Skip to content

ci: verify release assets by digest before publishing #23

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TheStreamCode merged 2 commits into from
Nov 1, 2026
Merged

ci: verify release assets by digest before publishing #23

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
60c7d12
ci: verify release assets by digest before publishing
Nov 1, 2026
18e2928
ci: verify packaged extension identity before publishing
Nov 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 20 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,14 @@ jobs:
id-token: write

steps:
- name: Download the released VSIX
- name: Validate release tag
env:
RELEASE_TAG: ${{ inputs.tag }}
run: |
set -euo pipefail
[[ "$RELEASE_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]

- name: Download and verify the released VSIX
env:
GH_TOKEN: ${{ github.token }}
RELEASE_TAG: ${{ inputs.tag }}
Expand All @@ -90,9 +97,19 @@ jobs:
gh release download "$RELEASE_TAG" \
--repo "$GITHUB_REPOSITORY" \
--pattern "$VSIX" \
--pattern "$VSIX.sha256" \
--dir .release
(cd .release && sha256sum -c "$VSIX.sha256")
gh release view "$RELEASE_TAG" \
--repo "$GITHUB_REPOSITORY" \
--json assets > release-assets.json
expected="$(jq -r --arg name "$VSIX" '.assets[] | select(.name == $name) | .digest' release-assets.json)"
test -n "$expected"
test "$expected" != "null"
actual="sha256:$(sha256sum ".release/$VSIX" | awk '{print $1}')"
test "$actual" = "$expected"
unzip -p ".release/$VSIX" extension/package.json > vsix-package.json
test "$(jq -r '.publisher' vsix-package.json)" = "mikesoft"
test "$(jq -r '.name' vsix-package.json)" = "vscode-kimi-code-cli-launcher"
test "$(jq -r '.version' vsix-package.json)" = "${RELEASE_TAG#v}"

- name: Publish to Visual Studio Marketplace
env:
Expand Down
6 changes: 3 additions & 3 deletions CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,6 @@ the GitHub release exists, dispatch the `Release` workflow with that release tag
gh workflow run release.yml -f tag=v<x.y.z>
```

The publish job downloads the released VSIX, verifies its checksum, and publishes it to both registries
with short-lived OIDC credentials. No registry publisher token is stored in the repository, local
automation, or GitHub Actions secrets.
The publish job downloads the released VSIX, verifies its SHA-256 against the digest recorded on the
GitHub release asset, and publishes it to both registries with short-lived OIDC credentials. No
registry publisher token is stored in the repository, local automation, or GitHub Actions secrets.
Loading