danvics/Pulse
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix critical release workflow issues identified in review

Browse source 
Addresses 3 critical issues from 4-dev team review:

1. CRITICAL: Fix non-deterministic checksum generation (Dev 2 & 3)
   - Add explicit sorting to checksums.txt generation
   - Prevents #671 checksum mismatches between builds
   - Location: scripts/build-release.sh:348

2. CRITICAL: Fix upload/validation race condition (Dev 1)
   - Change validation trigger from 'release: created' to 'workflow_run'
   - Prevents validation from running while assets still uploading
   - Prevents valid releases from being incorrectly deleted
   - Location: .github/workflows/validate-release-assets.yml:4-8

3. CRITICAL: Fix GitHub token exposure in logs (Dev 1)
   - Replace curl commands with gh CLI
   - Prevents token leakage in workflow logs
   - Location: .github/workflows/validate-release-assets.yml:44, 63

All three issues were blocking issues that could cause release failures.
Remaining high/medium priority issues to be addressed in follow-up PRs.
This commit is contained in:
rcourtman 2025-11-11 11:32:44 +00:00
parent 7e10979117
commit b604a63322
2 changed files with 12 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
.github/workflows/validate-release-assets.yml vendored
View file

@ -1,8 +1,11 @@
name: Validate Release Assets name: Validate Release Assets
on: on:
workflow_run:
workflows: ["Release"]
types: [completed]
release: release:
types: [created, edited] types: [edited] # Still validate on manual edits
jobs: jobs:
validate: validate:
@ -37,10 +40,9 @@ jobs:
mkdir -p release mkdir -p release
cd release cd release
# Get list of all assets for this release # Get list of all assets for this release (using gh CLI to avoid token exposure)
ASSETS=$(curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \ ASSETS=$(gh api "repos/${{ github.repository }}/releases/${{ github.event.release.id }}/assets" \
"https://api.github.com/repos/${{ github.repository }}/releases/${{ github.event.release.id }}/assets" \ --jq '.[].browser_download_url')
| jq -r '.[].browser_download_url')
if [ -z "$ASSETS" ]; then if [ -z "$ASSETS" ]; then
echo "::error::No assets found in release" echo "::error::No assets found in release"
@ -57,9 +59,9 @@ jobs:
if [ -n "$url" ]; then if [ -n "$url" ]; then
filename=$(basename "$url") filename=$(basename "$url")
echo "Downloading $filename..." echo "Downloading $filename..."
curl -L -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \ # Use gh CLI to download (avoids token exposure in logs)
-H "Accept: application/octet-stream" \ gh release download "${{ github.event.release.tag_name }}" \
-o "$filename" "$url" --pattern "$filename" --dir . --clobber
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
echo "✓ Downloaded $filename ($(du -h "$filename" | cut -f1))" echo "✓ Downloaded $filename ($(du -h "$filename" | cut -f1))"

3
scripts/build-release.sh
View file

@ -344,7 +344,8 @@ else
done done
# Also generate combined checksums.txt for convenience # Also generate combined checksums.txt for convenience
sha256sum "${checksum_files[@]}" > checksums.txt # Sort checksums by filename for deterministic output (prevents #671 checksum mismatches)
sha256sum "${checksum_files[@]}" | sort -k 2 > checksums.txt
if [ -n "${SIGNING_KEY_ID:-}" ]; then if [ -n "${SIGNING_KEY_ID:-}" ]; then
if command -v gpg >/dev/null 2>&1; then if command -v gpg >/dev/null 2>&1; then
echo "Signing checksums with GPG key ${SIGNING_KEY_ID}..." echo "Signing checksums with GPG key ${SIGNING_KEY_ID}..."