|
79 | 79 | FETCH_ARGS=(--no-tags --prune --depth 1 origin "${TRIGGER_REF}") |
80 | 80 | if [ -n "${GITHUB_TOKEN}" ]; then |
81 | 81 | AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')" |
82 | | - git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch "${FETCH_ARGS[@]}" |
| 82 | + export GIT_CONFIG_COUNT=1 |
| 83 | + export GIT_CONFIG_KEY_0="http.${SERVER_URL}/.extraheader" |
| 84 | + export GIT_CONFIG_VALUE_0="AUTHORIZATION: basic ${AUTH_B64}" |
| 85 | + git fetch "${FETCH_ARGS[@]}" |
83 | 86 | else |
84 | 87 | git fetch "${FETCH_ARGS[@]}" |
85 | 88 | fi |
@@ -107,47 +110,97 @@ jobs: |
107 | 110 | permissions: |
108 | 111 | contents: write |
109 | 112 | steps: |
110 | | - # First step can't call the local ./.github/actions/fleet/checkout |
111 | | - # composite (nothing checked out yet); bootstrap the workspace with the |
112 | | - # same inline git-fetch shape publish-npm.yml uses, so the fleet |
113 | | - # checkout action below can re-check-out at its own depth. |
114 | | - - name: Bootstrap checkout |
| 113 | + # Retain the current default branch's fleet actions before checking out |
| 114 | + # historical release content. The archive digest protects the retained |
| 115 | + # definitions until they are restored after checkout. |
| 116 | + - name: Bootstrap fleet Actions |
115 | 117 | shell: bash |
116 | 118 | env: |
117 | 119 | # Route context through env (no ${{ }} in the shell body — |
118 | 120 | # zizmor expression-injection). Token authorizes the fetch inline and |
119 | 121 | # is never persisted to .git/config. |
| 122 | + DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} |
120 | 123 | GITHUB_TOKEN: ${{ github.token }} |
121 | | - INPUT_TAG: ${{ inputs.tag }} |
122 | 124 | REPOSITORY: ${{ github.repository }} |
123 | 125 | SERVER_URL: ${{ github.server_url }} |
124 | | - TRIGGER_REF: ${{ github.ref }} |
125 | 126 | run: | |
126 | 127 | set -euo pipefail |
| 128 | + if [ -z "${DEFAULT_BRANCH}" ]; then |
| 129 | + echo '::error::Cannot retain fleet actions: repository default branch is empty.' >&2 |
| 130 | + exit 1 |
| 131 | + fi |
127 | 132 | git init -q |
128 | 133 | git config --local advice.detachedHead false |
129 | 134 | git remote remove origin 2>/dev/null || true |
130 | 135 | git remote add origin "${SERVER_URL}/${REPOSITORY}" |
131 | | - # A dispatched tag input wins; otherwise the ref that triggered the run. |
132 | | - FETCH_REF="${TRIGGER_REF}" |
| 136 | + FETCH_ARGS=(--no-tags --prune --depth 1 origin "refs/heads/${DEFAULT_BRANCH}") |
| 137 | + if [ -n "${GITHUB_TOKEN}" ]; then |
| 138 | + AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')" |
| 139 | + export GIT_CONFIG_COUNT=1 |
| 140 | + export GIT_CONFIG_KEY_0="http.${SERVER_URL}/.extraheader" |
| 141 | + export GIT_CONFIG_VALUE_0="AUTHORIZATION: basic ${AUTH_B64}" |
| 142 | + git fetch "${FETCH_ARGS[@]}" |
| 143 | + else |
| 144 | + git fetch "${FETCH_ARGS[@]}" |
| 145 | + fi |
| 146 | + ACTIONS_SHA="$(git rev-parse 'FETCH_HEAD^{commit}')" |
| 147 | + git checkout -q --detach "${ACTIONS_SHA}" |
| 148 | + ACTUAL_SHA="$(git rev-parse 'HEAD^{commit}')" |
| 149 | + if [ "${ACTUAL_SHA}" != "${ACTIONS_SHA}" ]; then |
| 150 | + echo "::error::Fleet action source mismatch: expected ${ACTIONS_SHA}, got ${ACTUAL_SHA}." >&2 |
| 151 | + exit 1 |
| 152 | + fi |
| 153 | + tar -czf "${RUNNER_TEMP}/fleet-actions.tar.gz" .github/actions/fleet |
| 154 | + ( |
| 155 | + cd "${RUNNER_TEMP}" |
| 156 | + sha256sum fleet-actions.tar.gz > fleet-actions.tar.gz.sha256 |
| 157 | + ) |
| 158 | + printf '%s\n' "${ACTIONS_SHA}" > "${RUNNER_TEMP}/fleet-actions.sha" |
| 159 | + - name: Checkout release content |
| 160 | + shell: bash |
| 161 | + env: |
| 162 | + GITHUB_TOKEN: ${{ github.token }} |
| 163 | + INPUT_TAG: ${{ inputs.tag }} |
| 164 | + REPOSITORY: ${{ github.repository }} |
| 165 | + SERVER_URL: ${{ github.server_url }} |
| 166 | + TRIGGER_SHA: ${{ github.sha }} |
| 167 | + run: | |
| 168 | + set -euo pipefail |
| 169 | + FETCH_REF="${TRIGGER_SHA}" |
133 | 170 | if [ -n "${INPUT_TAG}" ]; then |
134 | 171 | FETCH_REF="refs/tags/${INPUT_TAG}" |
135 | 172 | fi |
136 | 173 | FETCH_ARGS=(--no-tags --prune --depth 1 origin "${FETCH_REF}") |
137 | 174 | if [ -n "${GITHUB_TOKEN}" ]; then |
138 | 175 | AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')" |
139 | | - git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch "${FETCH_ARGS[@]}" |
| 176 | + export GIT_CONFIG_COUNT=1 |
| 177 | + export GIT_CONFIG_KEY_0="http.${SERVER_URL}/.extraheader" |
| 178 | + export GIT_CONFIG_VALUE_0="AUTHORIZATION: basic ${AUTH_B64}" |
| 179 | + git fetch "${FETCH_ARGS[@]}" |
140 | 180 | else |
141 | 181 | git fetch "${FETCH_ARGS[@]}" |
142 | 182 | fi |
143 | | - git checkout -q --detach FETCH_HEAD |
144 | | - - name: Checkout |
| 183 | + RELEASE_SHA="$(git rev-parse 'FETCH_HEAD^{commit}')" |
| 184 | + git checkout -q --detach "${RELEASE_SHA}" |
| 185 | + ACTUAL_SHA="$(git rev-parse 'HEAD^{commit}')" |
| 186 | + if [ "${ACTUAL_SHA}" != "${RELEASE_SHA}" ]; then |
| 187 | + echo "::error::Release source mismatch: expected ${RELEASE_SHA}, got ${ACTUAL_SHA}." >&2 |
| 188 | + exit 1 |
| 189 | + fi |
| 190 | + - name: Restore fleet Actions |
| 191 | + shell: bash |
| 192 | + run: | |
| 193 | + set -euo pipefail |
| 194 | + ( |
| 195 | + cd "${RUNNER_TEMP}" |
| 196 | + sha256sum -c fleet-actions.tar.gz.sha256 |
| 197 | + ) |
| 198 | + tar -xzf "${RUNNER_TEMP}/fleet-actions.tar.gz" -C "${GITHUB_WORKSPACE}" |
| 199 | + echo "Restored fleet actions from $(cat "${RUNNER_TEMP}/fleet-actions.sha")." |
| 200 | + - name: Hydrate release content |
145 | 201 | uses: ./.github/actions/fleet/checkout |
146 | 202 | with: |
147 | | - ref: ${{ inputs.tag != '' && format('refs/tags/{0}', inputs.tag) || github.sha }} |
148 | | - # Reuse the PR App for a contents:read token scoped to wheelhouse. |
149 | | - # Both credentials enable the private release fallback. Without the |
150 | | - # key, hydration still pulls public GHCR anonymously. |
| 203 | + checkout: 'false' |
151 | 204 | payload-token-client-id: ${{ secrets.SOCKET_PR_CLIENT_ID }} |
152 | 205 | payload-token-private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }} |
153 | 206 | # The resolved tag is the single input every later step trusts — it |
|
0 commit comments