-
Notifications
You must be signed in to change notification settings - Fork 188
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
ci: split out release check into
is-workflow-valid.sh
This change refactors the script logic that checks if a workflow in fact built the commit matching our release tag out into a separate script. This is mainly an improvement in clarity.
- Loading branch information
Showing
3 changed files
with
78 additions
and
49 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| #!/usr/bin/env bash | ||
| set -e | ||
|
|
||
| # This script checks 1) that the workflow commit corresponds to the commit for | ||
| # the given tag and 2) that the workflow has completed. This is a sanity check | ||
| # to ensure the artifacts we are about to publish are in fact built from the | ||
| # commit/tag we think. The script has several pre-requisites: | ||
| # - some standard Bash tools (curl, unzip) and one slightly more rare one (jq) | ||
| # - an already-created tag in the repository (this marks the code to release) | ||
| # - the ID of a workflow run that has run successfully--this is where we | ||
| # retrieve the artifacts from | ||
| # - a GitHub access token, see https://github.com/settings/tokens | ||
| # | ||
| # Usage: is-workflow-valid.sh <release tag> <workflow run ID> <token> | ||
|
|
||
| TAG=$1 | ||
| WORKFLOW_RUN_ID=$2 | ||
| GITHUB_TOKEN=$3 | ||
| GITHUB_API_VERSION=2022-11-28 | ||
| GITHUB_API_URL=https://api.github.com/repos/WebAssembly/wasi-sdk | ||
|
|
||
| if [ -z "${TAG}" ] || [ -z "${WORKFLOW_RUN_ID}" ] || [ -z "${GITHUB_TOKEN}" ]; then | ||
| >&2 echo "Missing parameter; exiting..." | ||
| >&2 echo "Usage: is-workflow-valid.sh <release tag> <workflow run ID> <token>" | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Get the commit SHA for the passed tag. | ||
| # See https://docs.github.com/en/rest/commits/commits#get-a-commit | ||
| MATCHING_COMMIT=$(curl \ | ||
| -H "Accept: application/vnd.github+json" \ | ||
| -H "Authorization: Bearer ${GITHUB_TOKEN}" \ | ||
| -H "X-GitHub-Api-Version: ${GITHUB_API_VERSION}" \ | ||
| "${GITHUB_API_URL}/commits/${TAG}") | ||
| COMMIT=$(echo $MATCHING_COMMIT | jq -r '.sha') | ||
| >&2 echo "===== Found commit for tag ${TAG}: ${COMMIT} =====" | ||
|
|
||
| # Check that the commit of the workflow run matches the tag commit and that the | ||
| # workflow was successful. | ||
| # See https://docs.github.com/en/rest/actions/workflow-runs#get-a-workflow-run | ||
| WORKFLOW_RUN=$(curl \ | ||
| -H "Accept: application/vnd.github+json" \ | ||
| -H "Authorization: Bearer ${GITHUB_TOKEN}" \ | ||
| -H "X-GitHub-Api-Version: ${GITHUB_API_VERSION}" \ | ||
| "${GITHUB_API_URL}/actions/runs/${WORKFLOW_RUN_ID}") | ||
| WORKFLOW_COMMIT=$(echo $WORKFLOW_RUN | jq -r '.head_sha') | ||
| WORKFLOW_STATUS=$(echo $WORKFLOW_RUN | jq -r '.status') | ||
| >&2 echo "===== Found commit for workflow ${WORKFLOW_RUN_ID}: ${WORKFLOW_COMMIT} =====" | ||
| if [ "${COMMIT}" != "${WORKFLOW_COMMIT}" ]; then | ||
| >&2 echo "Commit at tag ${TAG} did not match the commit for workflow ${WORKFLOW_RUN_ID}, exiting...:" | ||
| >&2 echo " ${COMMIT} != ${WORKFLOW_COMMIT}" | ||
| exit 1 | ||
| fi | ||
| if [ "${WORKFLOW_STATUS}" != "completed" ]; then | ||
| >&2 echo "Workflow ${WORKFLOW_RUN_ID} did not end successfully, exiting...:" | ||
| >&2 echo " status = ${WORKFLOW_STATUS}" | ||
| exit 1 | ||
| fi |