Skip to content

fix(ci): harden release supply chain #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
altaywtf merged 6 commits into from
May 8, 2026
Merged

fix(ci): harden release supply chain #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
aeb5539
fix(ci): harden release supply chain
altaywtf May 8, 2026
b4804de
fix(ci): avoid pnpm cache bootstrap failure
altaywtf May 8, 2026
dac2f9d
docs: use titled routing links
altaywtf May 8, 2026
1a4d9f5
chore(docs): trim unrelated link label changes
altaywtf May 8, 2026
ef19a65
fix(ci): use release environment for publish secrets
altaywtf May 8, 2026
dccc8e5
ci: use release bot for CLI publishing
altaywtf May 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
93 changes: 71 additions & 22 deletions .github/workflows/backfill-release-assets.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,30 @@ on:
type: string

jobs:
validate-release-tag:
name: Validate release tag
runs-on: ubuntu-latest
timeout-minutes: 5
permissions:
contents: read

steps:
- name: Validate tag name
env:
TAG_NAME: ${{ inputs.tag_name }}
run: |
if [[ ! "$TAG_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.-]+)?$ ]]; then
echo "Invalid release tag: $TAG_NAME" >&2
exit 1
fi

build-unix-binaries:
name: Build ${{ matrix.os }} release assets
needs:
- validate-release-tag
runs-on: ${{ matrix.os }}
timeout-minutes: 30
environment: release
permissions:
contents: write
strategy:
Expand All @@ -27,30 +47,42 @@ jobs:
asset_arch: arm64

steps:
- name: Create release bot token
id: release-bot
uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
with:
app-id: ${{ vars.PUTIO_RELEASE_BOT_APP_ID }}
private-key: ${{ secrets.PUTIO_RELEASE_BOT_PRIVATE_KEY }}
permission-contents: write
- name: Check out repository
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
fetch-depth: 0
ref: ${{ inputs.tag_name }}

- name: Check out release tag
run: git checkout ${{ inputs.tag_name }}

- name: Set up Vite+
uses: voidzero-dev/setup-vp@v1
- name: Set up Node.js
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version-file: ".node-version"
cache: true

- name: Enable Corepack
run: corepack enable

- name: Install dependencies
run: pnpm install --frozen-lockfile

- name: Build SEA binary
run: vp run build:sea
run: pnpm run build:sea

- name: Verify SEA binary
run: vp run verify:sea
run: pnpm run verify:sea

- name: Package release assets
shell: pwsh
env:
TAG_NAME: ${{ inputs.tag_name }}
run: |
$version = "${{ inputs.tag_name }}".TrimStart("v")
$version = $env:TAG_NAME.TrimStart("v")
$assetBase = "putio-cli-$version-${{ matrix.asset_os }}-${{ matrix.asset_arch }}"
$releaseDir = ".artifacts/release"
New-Item -ItemType Directory -Force -Path $releaseDir | Out-Null
Expand All @@ -70,44 +102,60 @@ jobs:
run: Get-ChildItem .artifacts/release

- name: Upload binary assets to the GitHub release
uses: softprops/action-gh-release@v3
uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
with:
token: ${{ steps.release-bot.outputs.token }}
tag_name: ${{ inputs.tag_name }}
files: |
.artifacts/release/*

build-windows-binary:
name: Build windows-latest release assets
needs:
- validate-release-tag
runs-on: windows-latest
timeout-minutes: 30
environment: release
permissions:
contents: write

steps:
- name: Create release bot token
id: release-bot
uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
with:
app-id: ${{ vars.PUTIO_RELEASE_BOT_APP_ID }}
private-key: ${{ secrets.PUTIO_RELEASE_BOT_PRIVATE_KEY }}
permission-contents: write
- name: Check out repository
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
fetch-depth: 0
ref: ${{ inputs.tag_name }}

- name: Check out release tag
run: git checkout ${{ inputs.tag_name }}

- name: Set up Vite+
uses: voidzero-dev/setup-vp@v1
- name: Set up Node.js
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
with:
node-version-file: ".node-version"
cache: true

- name: Enable Corepack
run: corepack enable

- name: Install dependencies
run: pnpm install --frozen-lockfile

- name: Build SEA binary
run: vp run build:sea
run: pnpm run build:sea

- name: Verify SEA binary
run: vp run verify:sea
run: pnpm run verify:sea

- name: Package release assets
shell: pwsh
env:
TAG_NAME: ${{ inputs.tag_name }}
run: |
$version = "${{ inputs.tag_name }}".TrimStart("v")
$version = $env:TAG_NAME.TrimStart("v")
$assetBase = "putio-cli-$version-windows-amd64"
$releaseDir = ".artifacts/release"
New-Item -ItemType Directory -Force -Path $releaseDir | Out-Null
Expand All @@ -122,8 +170,9 @@ jobs:
run: Get-ChildItem .artifacts/release

- name: Upload binary assets to the GitHub release
uses: softprops/action-gh-release@v3
uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
with:
token: ${{ steps.release-bot.outputs.token }}
tag_name: ${{ inputs.tag_name }}
files: |
.artifacts/release/*
Loading