From 82bfe7e3c9a43aeb2fff5afdb57b49152c40b73c Mon Sep 17 00:00:00 2001 From: priyagupta108 Date: Mon, 5 Oct 2026 14:54:08 +0530 Subject: [PATCH 1/2] generate and verify valid SHA256 checksum file --- .github/workflows/build-tool-packages.yml | 32 +++++++++++++++++++---- 1 file changed, 27 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build-tool-packages.yml b/.github/workflows/build-tool-packages.yml index 153f095..24cc573 100644 --- a/.github/workflows/build-tool-packages.yml +++ b/.github/workflows/build-tool-packages.yml @@ -217,16 +217,38 @@ jobs: - name: Generate hash for packages run: | - $childItems = Get-Childitem -Path '.' + $hashFile = './hashes.sha256' + if (Test-Path $hashFile) { Remove-Item $hashFile } + $childItems = Get-Childitem -Path '.' -Directory $childItems | Foreach-Object { - $packageObj = Get-Childitem -Path $_.FullName | Select-Object -First 1 + $packageObj = Get-Childitem -Path $_.FullName -File | Select-Object -First 1 + if (-not $packageObj) { return } Write-Host "Package: $($packageObj.Name)" - $actualHash = (Get-FileHash -Path $packageObj.FullName -Algorithm sha256).Hash - $hashString = "$actualHash $($packageObj.Name)" + $actualHash = (Get-FileHash -Path $packageObj.FullName -Algorithm sha256).Hash.ToLower() + $hashString = "$actualHash *$($packageObj.Name)" Write-Host "$hashString" - Add-Content -Path ./hashes.sha256 -Value "$hashString" + Add-Content -Path $hashFile -Value "$hashString" -Encoding utf8 } + - name: Verify hashes + shell: bash + run: | + set -euo pipefail + if [[ ! -s hashes.sha256 ]]; then + echo "Error: hashes.sha256 is missing or empty." + exit 1 + fi + while IFS= read -r line; do + [[ -n "$line" ]] || continue + name="${line#* \*}" + dir="$(find . -mindepth 2 -maxdepth 2 -type f -name "$name" -printf '%h\n' | head -1)" + if [[ -z "$dir" ]]; then + echo "Error: no file found for checksum entry: $name" + exit 1 + fi + ( cd "$dir" && printf '%s\n' "$line" | sha256sum --check --strict --warn - ) + done < hashes.sha256 + - name: Upload release assets uses: actions/github-script@v9 with: From d0dae0b8d89d12902b65d885cf3ebbe5e86e496d Mon Sep 17 00:00:00 2001 From: priyagupta108 Date: Tue, 13 Oct 2026 11:21:29 +0530 Subject: [PATCH 2/2] Verify uploaded release assets and fix hashes.sha256 format --- .github/workflows/build-tool-packages.yml | 72 +++++++++++++---------- 1 file changed, 42 insertions(+), 30 deletions(-) diff --git a/.github/workflows/build-tool-packages.yml b/.github/workflows/build-tool-packages.yml index 24cc573..e0fb61b 100644 --- a/.github/workflows/build-tool-packages.yml +++ b/.github/workflows/build-tool-packages.yml @@ -217,56 +217,68 @@ jobs: - name: Generate hash for packages run: | - $hashFile = './hashes.sha256' - if (Test-Path $hashFile) { Remove-Item $hashFile } $childItems = Get-Childitem -Path '.' -Directory $childItems | Foreach-Object { - $packageObj = Get-Childitem -Path $_.FullName -File | Select-Object -First 1 - if (-not $packageObj) { return } + $packageFiles = @(Get-Childitem -Path $_.FullName -File) + if ($packageFiles.Count -ne 1) { throw "Expected exactly one file in artifact folder '$($_.FullName)', found $($packageFiles.Count)." } + $packageObj = $packageFiles[0] Write-Host "Package: $($packageObj.Name)" - $actualHash = (Get-FileHash -Path $packageObj.FullName -Algorithm sha256).Hash.ToLower() + $actualHash = (Get-FileHash -Path $packageObj.FullName -Algorithm sha256).Hash $hashString = "$actualHash *$($packageObj.Name)" Write-Host "$hashString" - Add-Content -Path $hashFile -Value "$hashString" -Encoding utf8 + Add-Content -Path ./hashes.sha256 -Value "$hashString" } - - name: Verify hashes - shell: bash - run: | - set -euo pipefail - if [[ ! -s hashes.sha256 ]]; then - echo "Error: hashes.sha256 is missing or empty." - exit 1 - fi - while IFS= read -r line; do - [[ -n "$line" ]] || continue - name="${line#* \*}" - dir="$(find . -mindepth 2 -maxdepth 2 -type f -name "$name" -printf '%h\n' | head -1)" - if [[ -z "$dir" ]]; then - echo "Error: no file found for checksum entry: $name" - exit 1 - fi - ( cd "$dir" && printf '%s\n' "$line" | sha256sum --check --strict --warn - ) - done < hashes.sha256 - - name: Upload release assets uses: actions/github-script@v9 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | const fs = require('fs'); - for (let artifactDir of fs.readdirSync('.')) { - let artifactName = fs.lstatSync(artifactDir).isDirectory() ? fs.readdirSync(`${artifactDir}`)[0] : artifactDir; + const path = require('path'); + const uploads = []; + for (const entry of fs.readdirSync('.')) { + let artifactName; + let data; + if (fs.lstatSync(entry).isDirectory()) { + const files = fs.readdirSync(entry) + .filter(f => fs.lstatSync(path.join(entry, f)).isFile()); + if (files.length !== 1) { + throw new Error(`Expected exactly one file in artifact folder '${entry}', found ${files.length}.`); + } + artifactName = files[0]; + data = fs.readFileSync(path.join(entry, artifactName)); + } else { + artifactName = entry; + data = fs.readFileSync(entry); + } console.log(`Upload ${artifactName} asset`); - github.rest.repos.uploadReleaseAsset({ + uploads.push(github.rest.repos.uploadReleaseAsset({ owner: context.repo.owner, repo: context.repo.repo, release_id: ${{ steps.create_release.outputs.id }}, name: artifactName, - data: fs.lstatSync(artifactDir).isDirectory() ? fs.readFileSync(`./${artifactDir}/${artifactName}`) : fs.readFileSync(`./${artifactName}`).toString() - }); + data, + })); } + await Promise.all(uploads); + + - name: Verify uploaded release assets + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG_NAME: ${{ inputs.tool-version }}-${{ github.run_id }} + shell: bash + run: | + set -euo pipefail + tmp="$(mktemp -d)" + gh release download "$TAG_NAME" --repo "$GITHUB_REPOSITORY" --dir "$tmp" + cd "$tmp" + if [[ ! -s hashes.sha256 ]]; then + echo "Error: hashes.sha256 is missing or empty on the release." + exit 1 + fi + sha256sum --check --strict --warn hashes.sha256 trigger_pr: name: Trigger "Create Pull Request" workflow