Skip to content

Commit 9bb88c4

Browse files
jrfnljrfnl
committed
GH Actions: automate release verification steps
While the actual releasing can not be fully automated (due to security concerns related to signing releases in a GHA workflow), there are a number of verification checks which are part of the release workflow, which _can_ be automated. These checks were previously done as manual spot-checks. With the new workflow, they will now be executed structurally and automatically whenever a release is published on GitHub. The checks which are automated via this workflow are as follows: * For the PHAR files which can be downloaded from the GH "releases" page, the (unversioned) PHAR files published on the GH Pages website and the versioned PHAR files published on the GH Pages website for Phive (but which can also be downloaded manually), the following checks will now be run automatically: - Is the PHAR file available and can it be downloaded ? - Is the ASC (detached signature) file available and can it be downloaded ? - Verify the PHAR file via the attestation (which was created when the PHAR was created for a tag). - Verify the PHAR file is GPG signed and the signature matches. - Verify the PHAR file is functional (simple command runs without problems). - Verify the version with which the PHAR file identifies itself is the expected version. * For Phive: - Install via Phive. This will automatically also check the PHAR file is signed and the signature matches. - Verify the Phive installed PHAR file via the attestation. - Verify the Phive installed PHAR file is functional (simple command runs without problems). - Verify the version with which the PHAR file identifies itself is the expected version. Note: these checks will only run for releases from this repo. If a fork of the repo would publish their own releases, the workflow would fail anyhow (as the releases wouldn't be published to the website, nor accessible via Phive), so may as well prevent the workflow from running altogether.
1 parent 799e293 commit 9bb88c4

File tree

1 file changed

+203
-0
lines changed

1 file changed

+203
-0
lines changed

‎.github/workflows/verify-release.yml

+203
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,203 @@
1+
name: Verify release
2+
3+
on:
4+
# Run whenever a release is published.
5+
release:
6+
types: [published]
7+
# And whenever this workflow is updated.
8+
push:
9+
paths:
10+
- '.github/workflows/verify-release.yml'
11+
pull_request:
12+
paths:
13+
- '.github/workflows/verify-release.yml'
14+
# Allow manually triggering the workflow.
15+
workflow_dispatch:
16+
17+
# Cancels all previous workflow runs for the same branch that have not yet completed.
18+
concurrency:
19+
# The concurrency group contains the workflow name and the branch name.
20+
group: ${{ github.workflow }}-${{ github.ref }}
21+
cancel-in-progress: true
22+
23+
jobs:
24+
##################################################################################
25+
# Verify the release is available in all the right places and works as expected. #
26+
##################################################################################
27+
verify-available-downloads:
28+
runs-on: ubuntu-latest
29+
30+
# Only run this workflow in the context of this repo.
31+
if: github.repository_owner == 'PHPCSStandards'
32+
33+
strategy:
34+
fail-fast: false
35+
matrix:
36+
download_flavour:
37+
- "Release assets"
38+
- "Unversioned web"
39+
- "Versioned web"
40+
pharfile:
41+
- 'phpcs'
42+
- 'phpcbf'
43+
44+
name: "${{ matrix.download_flavour }}: ${{ matrix.pharfile }}"
45+
46+
steps:
47+
- name: Retrieve latest release info
48+
uses: octokit/[email protected]
49+
id: get_latest_release
50+
with:
51+
route: GET /repos/PHPCSStandards/PHP_CodeSniffer/releases/latest
52+
env:
53+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
54+
55+
- name: "DEBUG: Show API request failure status"
56+
if: ${{ failure() }}
57+
run: "echo No release found. Request failed with status ${{ steps.get_latest_release.outputs.status }}"
58+
59+
- name: Grab latest tag name from API response
60+
id: version
61+
run: |
62+
echo "TAG=${{ fromJson(steps.get_latest_release.outputs.data).tag_name }}" >> "$GITHUB_OUTPUT"
63+
64+
- name: "DEBUG: Show tag name found in API response"
65+
run: "echo ${{ steps.version.outputs.TAG }}"
66+
67+
- name: Set source URL and file name
68+
id: source
69+
shell: bash
70+
run: |
71+
if [[ "${{ matrix.download_flavour }}" == "Release assets" ]]; then
72+
echo 'SRC=https://github.com/PHPCSStandards/PHP_CodeSniffer/releases/latest/download/' >> "$GITHUB_OUTPUT"
73+
echo "FILE=${{ matrix.pharfile }}.phar" >> "$GITHUB_OUTPUT"
74+
elif [[ "${{ matrix.download_flavour }}" == "Unversioned web" ]]; then
75+
echo 'SRC=https://phars.phpcodesniffer.com/' >> "$GITHUB_OUTPUT"
76+
echo "FILE=${{ matrix.pharfile }}.phar" >> "$GITHUB_OUTPUT"
77+
else
78+
echo 'SRC=https://phars.phpcodesniffer.com/phars/' >> "$GITHUB_OUTPUT"
79+
echo "FILE=${{ matrix.pharfile }}-${{ steps.version.outputs.TAG }}.phar" >> "$GITHUB_OUTPUT"
80+
fi
81+
82+
- name: Verify PHAR file is available and download
83+
run: "wget -O ${{ steps.source.outputs.FILE }} ${{ steps.source.outputs.SRC }}${{ steps.source.outputs.FILE }}"
84+
85+
- name: Verify signature file is available and download
86+
run: "wget -O ${{ steps.source.outputs.FILE }}.asc ${{ steps.source.outputs.SRC }}${{ steps.source.outputs.FILE }}.asc"
87+
88+
- name: "DEBUG: List files"
89+
run: ls -Rlh
90+
91+
- name: Verify attestation of the PHAR file
92+
run: gh attestation verify ${{ steps.source.outputs.FILE }} -o PHPCSStandards
93+
env:
94+
GH_TOKEN: ${{ github.token }}
95+
96+
- name: Download public key
97+
env:
98+
FINGERPRINT: "0x689DAD778FF08760E046228BA978220305CD5C32"
99+
run: gpg --keyserver "hkps://keys.openpgp.org" --recv-keys "$FINGERPRINT"
100+
101+
- name: Verify signature of the PHAR file
102+
run: gpg --verify ${{ steps.source.outputs.FILE }}.asc ${{ steps.source.outputs.FILE }}
103+
104+
- name: Setup PHP
105+
uses: shivammathur/setup-php@v2
106+
with:
107+
php-version: 'latest'
108+
ini-values: error_reporting=-1, display_errors=On
109+
coverage: none
110+
111+
# Note: the `.` is in the command to make it work for both PHPCS as well PHPCBF.
112+
- name: Verify the PHAR is nominally functional
113+
run: php ${{ steps.source.outputs.FILE }} . -e --standard=PSR12
114+
115+
- name: Grab the version
116+
id: asset_version
117+
env:
118+
FILE_NAME: ${{ steps.source.outputs.FILE }}
119+
# yamllint disable-line rule:line-length
120+
run: echo "VERSION=$(php "$FILE_NAME" --version | grep --only-matching --max-count=1 --extended-regexp '\b[0-9]+(\.[0-9]+)+')" >> "$GITHUB_OUTPUT"
121+
122+
- name: "DEBUG: Show grabbed version"
123+
run: echo ${{ steps.asset_version.outputs.VERSION }}
124+
125+
- name: Fail the build if the PHAR is not the correct version
126+
if: ${{ steps.asset_version.outputs.VERSION != steps.version.outputs.TAG }}
127+
run: exit 1
128+
129+
# #########################################
130+
# Verify install via PHIVE.
131+
# #########################################
132+
verify-phive:
133+
runs-on: ubuntu-latest
134+
135+
# Only run this workflow in the context of this repo.
136+
if: github.repository_owner == 'PHPCSStandards'
137+
138+
strategy:
139+
fail-fast: false
140+
matrix:
141+
pharfile:
142+
- 'phpcs'
143+
- 'phpcbf'
144+
145+
name: "PHIVE: ${{ matrix.pharfile }}"
146+
147+
steps:
148+
- name: Retrieve latest release info
149+
uses: octokit/[email protected]
150+
id: get_latest_release
151+
with:
152+
route: GET /repos/PHPCSStandards/PHP_CodeSniffer/releases/latest
153+
env:
154+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
155+
156+
- name: "DEBUG: Show API request failure status"
157+
if: ${{ failure() }}
158+
run: "echo No release found. Request failed with status ${{ steps.get_latest_release.outputs.status }}"
159+
160+
- name: Grab latest tag name from API response
161+
id: version
162+
run: |
163+
echo "TAG=${{ fromJson(steps.get_latest_release.outputs.data).tag_name }}" >> "$GITHUB_OUTPUT"
164+
165+
- name: "DEBUG: Show tag name found in API response"
166+
run: "echo ${{ steps.version.outputs.TAG }}"
167+
168+
- name: Setup PHP
169+
uses: shivammathur/setup-php@v2
170+
with:
171+
php-version: 'latest'
172+
ini-values: error_reporting=-1, display_errors=On
173+
coverage: none
174+
tools: phive
175+
176+
- name: Install
177+
run: phive install ${{ matrix.pharfile }} --copy --trust-gpg-keys 689DAD778FF08760E046228BA978220305CD5C32
178+
179+
- name: "DEBUG: List files"
180+
run: ls -R
181+
182+
- name: Verify attestation of the PHAR file
183+
run: gh attestation verify ./tools/${{ matrix.pharfile }} -o PHPCSStandards
184+
env:
185+
GH_TOKEN: ${{ github.token }}
186+
187+
# Note: the `.` is in the command to make it work for both PHPCS as well PHPCBF.
188+
- name: Verify the PHAR is nominally functional
189+
run: php ./tools/${{ matrix.pharfile }} . -e --standard=PSR12
190+
191+
- name: Grab the version
192+
id: asset_version
193+
env:
194+
FILE_NAME: ./tools/${{ matrix.pharfile }}
195+
# yamllint disable-line rule:line-length
196+
run: echo "VERSION=$(php "$FILE_NAME" --version | grep --only-matching --max-count=1 --extended-regexp '\b[0-9]+(\.[0-9]+)+')" >> "$GITHUB_OUTPUT"
197+
198+
- name: "DEBUG: Show grabbed version"
199+
run: echo ${{ steps.asset_version.outputs.VERSION }}
200+
201+
- name: Fail the build if the PHAR is not the correct version
202+
if: ${{ steps.asset_version.outputs.VERSION != steps.version.outputs.TAG }}
203+
run: exit 1

0 commit comments

Comments
 (0)