Skip to content

ci: fail the release when an asset is attached unsigned #406

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bernardladenthin merged 1 commit into from
Sep 1, 2026
+68 −0
Merged

ci: fail the release when an asset is attached unsigned #406

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
68 changes: 68 additions & 0 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3574,6 +3574,34 @@ jobs:
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
run: bash .github/sign-fatjars.sh snapshot-assets
- name: Report unsigned assets (does not block the upload)
# Deliberately NON-blocking, and deliberately BEFORE the upload. Both attach jobs run even
# when their publish job failed, because a Central publish-poll timeout must not cost the
# GitHub assets: if Central is unreachable these are the ONLY way to get the artifacts at
# all. Refusing to attach on a signing failure would defeat exactly that. So annotate here,
# upload regardless, and fail the job afterwards. Assets always land; an unsigned release is
# still loudly red rather than quietly wrong.
# See workspace/policies/fat-jar-release-assets.md, "Attach first, then go red".
id: signatures
run: |
set -uo pipefail
dir="snapshot-assets"
jars=$(find "$dir" -maxdepth 1 -name '*.jar' | sort)
if [ -z "$jars" ]; then
echo "::error::no jars in $dir -- the collection step produced nothing"
echo "missing=-1" >> "$GITHUB_OUTPUT"
exit 0
fi
missing=0
for jar in $jars; do
if [ ! -e "$jar.asc" ]; then
echo "::error::unsigned: $(basename "$jar") has no detached .asc"
missing=$((missing + 1))
fi
done
echo "missing=$missing" >> "$GITHUB_OUTPUT"
[ "$missing" -eq 0 ] && echo "all $(echo "$jars" | wc -l) jar(s) signed"
exit 0
- name: Update snapshot pre-release
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Expand All @@ -3587,6 +3615,12 @@ jobs:
gh release upload snapshot snapshot-assets/* \
--repo ${{ github.repository }} \
--clobber
- name: Fail if anything was attached unsigned
# After the upload on purpose: the assets must exist even when the signature does not.
if: ${{ always() && steps.signatures.outputs.missing != '0' }}
run: |
echo "::error::${{ steps.signatures.outputs.missing }} asset(s) attached without a signature (-1 means none were collected at all)"
exit 1

publish-release:
name: Publish Release to Central
Expand Down Expand Up @@ -3807,7 +3841,41 @@ jobs:
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
run: bash .github/sign-fatjars.sh release-assets
- name: Report unsigned assets (does not block the upload)
# Deliberately NON-blocking, and deliberately BEFORE the upload. Both attach jobs run even
# when their publish job failed, because a Central publish-poll timeout must not cost the
# GitHub assets: if Central is unreachable these are the ONLY way to get the artifacts at
# all. Refusing to attach on a signing failure would defeat exactly that. So annotate here,
# upload regardless, and fail the job afterwards. Assets always land; an unsigned release is
# still loudly red rather than quietly wrong.
# See workspace/policies/fat-jar-release-assets.md, "Attach first, then go red".
id: signatures
run: |
set -uo pipefail
dir="release-assets"
jars=$(find "$dir" -maxdepth 1 -name '*.jar' | sort)
if [ -z "$jars" ]; then
echo "::error::no jars in $dir -- the collection step produced nothing"
echo "missing=-1" >> "$GITHUB_OUTPUT"
exit 0
fi
missing=0
for jar in $jars; do
if [ ! -e "$jar.asc" ]; then
echo "::error::unsigned: $(basename "$jar") has no detached .asc"
missing=$((missing + 1))
fi
done
echo "missing=$missing" >> "$GITHUB_OUTPUT"
[ "$missing" -eq 0 ] && echo "all $(echo "$jars" | wc -l) jar(s) signed"
exit 0
- name: Upload release assets
uses: softprops/action-gh-release@v3
with:
files: release-assets/*
- name: Fail if anything was attached unsigned
# After the upload on purpose: the assets must exist even when the signature does not.
if: ${{ always() && steps.signatures.outputs.missing != '0' }}
run: |
echo "::error::${{ steps.signatures.outputs.missing }} asset(s) attached without a signature (-1 means none were collected at all)"
exit 1
Loading