verify-homebrew #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Verify Homebrew Tarball | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: Release tag to verify (e.g. v0.1.2) | |
| required: false | |
| default: '' | |
| repository_dispatch: | |
| types: [verify-homebrew] | |
| jobs: | |
| verify: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Determine tag and version | |
| id: tagvars | |
| shell: bash | |
| run: | | |
| if [[ -n "${{ github.event.inputs.tag }}" ]]; then | |
| tag="${{ github.event.inputs.tag }}" | |
| elif [[ -n "${{ github.event.client_payload.tag }}" ]]; then | |
| tag="${{ github.event.client_payload.tag }}" | |
| elif [[ "${GITHUB_REF}" == refs/tags/* ]]; then | |
| tag="${GITHUB_REF#refs/tags/}" | |
| else | |
| echo "::error ::No tag provided. Set workflow input 'tag'." | |
| exit 1 | |
| fi | |
| version="${tag#v}" | |
| echo "tag=$tag" >> "$GITHUB_OUTPUT" | |
| echo "version=$version" >> "$GITHUB_OUTPUT" | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '18' | |
| - name: Run tests | |
| run: npm test | |
| - name: Archive tagged sources | |
| id: archive | |
| shell: bash | |
| run: | | |
| mkdir -p dist-ci | |
| tar_path="dist-ci/codex-status-${{ steps.tagvars.outputs.version }}.tar.gz" | |
| git archive --format=tar.gz --prefix="codex-status-${{ steps.tagvars.outputs.version }}/" "${{ steps.tagvars.outputs.tag }}" > "$tar_path" | |
| local_sha=$(shasum -a 256 "$tar_path" | awk '{print $1}') | |
| echo "sha=$local_sha" >> "$GITHUB_OUTPUT" | |
| echo "tar_path=$tar_path" >> "$GITHUB_OUTPUT" | |
| - name: Fetch GitHub release tarball | |
| id: remote | |
| shell: bash | |
| run: | | |
| remote_sha=$(curl -L --fail "https://github.com/clockworknet/codex-status/archive/refs/tags/${{ steps.tagvars.outputs.tag }}.tar.gz" | shasum -a 256 | awk '{print $1}') | |
| echo "sha=$remote_sha" >> "$GITHUB_OUTPUT" | |
| - name: Compare SHAs | |
| shell: bash | |
| run: | | |
| local_sha="${{ steps.archive.outputs.sha }}" | |
| remote_sha="${{ steps.remote.outputs.sha }}" | |
| if [[ "$local_sha" != "$remote_sha" ]]; then | |
| echo "::error ::Local archive SHA $local_sha does not match GitHub tarball SHA $remote_sha" | |
| exit 1 | |
| fi | |
| - name: Validate Homebrew formula entry | |
| shell: bash | |
| run: | | |
| url="url \"https://github.com/clockworknet/codex-status/archive/refs/tags/${{ steps.tagvars.outputs.tag }}.tar.gz\"" | |
| sha="sha256 \"${{ steps.archive.outputs.sha }}\"" | |
| grep -F "$url" HomebrewFormula/codex-status.rb | |
| grep -F "$sha" HomebrewFormula/codex-status.rb | |
| - name: Upload local archive for visibility | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: codex-status-${{ steps.tagvars.outputs.version }} | |
| path: ${{ steps.archive.outputs.tar_path }} |