github/libhalo
1
1
Fork 0
mirror of https://github.com/arx-research/libhalo.git synced 2026-01-09 13:18:04 -05:00
Code Issues Packages Projects Releases Wiki Activity

CI: Periodically check integrity with npmjs (#105)

Browse Source
This commit is contained in:
Michał Leszczyński
2023-03-07 16:11:35 +01:00
committed by GitHub
parent 5ff52e955e
commit 80fbf62477
1 changed files with 41 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
.github/workflows/prod_integrity_check.yml vendored Normal file
View File

@@ -0,0 +1,41 @@
name: Integrity check
on:
push:
branches:
- master
schedule:
- cron: '37 21 * * *'
jobs:
integrity_npmjs:
name: Integrity check (npmjs)
runs-on: ubuntu-latest
steps:
- name: Install cosign
uses: sigstore/cosign-installer@c3667d99424e7e6047999fb6246c0da843953c65
- name: Get latest version from npm
id: get-latest-npm
run: |
curl -s -o "$RUNNER_TEMP/package-npm.json" https://registry.npmjs.org/@arx-research/libhalo/latest
NPM_LATEST_VER=$(cat "$RUNNER_TEMP/package-npm.json" | jq --raw-output '.version' | tr -d '\n')
NPM_HASH=$(cat "$RUNNER_TEMP/package-npm.json" | jq --raw-output '.dist.integrity' | tr -d '\n')
echo "NPM_LATEST_VER=$NPM_LATEST_VER" >> $GITHUB_ENV
echo "NPM_HASH=$NPM_HASH" >> $GITHUB_ENV
- name: Check cosign signature
run: |
curl -s -L -o "$RUNNER_TEMP/libhalo-npm-hash.txt" "https://github.com/arx-research/libhalo/releases/download/libhalo-v${NPM_LATEST_VER}/libhalo-npm-hash.txt"
curl -s -L -o "$RUNNER_TEMP/libhalo-npm-hash.txt-keyless.pem" "https://github.com/arx-research/libhalo/releases/download/libhalo-v${NPM_LATEST_VER}/libhalo-npm-hash.txt-keyless.pem"
curl -s -L -o "$RUNNER_TEMP/libhalo-npm-hash.txt-keyless.sig" "https://github.com/arx-research/libhalo/releases/download/libhalo-v${NPM_LATEST_VER}/libhalo-npm-hash.txt-keyless.sig"
cosign verify-blob \
--cert "$RUNNER_TEMP/libhalo-npm-hash.txt-keyless.pem" \
--signature "$RUNNER_TEMP/libhalo-npm-hash.txt-keyless.sig" \
--certificate-identity "https://github.com/arx-research/libhalo/.github/workflows/prod_build_lib.yml@refs/tags/libhalo-v${NPM_LATEST_VER}" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
"$RUNNER_TEMP/libhalo-npm-hash.txt"
- name: Verify integrity hash on npmjs
run: |
OUR_HASH=$(cat "$RUNNER_TEMP/libhalo-npm-hash.txt" | tr -d '\n')
echo "Our hash: $OUR_HASH"
echo "NPM hash: $NPM_HASH"
[[ "$NPM_HASH" == "$OUR_HASH" ]]