manifest generation, and keyless signing passed; publication was skipped because the ref was not a tag. PR #43 is not merged and v0.1.0-alpha.15 has not been created. ## Not verified Physical acceptance on real servers is intentionally outside this task and remains for the owner after release.