源码快照 @ 2026-09-01 (source-only, 剔除非源码素材)

.github/workflows/release-cli-finalize.yml

@@ -0,0 +1,326 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Finalize product release
+
+on:
+  workflow_dispatch:
+    inputs:
+      stage_run_id:
+        description: Successful Stage CLI npm release workflow run ID
+        required: true
+        type: string
+      stage_run_attempt:
+        description: Successful Stage CLI npm release workflow run attempt
+        required: true
+        type: string
+      release_run_id:
+        description: Successful Release workflow run ID that built the Draft assets
+        required: true
+        type: string
+      release_run_attempt:
+        description: Successful Release workflow run attempt that built the Draft assets
+        required: true
+        type: string
+      version:
+        description: Exact staged maka-agent product version
+        required: true
+        type: string
+
+permissions:
+  actions: read
+  contents: read
+
+concurrency:
+  group: product-release
+  cancel-in-progress: false
+
+jobs:
+  inspect:
+    name: Verify the public npm channel
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    outputs:
+      product_tag: ${{ steps.release.outputs.product_tag }}
+      product_version: ${{ steps.release.outputs.version }}
+      release_run_id: ${{ steps.release-run.outputs.run_id }}
+      release_run_attempt: ${{ steps.release-run.outputs.run_attempt }}
+      source_commit: ${{ steps.release.outputs.source_commit }}
+      source_reference_tag: ${{ steps.authority.outputs.source_reference_tag }}
+    steps:
+      - name: Require main
+        env:
+          RELEASE_REF: ${{ github.ref }}
+        run: |
+          if [[ "$RELEASE_REF" != "refs/heads/main" ]]; then
+            echo "Product finalization must be dispatched from main; found $RELEASE_REF" >&2
+            exit 1
+          fi
+
+      - name: Load the exact stage workflow run
+        env:
+          GH_TOKEN: ${{ github.token }}
+          STAGE_RUN_ID: ${{ inputs.stage_run_id }}
+          STAGE_RUN_ATTEMPT: ${{ inputs.stage_run_attempt }}
+        run: |
+          if [[ ! "$STAGE_RUN_ID" =~ ^[1-9][0-9]*$ ]]; then
+            echo "Stage workflow run ID must be a positive integer" >&2
+            exit 1
+          fi
+          if [[ ! "$STAGE_RUN_ATTEMPT" =~ ^[1-9][0-9]*$ ]]; then
+            echo "Stage workflow run attempt must be a positive integer" >&2
+            exit 1
+          fi
+          gh api "repos/$GITHUB_REPOSITORY/actions/runs/$STAGE_RUN_ID/attempts/$STAGE_RUN_ATTEMPT" > "$RUNNER_TEMP/stage-run.json"
+
+      - name: Load the exact Release workflow run
+        id: release-run
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_RUN_ID: ${{ inputs.release_run_id }}
+          RELEASE_RUN_ATTEMPT: ${{ inputs.release_run_attempt }}
+        run: |
+          if [[ ! "$RELEASE_RUN_ID" =~ ^[1-9][0-9]*$ ]]; then
+            echo "Release workflow run ID must be a positive integer" >&2
+            exit 1
+          fi
+          if [[ ! "$RELEASE_RUN_ATTEMPT" =~ ^[1-9][0-9]*$ ]]; then
+            echo "Release workflow run attempt must be a positive integer" >&2
+            exit 1
+          fi
+          gh api "repos/$GITHUB_REPOSITORY/actions/runs/$RELEASE_RUN_ID/attempts/$RELEASE_RUN_ATTEMPT" > "$RUNNER_TEMP/release-run.json"
+          echo "run_id=$RELEASE_RUN_ID" >> "$GITHUB_OUTPUT"
+          echo "run_attempt=$RELEASE_RUN_ATTEMPT" >> "$GITHUB_OUTPUT"
+
+      - name: Check out the current release verifier
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '24'
+          package-manager-cache: false
+
+      - name: Select the release npm toolchain
+        run: npm install --global --no-audit --no-fund "$(node -p 'require("./package.json").packageManager')"
+
+      - name: Download the exact staged candidate
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: cli-staged-release-${{ inputs.stage_run_attempt }}
+          path: packages/cli/release
+          github-token: ${{ github.token }}
+          repository: ${{ github.repository }}
+          run-id: ${{ inputs.stage_run_id }}
+
+      - name: Download the publication record
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: product-release-record-${{ inputs.release_run_attempt }}
+          path: ${{ runner.temp }}/product-release-record
+          github-token: ${{ github.token }}
+          repository: ${{ github.repository }}
+          run-id: ${{ inputs.release_run_id }}
+
+      - name: Verify the stage run and release record
+        id: release
+        env:
+          EXPECTED_VERSION: ${{ inputs.version }}
+        run: |
+          node scripts/release-cli-publication.mjs validate-stage-run \
+            packages/cli/release \
+            "$RUNNER_TEMP/stage-run.json" \
+            "$EXPECTED_VERSION" \
+            "$GITHUB_OUTPUT"
+
+      - name: Revalidate the product release authority
+        id: authority
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PRODUCT_SOURCE_COMMIT: ${{ steps.release.outputs.source_commit }}
+          PRODUCT_TAG: ${{ steps.release.outputs.product_tag }}
+          RELEASE_RUN_ATTEMPT: ${{ steps.release-run.outputs.run_attempt }}
+          RELEASE_RUN_ID: ${{ steps.release-run.outputs.run_id }}
+        run: |
+          node scripts/product-release-authority.mjs verify-build-run \
+            "$RUNNER_TEMP/release-run.json" \
+            "$PRODUCT_TAG" \
+            "$PRODUCT_SOURCE_COMMIT" \
+            "$GITHUB_REPOSITORY" \
+            "$RELEASE_RUN_ID" \
+            "$RELEASE_RUN_ATTEMPT"
+          source_reference_tag="$(jq -r .head_branch "$RUNNER_TEMP/release-run.json")"
+          node scripts/product-release-artifacts.mjs inspect-record \
+            "$RUNNER_TEMP/product-release-record/product-release.json" \
+            "$GITHUB_REPOSITORY" \
+            "$PRODUCT_TAG" \
+            "$PRODUCT_SOURCE_COMMIT" \
+            "$source_reference_tag" \
+            "$RELEASE_RUN_ID" \
+            "$RELEASE_RUN_ATTEMPT"
+          node scripts/product-release-authority.mjs verify-draft \
+            "$PRODUCT_TAG" "$PRODUCT_SOURCE_COMMIT" "$GITHUB_REPOSITORY"
+          echo "source_reference_tag=$source_reference_tag" >> "$GITHUB_OUTPUT"
+
+      - name: Fetch and verify the public registry bytes
+        run: |
+          node scripts/release-cli-publication.mjs fetch-registry \
+            packages/cli/release \
+            "$RUNNER_TEMP/registry-release"
+
+      - name: Verify npm signatures and provenance
+        run: |
+          node scripts/release-cli-publication.mjs prepare-audit \
+            packages/cli/release \
+            "$RUNNER_TEMP/signature-audit"
+          cd "$RUNNER_TEMP/signature-audit"
+          npm audit signatures --json --include-attestations > audit.json
+          node "$GITHUB_WORKSPACE/scripts/release-cli-publication.mjs" validate-audit \
+            "$GITHUB_WORKSPACE/packages/cli/release" \
+            "$RUNNER_TEMP/signature-audit/audit.json"
+
+      - name: Preserve the verified public npm package
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: cli-public-package-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/registry-release
+          if-no-files-found: error
+          compression-level: 0
+          retention-days: 30
+
+  publish:
+    name: Publish the attested convenience release
+    needs: inspect
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    environment:
+      name: product-release
+      url: https://github.com/apache/maka/releases/tag/${{ needs.inspect.outputs.product_tag }}
+    permissions:
+      actions: read
+      artifact-metadata: write
+      attestations: write
+      contents: write
+      id-token: write
+    steps:
+      - name: Check out the current release verifier
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '24'
+          package-manager-cache: false
+
+      - name: Download the exact verified Release run artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: release-*-${{ needs.inspect.outputs.release_run_attempt }}
+          path: ${{ runner.temp }}/product-release
+          merge-multiple: true
+          github-token: ${{ github.token }}
+          repository: ${{ github.repository }}
+          run-id: ${{ needs.inspect.outputs.release_run_id }}
+
+      - name: Download the publication record
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: product-release-record-${{ needs.inspect.outputs.release_run_attempt }}
+          path: ${{ runner.temp }}/product-release-record
+          github-token: ${{ github.token }}
+          repository: ${{ github.repository }}
+          run-id: ${{ needs.inspect.outputs.release_run_id }}
+
+      - name: Verify the exact publication input
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PRODUCT_SOURCE_COMMIT: ${{ needs.inspect.outputs.source_commit }}
+          PRODUCT_SOURCE_REFERENCE_TAG: ${{ needs.inspect.outputs.source_reference_tag }}
+          PRODUCT_TAG: ${{ needs.inspect.outputs.product_tag }}
+          RELEASE_RUN_ATTEMPT: ${{ needs.inspect.outputs.release_run_attempt }}
+          RELEASE_RUN_ID: ${{ needs.inspect.outputs.release_run_id }}
+        run: |
+          node scripts/product-release-authority.mjs verify-publication \
+            "$PRODUCT_TAG" \
+            "$PRODUCT_SOURCE_COMMIT" \
+            "$GITHUB_REPOSITORY" \
+            "$RUNNER_TEMP/product-release" \
+            "$RUNNER_TEMP/product-release-record/product-release.json" \
+            "$PRODUCT_SOURCE_REFERENCE_TAG" \
+            "$RELEASE_RUN_ID" \
+            "$RELEASE_RUN_ATTEMPT"
+
+      - name: Attest the verified convenience artifacts
+        id: attest
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.0.0
+        with:
+          subject-path: ${{ runner.temp }}/product-release/*
+
+      - name: Verify the issued provenance
+        env:
+          ATTESTATION_BUNDLE: ${{ steps.attest.outputs.bundle-path }}
+          CERTIFICATE_IDENTITY: https://github.com/${{ github.repository }}/.github/workflows/release-cli-finalize.yml@refs/heads/main
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          verified=0
+          while IFS= read -r -d '' artifact; do
+            gh attestation verify "$artifact" \
+              --bundle "$ATTESTATION_BUNDLE" \
+              --repo "$GITHUB_REPOSITORY" \
+              --cert-identity "$CERTIFICATE_IDENTITY" \
+              --cert-oidc-issuer https://token.actions.githubusercontent.com
+            verified=$((verified + 1))
+          done < <(find "$RUNNER_TEMP/product-release" -maxdepth 1 -type f -print0)
+          if (( verified == 0 )); then
+            echo "No product release artifacts were verified" >&2
+            exit 1
+          fi
+
+      - name: Name the offline verification bundle
+        env:
+          ATTESTATION_BUNDLE: ${{ steps.attest.outputs.bundle-path }}
+          PRODUCT_VERSION: ${{ needs.inspect.outputs.product_version }}
+        run: >-
+          cp -- "$ATTESTATION_BUNDLE"
+          "$RUNNER_TEMP/Maka-${PRODUCT_VERSION}-attestation.sigstore.json"
+
+      - name: Publish the verified convenience release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PRODUCT_SOURCE_COMMIT: ${{ needs.inspect.outputs.source_commit }}
+          PRODUCT_SOURCE_REFERENCE_TAG: ${{ needs.inspect.outputs.source_reference_tag }}
+          PRODUCT_TAG: ${{ needs.inspect.outputs.product_tag }}
+          PRODUCT_VERSION: ${{ needs.inspect.outputs.product_version }}
+          RELEASE_RUN_ATTEMPT: ${{ needs.inspect.outputs.release_run_attempt }}
+          RELEASE_RUN_ID: ${{ needs.inspect.outputs.release_run_id }}
+        run: |
+          node scripts/product-release-authority.mjs publish-draft \
+            "$PRODUCT_TAG" \
+            "$PRODUCT_SOURCE_COMMIT" \
+            "$GITHUB_REPOSITORY" \
+            "$RUNNER_TEMP/product-release" \
+            "$RUNNER_TEMP/product-release-record/product-release.json" \
+            "$PRODUCT_SOURCE_REFERENCE_TAG" \
+            "$RELEASE_RUN_ID" \
+            "$RELEASE_RUN_ATTEMPT" \
+            "$RUNNER_TEMP/Maka-${PRODUCT_VERSION}-attestation.sigstore.json"