fix(artifacts): emit ERR_VALIDATION warnings for degraded/missing inp… #76
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish Main Binary | |
| on: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: write | |
| jobs: | |
| publish-main: | |
| # Only publish from the canonical repository, never from forks. | |
| if: github.repository == 'github/gh-aw-threat-detection' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.26' | |
| - name: Build main binaries | |
| id: build | |
| run: | | |
| set -euo pipefail | |
| SHORT_SHA="${GITHUB_SHA:0:7}" | |
| VERSION="main-${SHORT_SHA}" | |
| mkdir -p dist | |
| while read -r goos goarch asset; do | |
| [[ -z "$goos" || "$goos" == \#* ]] && continue | |
| CGO_ENABLED=0 GOOS="$goos" GOARCH="$goarch" go build \ | |
| -ldflags="-s -w -X github.com/github/gh-aw-threat-detection/pkg/detector.Version=${VERSION}" \ | |
| -o "dist/${asset}" ./cmd/threat-detect | |
| done < release-targets.txt | |
| ( cd dist && sha256sum threat-detect-* > checksums.txt ) | |
| { | |
| echo "short_sha=${SHORT_SHA}" | |
| echo "version=${VERSION}" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Publish rolling main pre-release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| SHORT_SHA: ${{ steps.build.outputs.short_sha }} | |
| run: | | |
| set -euo pipefail | |
| # Record every release-asset SHA-256 in the release body, mirroring the | |
| # tagged release workflow so downstream verification is consistent. | |
| notes_file="$(mktemp)" | |
| mapfile -t assets < <(awk '!/^[[:space:]]*(#|$)/ { print $3 }' release-targets.txt) | |
| release_files=() | |
| { | |
| echo "Unverified branch build from ${GITHUB_SHA}." | |
| for asset in "${assets[@]}"; do | |
| asset_sha256="$(sha256sum "dist/${asset}" | awk '{print $1}')" | |
| echo "Binary asset sha256 (${asset}): sha256:${asset_sha256}" | |
| release_files+=("dist/${asset}#${asset}") | |
| done | |
| echo "The Latest release continues to track the most recently promoted version." | |
| } > "$notes_file" | |
| # Move the rolling `main` pre-release to this commit. Deleting and | |
| # recreating keeps the `main` tag pointed at the freshest build, mirroring | |
| # the moving `:main` container tag. The Latest release (the most recently | |
| # promoted version) is untouched. | |
| gh release delete main --yes --cleanup-tag 2>/dev/null || true | |
| gh release create main \ | |
| "${release_files[@]}" \ | |
| dist/checksums.txt#checksums.txt \ | |
| --title "main (edge build ${SHORT_SHA})" \ | |
| --notes-file "$notes_file" \ | |
| --target "${GITHUB_SHA}" \ | |
| --prerelease | |
| - name: Write summary | |
| env: | |
| SHORT_SHA: ${{ steps.build.outputs.short_sha }} | |
| run: | | |
| { | |
| echo "## Published main binary" | |
| echo | |
| echo "- Rolling pre-release \`main\` updated to edge build \`${SHORT_SHA}\`" | |
| echo "- Assets: Linux and macOS binaries for amd64 and arm64 (+ \`checksums.txt\`)" | |
| echo | |
| echo "These are unverified branch builds. The Latest release is unaffected and continues to track the most recently promoted release." | |
| } >> "$GITHUB_STEP_SUMMARY" |