mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
41 lines
1.3 KiB
Bash
41 lines
1.3 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
repo_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
|
||
|
|
workflow="$repo_root/.github/workflows/signed-macos-canary.yml"
|
||
|
|
|
||
|
|
grep -Fq 'workflow_dispatch:' "$workflow"
|
||
|
|
# The literal GitHub expression is the contract we are checking.
|
||
|
|
# shellcheck disable=SC2016
|
||
|
|
grep -Fq 'SOURCE_REF: ${{ github.ref }}' "$workflow"
|
||
|
|
grep -Fq '"refs/heads/main"' "$workflow"
|
||
|
|
grep -Fq 'contents: read' "$workflow"
|
||
|
|
grep -Fq 'id-token: write' "$workflow"
|
||
|
|
grep -Fq 'block/apple-codesign-action@' "$workflow"
|
||
|
|
grep -Fq 'actions/upload-artifact@' "$workflow"
|
||
|
|
grep -Fq 'retention-days: 7' "$workflow"
|
||
|
|
grep -Fq '"createUpdaterArtifacts": false' "$workflow"
|
||
|
|
|
||
|
|
if grep -Eq 'contents: write|gh release|buzz-desktop-latest|latest\.json|TAURI_SIGNING_PRIVATE_KEY|verify-release-ref\.sh|refs/tags/' "$workflow"; then
|
||
|
|
echo "signed canary workflow gained a release or publishing capability" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
on_block=$(
|
||
|
|
awk '
|
||
|
|
/^on:$/ { in_on = 1; next }
|
||
|
|
in_on && /^[^[:space:]#]/ { exit }
|
||
|
|
in_on && NF && $0 !~ /^[[:space:]]*#/ {
|
||
|
|
gsub(/[[:space:]]/, "")
|
||
|
|
print
|
||
|
|
}
|
||
|
|
' "$workflow"
|
||
|
|
)
|
||
|
|
if [[ "$on_block" != "workflow_dispatch:" ]]; then
|
||
|
|
echo "signed canary workflow must have workflow_dispatch as its only trigger" >&2
|
||
|
|
printf 'found on block:\n%s\n' "$on_block" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
echo "signed canary contract passed"
|