ci: harden current repository release workflow

Author: boa-z

.github/workflows/binary-release.yml

@@ -14,6 +14,14 @@ on:
         description: 'Enable UPX compression (true/false)'
         required: false
         default: 'true'
+      release_name:
+        description: 'Optional GitHub Release title for manual runs'
+        required: false
+        default: ''
+      release_notes:
+        description: 'Optional GitHub Release notes for manual runs'
+        required: false
+        default: ''
 
 permissions:
   contents: write
@@ -82,17 +90,20 @@ jobs:
       - name: Prepare build vars
         id: vars
         shell: bash
+        env:
+          INPUT_VERSION: ${{ github.event.inputs.version || 'dev' }}
+          INPUT_ENABLE_UPX: ${{ github.event.inputs.enable_upx || 'true' }}
         run: |
           if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
             VERSION="${GITHUB_REF_NAME}"
           else
-            VERSION="${{ github.event.inputs.version || 'dev' }}"
+            VERSION="${INPUT_VERSION}"
           fi
           BUILDTIME="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
           REVISION="${GITHUB_SHA}"
 
           if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
-            ENABLE_UPX_RAW="${{ github.event.inputs.enable_upx }}"
+            ENABLE_UPX_RAW="${INPUT_ENABLE_UPX}"
           else
             ENABLE_UPX_RAW="true"
           fi
@@ -168,13 +179,30 @@ jobs:
       - name: Prepare release vars
         id: release_vars
         shell: bash
+        env:
+          INPUT_VERSION: ${{ github.event.inputs.version || 'dev' }}
+          INPUT_RELEASE_NAME: ${{ github.event.inputs.release_name || '' }}
+          INPUT_RELEASE_NOTES: ${{ github.event.inputs.release_notes || '' }}
         run: |
           if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
             RELEASE_VERSION="${GITHUB_REF_NAME}"
+            RELEASE_NAME="${GITHUB_REF_NAME}"
+            RELEASE_BODY=""
           else
-            RELEASE_VERSION="${{ github.event.inputs.version || 'dev' }}"
+            RELEASE_VERSION="${INPUT_VERSION}"
+            RELEASE_NAME="${INPUT_RELEASE_NAME}"
+            RELEASE_BODY="${INPUT_RELEASE_NOTES}"
+          fi
+          if [[ -z "${RELEASE_NAME}" ]]; then
+            RELEASE_NAME="${RELEASE_VERSION}"
           fi
           echo "release_version=${RELEASE_VERSION}" >> "${GITHUB_OUTPUT}"
+          echo "release_name=${RELEASE_NAME}" >> "${GITHUB_OUTPUT}"
+          {
+            echo "release_body<<EOF"
+            printf '%s\n' "${RELEASE_BODY}"
+            echo "EOF"
+          } >> "${GITHUB_OUTPUT}"
 
       - name: Download all artifacts
         uses: actions/download-artifact@v4
@@ -187,12 +215,14 @@ jobs:
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ steps.release_vars.outputs.release_version }}
+          name: ${{ steps.release_vars.outputs.release_name }}
+          body: ${{ steps.release_vars.outputs.release_body }}
           files: dist/*
           fail_on_unmatched_files: true
           overwrite_files: true
 
-      - name: Load source release metadata
-        id: source_release
+      - name: Load current release metadata
+        id: current_release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         shell: bash
@@ -221,7 +251,7 @@ jobs:
         if: ${{ env.TELEGRAM_BOT_TOKEN != '' && env.TELEGRAM_CHANNEL_ID != '' }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          RELEASE_BODY: ${{ steps.source_release.outputs.release_body }}
+          RELEASE_BODY: ${{ steps.current_release.outputs.release_body }}
         shell: bash
         run: |
           set -euo pipefail

scripts/ci.sh

@@ -77,6 +77,28 @@ dependency_hygiene() {
 	printf '\n==> dependency hygiene ok\n'
 }
 
+release_hygiene() {
+	local workflow
+	workflow=".github/workflows/binary-release.yml"
+	if [[ ! -f "$workflow" ]]; then
+		printf 'release workflow not found: %s\n' "$workflow" >&2
+		return 1
+	fi
+	if git grep -nE 'repository:[[:space:]]*[^[:space:]]+|GH[_]PAT|vohive[-]release|github[.]com/iniwex5' -- "$workflow"; then
+		printf 'release workflow must publish only to the current repository without cross-repo PAT wiring\n' >&2
+		return 1
+	fi
+	if ! git grep -n 'softprops/action-gh-release' -- "$workflow" >/dev/null; then
+		printf 'release workflow does not publish through softprops/action-gh-release\n' >&2
+		return 1
+	fi
+	if ! git grep -n 'files: dist/*' -- "$workflow" >/dev/null; then
+		printf 'release workflow must upload dist artifacts to the current release\n' >&2
+		return 1
+	fi
+	printf '\n==> release hygiene ok\n'
+}
+
 web_build() {
 	run npm ci --prefix web
 	run npm run build --prefix web
@@ -108,9 +130,9 @@ go_build() {
 
 usage() {
 	cat <<'USAGE'
-Usage: scripts/ci.sh [all|workflow-lint|hygiene|web|tidy|test|build ...]
+Usage: scripts/ci.sh [all|workflow-lint|hygiene|release-hygiene|web|tidy|test|build ...]
 
-Default all runs workflow-lint, hygiene, web, tidy, test, and build.
+Default all runs workflow-lint, hygiene, release-hygiene, web, tidy, test, and build.
 
 Environment:
   GO_BIN               path to go binary
@@ -126,7 +148,7 @@ USAGE
 GO_BIN="$(find_go)"
 
 if [[ $# -eq 0 || "${1:-}" == "all" ]]; then
-	tasks=(workflow-lint hygiene web tidy test build)
+	tasks=(workflow-lint hygiene release-hygiene web tidy test build)
 else
 	tasks=("$@")
 fi
@@ -138,6 +160,7 @@ for task in "${tasks[@]}"; do
 	case "$task" in
 		workflow-lint | actionlint) workflow_lint ;;
 		hygiene | dependency-hygiene) dependency_hygiene ;;
+		release-hygiene | release) release_hygiene ;;
 		web | frontend) web_build ;;
 		tidy | tidy-check) tidy_check ;;
 		test | go-test) go_tests ;;