fix: use canonical Terraphim collateral links (#6) #4
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish marketplace pack | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| permissions: | |
| contents: read | |
| jobs: | |
| validate: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out tagged source | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| with: | |
| # Signature verification needs the annotated tag object, not only the | |
| # commit that a shallow tag checkout resolves to. | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Set up Python | |
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Validate tagged pack | |
| run: | | |
| expected_tag="v$(python3 scripts/generate_distribution.py --print-version)" | |
| test "$GITHUB_REF_NAME" = "$expected_tag" | |
| # actions/checkout can leave the event tag name pointing at the | |
| # peeled commit. Fetch the remote annotated tag into a private ref so | |
| # signature verification always targets the tag object itself. | |
| release_ref="refs/release-tags/$GITHUB_REF_NAME" | |
| git fetch --no-tags --force origin \ | |
| "refs/tags/$GITHUB_REF_NAME:$release_ref" | |
| test "$(git rev-list -n 1 "$release_ref")" = "$GITHUB_SHA" | |
| git config gpg.format ssh | |
| git config gpg.ssh.allowedSignersFile \ | |
| "$GITHUB_WORKSPACE/.github/trusted-release-signers" | |
| git verify-tag "$release_ref" | |
| python3 scripts/generate_distribution.py --check | |
| python3 -m unittest discover -s tests -p 'test_*.py' | |
| - name: Rebuild and compare AutoClaw archives | |
| run: | | |
| output="$(mktemp -d)" | |
| python3 scripts/generate_distribution.py --autoclaw-dist "$output" | |
| diff -u dist/autoclaw/SHA256SUMS "$output/SHA256SUMS" | |
| for archive in dist/autoclaw/*.zip; do | |
| name="$(basename "$archive")" | |
| cmp "$archive" "$output/$name" | |
| done | |
| publish: | |
| needs: validate | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Check out validated tagged source | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| with: | |
| persist-credentials: false | |
| - name: Re-verify immutable release tag | |
| run: | | |
| release_ref="refs/release-tags/$GITHUB_REF_NAME" | |
| git fetch --no-tags --force origin \ | |
| "refs/tags/$GITHUB_REF_NAME:$release_ref" | |
| test "$(git rev-list -n 1 "$release_ref")" = "$GITHUB_SHA" | |
| git config gpg.format ssh | |
| git config gpg.ssh.allowedSignersFile \ | |
| "$GITHUB_WORKSPACE/.github/trusted-release-signers" | |
| git verify-tag "$release_ref" | |
| - name: Publish immutable release assets | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| gh release create "$GITHUB_REF_NAME" \ | |
| dist/autoclaw/*.zip \ | |
| dist/autoclaw/SHA256SUMS \ | |
| assets/v-model-overview.svg \ | |
| assets/v-model-overview.png \ | |
| --repo "$GITHUB_REPOSITORY" \ | |
| --title "Terraphim Skills Introduction $GITHUB_REF_NAME" \ | |
| --generate-notes \ | |
| --verify-tag |