trove/curios
Public Access
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): verify public release target

Browse Source
This commit is contained in:
render
2026-09-23 16:21:32 +08:00
parent 1fd77f0012
commit b5c188c185
1 changed files with 2 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/actions/curio-source/main.mjs
+2 -11
View File
@@ -579,15 +579,6 @@ async function validatePullRequest() {
console.log("Scheduled merge after required checks succeed."); console.log("Scheduled merge after required checks succeed.");
} }
} }
async function releaseCommit(client, repository, tag) {
const refs = await client.api(`/repos/${repositoryPath(repository)}/git/refs/tags/${encodeURIComponent(tag)}`);
let object = (Array.isArray(refs) ? refs.find((ref) => ref.ref === `refs/tags/${tag}`) : refs)?.object;
for (let depth = 0; object?.type === "tag" && depth < 5; depth++) {
object = (await client.api(`/repos/${repositoryPath(repository)}/git/tags/${object.sha}`)).object;
}
if (object?.type !== "commit") throw new Error("Release tag does not resolve to a commit");
return object.sha;
}
async function verifyPublishedRelease(client, repository, tag, registry) { async function verifyPublishedRelease(client, repository, tag, registry) {
const release = await client.api(`/repos/${repositoryPath(repository)}/releases/tags/${encodeURIComponent(tag)}`); const release = await client.api(`/repos/${repositoryPath(repository)}/releases/tags/${encodeURIComponent(tag)}`);
if (release.draft) throw new Error("Draft releases cannot enter the catalog"); if (release.draft) throw new Error("Draft releases cannot enter the catalog");
@@ -595,7 +586,7 @@ async function verifyPublishedRelease(client, repository, tag, registry) {
if (!descriptorAsset) throw new Error("Release has no trove-release.json attachment"); if (!descriptorAsset) throw new Error("Release has no trove-release.json attachment");
const descriptor = validateDescriptor(await client.json(descriptorAsset.browser_download_url), registry); const descriptor = validateDescriptor(await client.json(descriptorAsset.browser_download_url), registry);
if (descriptor.repository !== repository || descriptor.tag !== tag) throw new Error("Release identity differs from its descriptor"); if (descriptor.repository !== repository || descriptor.tag !== tag) throw new Error("Release identity differs from its descriptor");
if (descriptor.commit !== await releaseCommit(client, repository, tag)) throw new Error("Release tag differs from the descriptor commit"); if (descriptor.commit !== release.target_commitish) throw new Error("Release target differs from the descriptor commit");
const assets = /* @__PURE__ */ new Map(); const assets = /* @__PURE__ */ new Map();
for (const plugin of descriptor.plugins) { for (const plugin of descriptor.plugins) {
for (const artifact of plugin.artifacts) { for (const artifact of plugin.artifacts) {
@@ -616,7 +607,7 @@ async function proposeRelease() {
if (!tag) throw new Error("Release tag is required"); if (!tag) throw new Error("Release tag is required");
if (repository.split("/")[0] !== trustedOwner) throw new Error(`${repository} is not an official Curio repository`); if (repository.split("/")[0] !== trustedOwner) throw new Error(`${repository} is not an official Curio repository`);
if (!process.env.CATALOG_TOKEN) throw new Error("Catalog write token is missing"); if (!process.env.CATALOG_TOKEN) throw new Error("Catalog write token is missing");
const sourceClient = new Gitea({ token: process.env.GITHUB_TOKEN }); const sourceClient = new Gitea({ token: "" });
const catalogClient = new Gitea({ token: process.env.CATALOG_TOKEN }); const catalogClient = new Gitea({ token: process.env.CATALOG_TOKEN });
if (sourceClient.server !== catalogClient.server) throw new Error("Release and catalog must use the same Gitea server"); if (sourceClient.server !== catalogClient.server) throw new Error("Release and catalog must use the same Gitea server");
const published = await verifyPublishedRelease(sourceClient, repository, tag, catalogRepository); const published = await verifyPublishedRelease(sourceClient, repository, tag, catalogRepository);