| 1 | #!/usr/bin/env bash |
| 2 | # Verify the non-forgeable GitHub context behind an orchestrated stable release. |
| 3 | # Inputs arrive through environment variables so workflow expressions never |
| 4 | # become shell source. |
| 5 | set -euo pipefail |
| 6 | |
| 7 | actual_caller="${ACTUAL_CALLER_WORKFLOW_REF:?ACTUAL_CALLER_WORKFLOW_REF is required}" |
| 8 | expected_caller="${EXPECTED_CALLER_WORKFLOW_REF:?EXPECTED_CALLER_WORKFLOW_REF is required}" |
| 9 | caller_event="${CALLER_EVENT_NAME:?CALLER_EVENT_NAME is required}" |
| 10 | caller_ref="${CALLER_REF:?CALLER_REF is required}" |
| 11 | caller_ref_protected="${CALLER_REF_PROTECTED:?CALLER_REF_PROTECTED is required}" |
| 12 | caller_workflow_sha="${CALLER_WORKFLOW_SHA:?CALLER_WORKFLOW_SHA is required}" |
| 13 | caller_sha="${CALLER_SHA:?CALLER_SHA is required}" |
| 14 | approved_cli_tag="${APPROVED_CLI_TAG:?APPROVED_CLI_TAG is required}" |
| 15 | approved_sha="${APPROVED_SHA:?APPROVED_SHA is required}" |
| 16 | approved_channel="${APPROVED_CHANNEL:-stable}" |
| 17 | |
| 18 | if [ "$actual_caller" != "$expected_caller" ]; then |
| 19 | echo "::error::orchestrated release caller is $actual_caller, expected $expected_caller" >&2 |
| 20 | exit 1 |
| 21 | fi |
| 22 | if [ "$caller_ref_protected" != "true" ]; then |
| 23 | echo "::error::orchestrated release caller ref is not protected: $caller_ref" >&2 |
| 24 | exit 1 |
| 25 | fi |
| 26 | case "$approved_channel" in |
| 27 | stable) |
| 28 | approved_tag_pattern='^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$' |
| 29 | approved_tag_description='vMAJOR.MINOR.PATCH' |
| 30 | ;; |
| 31 | preview) |
| 32 | approved_tag_pattern='^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)-preview\.([1-9][0-9]*)$' |
| 33 | approved_tag_description='vMAJOR.MINOR.PATCH-preview.N' |
| 34 | ;; |
| 35 | *) |
| 36 | echo "::error::approved release channel must be stable or preview, got: $approved_channel" >&2 |
| 37 | exit 1 |
| 38 | ;; |
| 39 | esac |
| 40 | if [[ ! "$approved_cli_tag" =~ $approved_tag_pattern ]]; then |
| 41 | echo "::error::approved CLI tag must be $approved_tag_description, got: $approved_cli_tag" >&2 |
| 42 | exit 1 |
| 43 | fi |
| 44 | |
| 45 | case "$caller_event" in |
| 46 | push) |
| 47 | expected_ref="refs/tags/$approved_cli_tag" |
| 48 | if [ "$caller_workflow_sha" != "$approved_sha" ] || [ "$caller_sha" != "$approved_sha" ]; then |
| 49 | echo "::error::tag-push caller SHA/workflow SHA must equal approved SHA $approved_sha (caller=$caller_sha workflow=$caller_workflow_sha)" >&2 |
| 50 | exit 1 |
| 51 | fi |
| 52 | ;; |
| 53 | workflow_dispatch) |
| 54 | expected_ref="refs/heads/main-v2" |
| 55 | if [ "$caller_workflow_sha" != "$caller_sha" ]; then |
| 56 | echo "::error::recovery caller workflow SHA is $caller_workflow_sha, expected protected main-v2 SHA $caller_sha" >&2 |
| 57 | exit 1 |
| 58 | fi |
| 59 | ;; |
| 60 | *) |
| 61 | echo "::error::unsupported orchestrated release caller event: $caller_event" >&2 |
| 62 | exit 1 |
| 63 | ;; |
| 64 | esac |
| 65 | if [ "$caller_ref" != "$expected_ref" ]; then |
| 66 | echo "::error::orchestrated release caller ref is $caller_ref, expected $expected_ref" >&2 |
| 67 | exit 1 |
| 68 | fi |
| 69 | |
| 70 | echo "release authorization verified: caller=$actual_caller sha=$approved_sha" |
| 71 |