Skip to content

Commit 94cda74

Browse files
furkhatFurkhat Kasymov Genii Uulu
andauthored
fix: invalid checksum after signature; manually check signature before publishing (#674)
* upgrade actions; fixes incorrect checksum by older goreleaser * publish only after verifying signature produced by goreleaser * upgrade Go to 1.25.5 * rename jobs --------- Co-authored-by: Furkhat Kasymov Genii Uulu <furkhat@cast.ai>
1 parent 37b2f13 commit 94cda74

File tree

11 files changed

+69
-47
lines changed

11 files changed

+69
-47
lines changed

.github/workflows/acceptance-tests.yml

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,34 +18,34 @@ jobs:
1818
runs-on: ubuntu-latest
1919
steps:
2020
- name: Checkout source
21-
uses: actions/checkout@v3
21+
uses: actions/checkout@v6
2222

23-
- name: Setup Go 1.24.0
24-
uses: actions/setup-go@v4
23+
- name: Setup Go
24+
uses: actions/setup-go@v6
2525
with:
26-
go-version: '1.24.0'
26+
go-version: '1.25.5'
2727

2828
- name: Cache Go modules
29-
uses: actions/cache@v3
29+
uses: actions/cache@v5
3030
with:
3131
path: ~/go/pkg/mod
3232
key: ${{ runner.os }}-build-${{ hashFiles('**/go.sum') }}
3333
restore-keys: |
3434
${{ runner.os }}-build-
3535
3636
- name: Setup Terraform
37-
uses: hashicorp/setup-terraform@v2
37+
uses: hashicorp/setup-terraform@v4
3838
with:
3939
terraform_version: '1.11.*'
4040
terraform_wrapper: false
4141

4242
- name: Authenticate to GCP
43-
uses: google-github-actions/auth@v2
43+
uses: google-github-actions/auth@v3
4444
with:
4545
credentials_json: ${{ secrets.GOOGLE_TF_ACCEPTANCE_TEST_CREDENTIALS }}
4646

4747
- name: Get GKE credentials
48-
uses: google-github-actions/get-gke-credentials@v2
48+
uses: google-github-actions/get-gke-credentials@v3
4949
with:
5050
cluster_name: tf-core-acc-20230723
5151
location: us-central1-c

.github/workflows/doc.yaml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@ jobs:
99
name: Check if SDK is up to date
1010
runs-on: ubuntu-latest
1111
steps:
12-
- uses: actions/setup-go@v4
12+
- uses: actions/setup-go@v6
1313
with:
14-
go-version: 1.23.6
15-
- uses: actions/checkout@v4 # Updated to use Node.js 20
14+
go-version: 1.25.5
15+
- uses: actions/checkout@v6
1616
- name: Check SDK
1717
run: |
1818
make generate-sdk
@@ -25,10 +25,10 @@ jobs:
2525
name: Check if documentation is up to date
2626
runs-on: ubuntu-latest
2727
steps:
28-
- uses: actions/setup-go@v4
28+
- uses: actions/setup-go@v6
2929
with:
30-
go-version: 1.23.6
31-
- uses: actions/checkout@v4 # Updated to use Node.js 20
30+
go-version: 1.25.5
31+
- uses: actions/checkout@v6
3232
- name: Check Documentation
3333
run: |
3434
make generate-docs

.github/workflows/e2e.yaml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,20 +22,20 @@ jobs:
2222
E2E_GKE_WORKSPACE: ${{ secrets.GKE_WORKSPACE }}
2323

2424
steps:
25-
- uses: actions/checkout@v3
25+
- uses: actions/checkout@v6
2626
- name: Set up Go
27-
uses: actions/setup-go@v4
27+
uses: actions/setup-go@v6
2828
with:
29-
go-version: 1.23.6
29+
go-version: 1.25.5
3030

3131
- name: Cache Go modules
32-
uses: actions/cache@v3
32+
uses: actions/cache@v5
3333
with:
3434
path: ~/go/pkg/mod
3535
key: ${{ runner.os }}-build-${{ hashFiles('**/go.sum') }}
3636
restore-keys: |
3737
${{ runner.os }}-build-
38-
- uses: hashicorp/setup-terraform@v2
38+
- uses: hashicorp/setup-terraform@v4
3939
with:
4040
cli_config_credentials_token: ${{ secrets.TF_CLOUD_TOKEN }}
4141
cli_config_credentials_hostname: app.terraform.io

.github/workflows/examples.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,20 +13,20 @@ jobs:
1313

1414
steps:
1515
- name: Checkout repository
16-
uses: actions/checkout@v4 # Updated to use Node.js 20
16+
uses: actions/checkout@v6
1717

1818
- name: Set up Terraform
19-
uses: hashicorp/setup-terraform@v3 # Updated to use Node.js 20
19+
uses: hashicorp/setup-terraform@v4
2020
with:
2121
terraform_version: ${{ matrix.version }}
2222

2323
- name: Print tf version
2424
run: terraform version
2525

26-
- name: Setup Go 1.24.0
27-
uses: actions/setup-go@v5
26+
- name: Setup Go
27+
uses: actions/setup-go@v6
2828
with:
29-
go-version: '1.24.0'
29+
go-version: '1.25.5'
3030
cache: true
3131

3232
- name: Build binary

.github/workflows/fossa.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ jobs:
99
fossa-scan:
1010
runs-on: ubuntu-latest
1111
steps:
12-
- uses: actions/checkout@v3
12+
- uses: actions/checkout@v6
1313
- uses: fossas/fossa-action@v1
1414
with:
1515
api-key: ${{ secrets.FOSSA_API_KEY }}

.github/workflows/go-test.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,15 @@ jobs:
1313
runs-on: ubuntu-latest
1414
steps:
1515
- name: Checkout source
16-
uses: actions/checkout@v3
16+
uses: actions/checkout@v6
1717

18-
- name: Setup Go 1.24.0
19-
uses: actions/setup-go@v4
18+
- name: Setup Go
19+
uses: actions/setup-go@v6
2020
with:
21-
go-version: '1.24.0'
21+
go-version: '1.25.5'
2222

2323
- name: Cache Go modules
24-
uses: actions/cache@v3
24+
uses: actions/cache@v5
2525
with:
2626
path: ~/go/pkg/mod
2727
key: ${{ runner.os }}-build-${{ hashFiles('**/go.sum') }}

.github/workflows/golangci-lint.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,11 @@ jobs:
88
name: lint
99
runs-on: ubuntu-latest
1010
steps:
11-
- uses: actions/setup-go@v4
11+
- uses: actions/setup-go@v6
1212
with:
13-
go-version: 1.23.6
14-
- uses: actions/checkout@v3
13+
go-version: 1.25.5
14+
- uses: actions/checkout@v6
1515
- name: golangci-lint
16-
uses: golangci/golangci-lint-action@v3
16+
uses: golangci/golangci-lint-action@v9
1717
with:
1818
args: --timeout=5m

.github/workflows/release.yml

Lines changed: 31 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -15,28 +15,50 @@ jobs:
1515
runs-on: ubuntu-latest
1616
steps:
1717
- name: Checkout
18-
uses: actions/checkout@v3
18+
uses: actions/checkout@v6
1919

2020
- name: Unshallow
2121
run: git fetch --prune --unshallow
2222

2323
- name: Set up Go
24-
uses: actions/setup-go@v4
24+
uses: actions/setup-go@v6
2525
with:
26-
go-version: 1.23.6
26+
go-version: 1.25.5
2727

2828
- name: Import GPG key
2929
id: import_gpg
30-
uses: paultyng/ghaction-import-gpg@v2.1.0
31-
env:
32-
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
33-
PASSPHRASE: ${{ secrets.PASSPHRASE }}
30+
uses: crazy-max/ghaction-import-gpg@v7
31+
with:
32+
gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
33+
passphrase: ${{ secrets.PASSPHRASE }}
3434

3535
- name: Run GoReleaser
36-
uses: goreleaser/goreleaser-action@v6
36+
uses: goreleaser/goreleaser-action@v7
3737
with:
3838
version: '~> v2'
39-
args: release --clean --config=.github/.goreleaser.yml
39+
args: release --clean --skip=publish --config=.github/.goreleaser.yml
4040
env:
4141
GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
4242
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
43+
44+
- name: Verify release artifacts
45+
run: |
46+
cd dist
47+
checksums=$(ls *_SHA256SUMS)
48+
signature=$(ls *_SHA256SUMS.sig)
49+
50+
# Verify GPG signature on the checksum file
51+
# Goreleaser had bug so extra verifying as a safeguard (goreleaser#6508)
52+
gpg --verify "$signature" "$checksums"
53+
54+
# Verify checksums match actual artifacts
55+
sha256sum -c "$checksums"
56+
57+
- name: Publish release
58+
uses: goreleaser/goreleaser-action@v7
59+
with:
60+
version: '~> v2'
61+
args: continue --config=.github/.goreleaser.yml
62+
workdir: .
63+
env:
64+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/stale-pr-check.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
stale-pr-check:
1313
runs-on: ubuntu-latest
1414
steps:
15-
- uses: actions/stale@v9
15+
- uses: actions/stale@v10
1616
with:
1717
stale-pr-message: 'This PR has been labeled as stale due to inactivity and will be closed in 7 days if no further activity occurs.'
1818
close-pr-message: 'This PR has been closed due to inactivity. Feel free to reopen if you are still working on it.'

.github/workflows/terraform-fmt.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@ jobs:
66
runs-on: ubuntu-latest
77
steps:
88
- name: Checkout repository
9-
uses: actions/checkout@v3
9+
uses: actions/checkout@v6
1010

1111
- name: Set up Terraform
12-
uses: hashicorp/setup-terraform@v2
12+
uses: hashicorp/setup-terraform@v4
1313

1414
- name: Terraform format
1515
run: |

0 commit comments

Comments
 (0)