vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-07-21 05:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: accept trusted unsigned release merge heads (#104838)

Browse Source
This commit is contained in:
Peter Steinberger
2026-07-11 20:42:03 -07:00
committed by GitHub
parent a79554c281
commit 5b29c37137
2 changed files with 39 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
.github/workflows/openclaw-release-telegram-qa.yml vendored
View File

@@ -320,7 +320,7 @@ jobs:
trusted_reason="release-tag"
break
fi
done < <(git -C .candidate for-each-ref --format='%(refname)' refs/tags/v)
done < <(git -C .candidate for-each-ref --format='%(refname)' 'refs/tags/v*')
fi
fi
fi
@@ -339,18 +339,27 @@ jobs:
-f name="$repository_name" \
-f oid="$candidate_sha"
)"
signer="$(
signature_status="$(
jq -er \
--arg sha "$candidate_sha" \
'.data.repository.object |
select(.oid == $sha and .signature.isValid == true and .signature.state == "VALID") |
.signature.signer.login' \
select(.oid == $sha) |
if .signature == null then "missing"
elif .signature.isValid == true and .signature.state == "VALID" and
(.signature.signer.login // "") != "" then "valid"
else "invalid"
end' \
<<<"$signature_json"
)"
if [[ "$signature_status" == "invalid" ]]; then
echo "Release candidate ${candidate_sha} has an invalid commit signature." >&2
exit 1
fi
signer="$(jq -r '.data.repository.object.signature.signer.login // ""' <<<"$signature_json")"
permission_actor="$signer"
if [[ "$signer" == "web-flow" ]]; then
if [[ "$signature_status" == "missing" || "$signer" == "web-flow" ]]; then
if [[ "$trusted_reason" != "release-branch-head" || -z "$trusted_release_branch" ]]; then
echo "GitHub web-flow candidates require an exact release branch head." >&2
echo "Unsigned or GitHub web-flow candidates require an exact release branch head." >&2
exit 1
fi
permission_actor="$(
@@ -1002,7 +1011,7 @@ jobs:
trusted_reason="release-tag"
break
fi
done < <(git for-each-ref --format='%(refname)' refs/tags/v)
done < <(git for-each-ref --format='%(refname)' 'refs/tags/v*')
fi
fi
fi
@@ -1018,18 +1027,27 @@ jobs:
-f name="$repository_name" \
-f oid="$candidate_sha"
)"
signer="$(
signature_status="$(
jq -er \
--arg sha "$candidate_sha" \
'.data.repository.object |
select(.oid == $sha and .signature.isValid == true and .signature.state == "VALID") |
.signature.signer.login' \
select(.oid == $sha) |
if .signature == null then "missing"
elif .signature.isValid == true and .signature.state == "VALID" and
(.signature.signer.login // "") != "" then "valid"
else "invalid"
end' \
<<<"$signature_json"
)"
if [[ "$signature_status" == "invalid" ]]; then
echo "Release candidate ${candidate_sha} has an invalid commit signature." >&2
exit 1
fi
signer="$(jq -r '.data.repository.object.signature.signer.login // ""' <<<"$signature_json")"
permission_actor="$signer"
if [[ "$signer" == "web-flow" ]]; then
if [[ "$signature_status" == "missing" || "$signer" == "web-flow" ]]; then
if [[ "$trusted_reason" != "release-branch-head" || -z "$trusted_release_branch" ]]; then
echo "GitHub web-flow candidates require an exact release branch head." >&2
echo "Unsigned or GitHub web-flow candidates require an exact release branch head." >&2
exit 1
fi
permission_actor="$(