| 1 | #!/usr/bin/env bash |
| 2 | # Verify that a release job is building the approved commit and that the remote |
| 3 | # tag still resolves to that commit. This closes the gap between the stable |
| 4 | # preflight/approval and the later publishing jobs. |
| 5 | set -euo pipefail |
| 6 | |
| 7 | release_tag="${RELEASE_TAG:?RELEASE_TAG is required}" |
| 8 | approved_sha="${APPROVED_SHA:?APPROVED_SHA is required}" |
| 9 | release_remote="${RELEASE_REMOTE:-origin}" |
| 10 | verify_checkout="${VERIFY_RELEASE_CHECKOUT:-true}" |
| 11 | |
| 12 | case "$verify_checkout" in |
| 13 | true | false) ;; |
| 14 | *) |
| 15 | echo "::error::VERIFY_RELEASE_CHECKOUT must be true or false, got: $verify_checkout" >&2 |
| 16 | exit 1 |
| 17 | ;; |
| 18 | esac |
| 19 | |
| 20 | if [[ ! "$approved_sha" =~ ^[0-9a-f]{40}$ ]]; then |
| 21 | echo "::error::approved release SHA must be a full commit SHA, got: $approved_sha" >&2 |
| 22 | exit 1 |
| 23 | fi |
| 24 | if ! git check-ref-format "refs/tags/$release_tag" >/dev/null; then |
| 25 | echo "::error::invalid release tag: $release_tag" >&2 |
| 26 | exit 1 |
| 27 | fi |
| 28 | |
| 29 | if [ "$verify_checkout" = "true" ]; then |
| 30 | head_sha="$(git rev-parse HEAD^{commit})" |
| 31 | if [ "$head_sha" != "$approved_sha" ]; then |
| 32 | echo "::error::release checkout is $head_sha, expected approved SHA $approved_sha" >&2 |
| 33 | exit 1 |
| 34 | fi |
| 35 | fi |
| 36 | |
| 37 | # Prefer the peeled commit for annotated tags; lightweight tags only return the |
| 38 | # first line. Both forms are valid release refs. |
| 39 | tag_sha="$( |
| 40 | git ls-remote --tags "$release_remote" "refs/tags/$release_tag" "refs/tags/$release_tag^{}" | |
| 41 | awk '/\^\{\}$/ { print $1; found = 1; exit } NR == 1 { first = $1 } END { if (!found) print first }' |
| 42 | )" |
| 43 | if [ -z "$tag_sha" ]; then |
| 44 | echo "::error::approved release tag is missing: $release_tag" >&2 |
| 45 | exit 1 |
| 46 | fi |
| 47 | if [ "$tag_sha" != "$approved_sha" ]; then |
| 48 | echo "::error::$release_tag moved to $tag_sha after approval; expected $approved_sha" >&2 |
| 49 | exit 1 |
| 50 | fi |
| 51 | |
| 52 | echo "release tag verified: tag=$release_tag sha=$approved_sha" |
| 53 |