add latest gh official cli

Author: terion-name

install.sh

@@ -56,7 +56,14 @@ ensure_os() {
 ensure_bootstrap_deps() {
   export DEBIAN_FRONTEND=noninteractive
   apt-get -o DPkg::Lock::Timeout=900 update -y
-  apt-get -o DPkg::Lock::Timeout=900 install -y ca-certificates curl gh unzip python3
+  apt-get -o DPkg::Lock::Timeout=900 install -y ca-certificates curl
+  install -d -m 0755 /etc/apt/keyrings
+  curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg -o /etc/apt/keyrings/githubcli-archive-keyring.gpg
+  chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg
+  printf 'deb [arch=%s signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main\n' "$(dpkg --print-architecture)" > /etc/apt/sources.list.d/github-cli.list
+  apt-get -o DPkg::Lock::Timeout=900 update -y
+  apt-get -o DPkg::Lock::Timeout=900 install -y gh unzip python3
+  gh attestation verify --help >/dev/null || die "GitHub CLI does not support attestation verification after installing from the official apt repository"
 }
 
 ensure_git() {

scripts/ctl/update.ts

@@ -1,5 +1,19 @@
 import { createHash } from "node:crypto";
-import { chmodSync, copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readlinkSync, renameSync, rmSync, symlinkSync } from "node:fs";
+import {
+  chmodSync,
+  copyFileSync,
+  cpSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readlinkSync,
+  renameSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync
+} from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { runText } from "../lib/common";
@@ -14,6 +28,9 @@ const ANSIBLE_GALAXY_ATTEMPTS = 4;
 const INSTALLED_CLI = "/usr/local/bin/terrariumctl";
 const TRM_ALIAS = "/usr/local/bin/trm";
 const RELEASE_SIGNER_WORKFLOW = `${GITHUB_REPO}/.github/workflows/release.yml`;
+const GITHUB_CLI_APT_KEYRING = "/etc/apt/keyrings/githubcli-archive-keyring.gpg";
+const GITHUB_CLI_APT_SOURCE = "/etc/apt/sources.list.d/github-cli.list";
+const GITHUB_CLI_APT_REPO = "https://cli.github.com/packages";
 
 export type UpdateOptions = {
   ref?: string;
@@ -198,7 +215,15 @@ async function installAnsibleCollections(): Promise<void> {
 
 async function ensureUpdateDependencies(): Promise<void> {
   await runText(["apt-get", "-o", "DPkg::Lock::Timeout=900", "update", "-y"], PREFIX);
-  await runText(["apt-get", "-o", "DPkg::Lock::Timeout=900", "install", "-y", "ca-certificates", "curl", "git", "gh", "ansible", "python3", "jq", "unzip"], PREFIX);
+  await runText(["apt-get", "-o", "DPkg::Lock::Timeout=900", "install", "-y", "ca-certificates", "curl"], PREFIX);
+  await runText(["install", "-d", "-m", "0755", "/etc/apt/keyrings"], PREFIX);
+  await runText(["curl", "-fsSL", `${GITHUB_CLI_APT_REPO}/githubcli-archive-keyring.gpg`, "-o", GITHUB_CLI_APT_KEYRING], PREFIX);
+  chmodSync(GITHUB_CLI_APT_KEYRING, 0o644);
+  const arch = (await runText(["dpkg", "--print-architecture"], PREFIX)).trim();
+  writeFileSync(GITHUB_CLI_APT_SOURCE, `deb [arch=${arch} signed-by=${GITHUB_CLI_APT_KEYRING}] ${GITHUB_CLI_APT_REPO} stable main\n`);
+  await runText(["apt-get", "-o", "DPkg::Lock::Timeout=900", "update", "-y"], PREFIX);
+  await runText(["apt-get", "-o", "DPkg::Lock::Timeout=900", "install", "-y", "git", "gh", "ansible", "python3", "jq", "unzip"], PREFIX);
+  await runText(["gh", "attestation", "verify", "--help"], PREFIX);
 }
 
 function trmAliasIsManaged(): boolean {

tests/install-bootstrap.test.ts

@@ -46,7 +46,12 @@ describe("install.sh bootstrap", () => {
     const source = readFileSync(join(repoRoot, "install.sh"), "utf8");
 
     expect(source).toContain("DPkg::Lock::Timeout=900");
-    expect(source).toContain("apt-get -o DPkg::Lock::Timeout=900 install -y ca-certificates curl gh unzip python3");
+    expect(source).toContain("apt-get -o DPkg::Lock::Timeout=900 install -y ca-certificates curl");
+    expect(source).toContain("https://cli.github.com/packages/githubcli-archive-keyring.gpg");
+    expect(source).toContain("/etc/apt/sources.list.d/github-cli.list");
+    expect(source).toContain("https://cli.github.com/packages stable main");
+    expect(source).toContain("apt-get -o DPkg::Lock::Timeout=900 install -y gh unzip python3");
+    expect(source).toContain("gh attestation verify --help >/dev/null || die");
     expect(source).toContain("apt-get -o DPkg::Lock::Timeout=900 install -y git");
   });
 

tests/release-workflow.test.ts

@@ -132,7 +132,10 @@ describe("release workflow", () => {
     const installer = readFileSync(join(repoRoot, "install.sh"), "utf8");
 
     expect(installer).toContain("ensure_git()");
-    expect(installer).toContain("apt-get -o DPkg::Lock::Timeout=900 install -y ca-certificates curl gh unzip python3");
+    expect(installer).toContain("apt-get -o DPkg::Lock::Timeout=900 install -y ca-certificates curl");
+    expect(installer).toContain("https://cli.github.com/packages/githubcli-archive-keyring.gpg");
+    expect(installer).toContain("https://cli.github.com/packages stable main");
+    expect(installer).toContain("apt-get -o DPkg::Lock::Timeout=900 install -y gh unzip python3");
     expect(installer).toContain("apt-get -o DPkg::Lock::Timeout=900 install -y git");
     expect(installer).not.toContain("apt-get install -y ca-certificates curl unzip git python3");
     expect(installer).toContain('ensure_git\n    git clone --depth 1 --branch "${source_ref}"');

tests/terrarium-update.test.ts

@@ -16,7 +16,12 @@ describe("terrarium update command", () => {
     expect(ctl).toContain('option("--non-interactive"');
     expect(update).toContain("TERRARIUM_BUNDLE_DIR");
     expect(update).toContain("syncTree(BUNDLE_DIR, REPO_DIR)");
+    expect(update).toContain("GITHUB_CLI_APT_KEYRING");
+    expect(update).toContain("https://cli.github.com/packages");
+    expect(update).toContain("githubcli-archive-keyring.gpg");
+    expect(update).toContain('"dpkg", "--print-architecture"');
     expect(update).toContain('"git", "gh", "ansible", "python3", "jq", "unzip"');
+    expect(update).toContain('"gh", "attestation", "verify", "--help"');
     expect(update).toContain("SHA256SUMS");
     expect(update).toContain("verifyReleaseChecksum");
     expect(update).toContain("gh");