19bface14f
The positive installation test (run-positive-installation.sh) and negative tests (run-negative-tests.sh) used 'gh release download', which requires a git context and GH_TOKEN. After the Isolate Workspace step removes .git, 'gh' fails with 'not a git repository'. Replace all 'gh' calls with anonymous 'curl --location' to match the real user path documented in linux-bootstrap.md: curl, sha256sum, cosign. A real user on a clean server has none of gh, GH_TOKEN, or a repo clone. Changes: - run-positive-installation.sh: rewrite to use curl for all downloads, add download() helper, add ISOLATION RULE comment, stricter shell opts - run-negative-tests.sh: same curl migration, remove alpha.8 backward compat test (verify-release checks for post-alpha.8 artifacts) - release-verification.yml: remove GH_TOKEN from positive and negative steps (only verify-assets retains it, runs before isolation)
67 lines
2.1 KiB
YAML
67 lines
2.1 KiB
YAML
name: Release Verification
|
|
|
|
on:
|
|
release:
|
|
types: [published]
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: 'Release tag to verify'
|
|
required: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
verify:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout tests
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
sparse-checkout: |
|
|
tests/release-verification
|
|
tests/contracts/monitor-snapshot-v1.txt
|
|
sparse-checkout-cone-mode: false
|
|
|
|
- name: Setup cosign
|
|
uses: sigstore/cosign-installer@v3.5.0
|
|
|
|
- name: Determine Tag
|
|
id: tag
|
|
run: |
|
|
if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
|
|
echo "tag=${{ github.event.inputs.tag }}" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "tag=${{ github.event.release.tag_name }}" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
- name: Verify Assets List
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
bash tests/release-verification/verify-assets.sh "${{ steps.tag.outputs.tag }}"
|
|
|
|
- name: Isolate Workspace
|
|
run: |
|
|
# Move tests to a safe location and clean the workspace.
|
|
# This ensures the installation does not accidentally use source files.
|
|
cp -r tests /tmp/isolated_tests
|
|
rm -rf * .git
|
|
|
|
- name: Run Positive Installation
|
|
# No GH_TOKEN: the real user path uses only curl/sha256sum/cosign.
|
|
run: |
|
|
mkdir -p workspace
|
|
cd workspace
|
|
# ISOLATION RULE: only expectation files come back from the repo.
|
|
mkdir -p tests/contracts
|
|
cp /tmp/isolated_tests/contracts/monitor-snapshot-v1.txt tests/contracts/
|
|
bash /tmp/isolated_tests/release-verification/run-positive-installation.sh "${{ steps.tag.outputs.tag }}"
|
|
|
|
- name: Run Negative Tests
|
|
# No GH_TOKEN: consistent with the positive path.
|
|
run: |
|
|
mkdir -p workspace-neg
|
|
cd workspace-neg
|
|
bash /tmp/isolated_tests/release-verification/run-negative-tests.sh "${{ steps.tag.outputs.tag }}"
|