ci: confirm dist archive is reproducible [beta] #4453
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [beta] | |
| pull_request: | |
| branches: [beta] | |
| release: | |
| types: [published] | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint: | |
| name: Lint & Format | |
| if: github.event_name != 'release' || github.event.release.target_commitish == 'beta' | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Check set:html safety | |
| run: | | |
| if grep -r "set:html" src --include="*.astro" | grep -Ev "set:html=\{(safeMarkdown\.|DOMPurify\.sanitize)"; then | |
| echo "Error: Found set:html usage without safeMarkdown or DOMPurify.sanitize" | |
| exit 1 | |
| fi | |
| echo "All set:html usages are safe" | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v5 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "22" | |
| cache: "pnpm" | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: ESLint - TypeScript validity | |
| run: pnpm lint | |
| - name: Stylelint - CSS compatibility | |
| run: pnpm lint:css | |
| - name: Prettier - Code formatting | |
| run: pnpm format:check | |
| - name: Type check | |
| run: pnpm check | |
| reproducible-archive: | |
| name: Reproducible Archive (Run ${{ matrix.run }}) | |
| if: github.event_name != 'release' || github.event.release.target_commitish == 'beta' | |
| runs-on: ubuntu-22.04 | |
| strategy: | |
| matrix: | |
| run: [1, 2] | |
| outputs: | |
| hash-1: ${{ steps.hash.outputs.hash-1 }} | |
| hash-2: ${{ steps.hash.outputs.hash-2 }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v5 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "22" | |
| cache: "pnpm" | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Prepare source for CI/Release build | |
| env: | |
| BASE_BRANCH: ${{ github.event_name != 'release' && github.event.pull_request.base.ref || '' }} # PR target branch | |
| BASE_REF: ${{ github.event_name == 'push' && github.event.before || '' }} # previous commit before the push event | |
| LIMIT_POSTS: ${{ github.event_name != 'release' && '10' || '' }} | |
| SKIP_IMAGE_OPTIMIZATION: ${{ github.event_name != 'release' && 'true' || '' }} | |
| SKIP_OG: ${{ github.event_name != 'release' && 'true' || '' }} | |
| LIMIT_LOCALES: ${{ github.event_name != 'release' && 'true' || '' }} | |
| run: pnpm prepare-build && pnpm build | |
| - name: Create archive | |
| run: | | |
| tar \ | |
| --sort=name \ | |
| --mtime='@0' \ | |
| --owner=0 \ | |
| --group=0 \ | |
| --numeric-owner \ | |
| --mode='u=rwX,go=rX' \ | |
| -czf dist.tar.gz dist/ | |
| - name: Hash archive | |
| id: hash | |
| run: | | |
| HASH=$(sha256sum dist.tar.gz | awk '{print $1}') | |
| echo "hash-${{ matrix.run }}=$HASH" >> $GITHUB_OUTPUT | |
| - name: Upload archive | |
| if: github.event_name == 'release' && matrix.run == 1 | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: deploy-dist-archive | |
| path: dist.tar.gz | |
| compare-archives: | |
| name: Compare hashes | |
| if: github.event_name != 'release' || github.event.release.target_commitish == 'beta' | |
| runs-on: ubuntu-22.04 | |
| needs: reproducible-archive | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Compare | |
| run: | | |
| HASH1="${{ needs.reproducible-archive.outputs.hash-1 }}" | |
| HASH2="${{ needs.reproducible-archive.outputs.hash-2 }}" | |
| if [ "$HASH1" = "$HASH2" ]; then | |
| echo "hashes match." | |
| else | |
| echo "hash mismatch." | |
| exit 1 | |
| fi | |
| - name: Download release archive | |
| if: github.event_name == 'release' | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: deploy-dist-archive | |
| - name: Upload release asset | |
| if: github.event_name == 'release' | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| files: dist.tar.gz |