Claude
7e0728e46b
Captain Bob, 2026-11-12: "release MUST refuse unsigned builds". release.yml's "The capsule-signing key" step warned when CAPSULE_SIGN_KEY was missing and the release went on, unsigned. Now it is an ::error:: and the step fails, as the gate into master's does (#174). build.yml and nightly.yml still warn. scripts/test_acceptance_signing.sh now takes the step from both acceptance.yml and release.yml as CI runs them. Against release.yml as it was: the release's unsigned case passed, no error -- 2 failures (acceptance's 3 checks passed). Now 6 checks, all pass. logs/20261112-205446/. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017RzZgrf7V7Zk2iczBXDRbm
45 lines
2.1 KiB
Bash
Executable File
45 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# SPDX-License-Identifier: LicenseRef-Starship-1.0
|
|
# Copyright (c) 2023-2026 Robert A. James
|
|
# test_acceptance_signing.sh -- the gate into master (#174) and a release (Captain Bob, 2026-11-12:
|
|
# "release MUST refuse unsigned builds") refuse an unsigned build. Each workflow's step "The
|
|
# capsule-signing key" is taken from the workflow as CI runs it, and run here with and without
|
|
# CAPSULE_SIGN_KEY.
|
|
#
|
|
# Prints PASS:/FAIL: per check and RESULT:; exits 0 only if every check passes.
|
|
set -uo pipefail
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
T=$(mktemp -d)
|
|
trap 'rm -rf "$T"' EXIT
|
|
ok=1
|
|
|
|
check_workflow() { # check_workflow <workflow> <job>
|
|
local wf=$1 job=$2 step="$T/$1.sh"
|
|
if ! python3 - "$ROOT/.gitea/workflows/$wf.yml" "$job" "$step" <<'EOF'
|
|
import sys, yaml
|
|
steps = yaml.safe_load(open(sys.argv[1]))["jobs"][sys.argv[2]]["steps"]
|
|
run = [s["run"] for s in steps if s.get("name") == "The capsule-signing key"]
|
|
assert len(run) == 1
|
|
open(sys.argv[3], "w").write(run[0])
|
|
EOF
|
|
then echo "FAIL: $wf: no 'The capsule-signing key' step in job $job"; ok=0; return; fi
|
|
|
|
run_step() { : > "$T/env"; KEY="$1" GITHUB_ENV="$T/env" RUNNER_TEMP="$T" bash -e "$step" > "$T/out" 2>&1; }
|
|
|
|
if run_step ""; then echo "FAIL: $wf: no CAPSULE_SIGN_KEY: the step passed -- an unsigned build would go on"; ok=0
|
|
else echo "PASS: $wf: no CAPSULE_SIGN_KEY: the step fails, the unsigned build is refused"; fi
|
|
grep -q "::error::" "$T/out" && echo "PASS: $wf: and says so as an error" || { echo "FAIL: $wf: no ::error:: line"; ok=0; }
|
|
|
|
if run_step "-----BEGIN PRIVATE KEY----- test -----END PRIVATE KEY-----" &&
|
|
grep -q "^SIGN_KEY=$T/capsule-signing.key$" "$T/env" && [ -s "$T/capsule-signing.key" ]; then
|
|
echo "PASS: $wf: with a key: the step passes and hands it to the build (SIGN_KEY)"
|
|
else echo "FAIL: $wf: with a key: the step did not pass, or did not set SIGN_KEY"; ok=0; fi
|
|
rm -f "$T/capsule-signing.key"
|
|
}
|
|
|
|
check_workflow acceptance acceptance # the gate into master (#174)
|
|
check_workflow release release # a release
|
|
|
|
echo "RESULT: $([ $ok = 1 ] && echo PASS || echo FAIL)"
|
|
[ $ok = 1 ]
|