Skip to content

Commit 99faaa8

Browse files
Quant-TheodoreFelixQuant-TheodoreFelix
committed
무결성 검사 워크플로 추가 (테스트 진행)
1 parent 407f297 commit 99faaa8

1 file changed

Lines changed: 132 additions & 0 deletions

File tree

‎.github/workflows/secure_release.yml‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
name: Secure Release & Publish Pipeline
2+
3+
on:
4+
pull_request:
5+
branches: [ "fix/build-wf" ]
6+
push:
7+
tags:
8+
- 'v*.*.*'
9+
10+
permissions:
11+
contents: write
12+
pages: write
13+
id-token: write
14+
15+
jobs:
16+
verify-and-release:
17+
name: Cryptographic Verification and Source Release
18+
runs-on: ubuntu-latest
19+
20+
steps:
21+
- name: Checkout Repository
22+
uses: actions/checkout@v4
23+
with:
24+
fetch-depth: 0
25+
26+
- name: Import Public Key (Trust Anchor)
27+
run: gpg --import ./public/public-key.asc
28+
29+
- name: Verify PGP Signature
30+
run: |
31+
cd ./target/dist
32+
gpg --verify RELEASE_HASHES.txt.asc RELEASE_HASHES.txt
33+
34+
- name: Extract Tag Version
35+
id: version
36+
run: echo "tag=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
37+
38+
- name: Create GitHub Release
39+
uses: softprops/action-gh-release@v2
40+
env:
41+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
42+
RELEASE_TAG: ${{ steps.version.outputs.tag }}
43+
with:
44+
name: "entlib-native ${{ steps.version.outputs.tag }}"
45+
body: |
46+
## Source Distribution
47+
48+
| File | Description |
49+
|------|-------------|
50+
| `entlib-native-${{ steps.version.outputs.tag }}-source.tar.gz` | Source archive (tar.gz) |
51+
| `entlib-native-${{ steps.version.outputs.tag }}-source.zip` | Source archive (zip) |
52+
| `RELEASE_HASHES.txt` | SHA3-512 + BLAKE3 checksums |
53+
| `RELEASE_HASHES.txt.asc` | PGP detached signature |
54+
| `public-key.asc` | PGP public key (Trust Anchor) |
55+
56+
## Verify Integrity
57+
58+
```bash
59+
gpg --import public-key.asc
60+
gpg --verify RELEASE_HASHES.txt.asc RELEASE_HASHES.txt
61+
```
62+
files: |
63+
./target/dist/entlib-native-*-source.tar.gz
64+
./target/dist/entlib-native-*-source.zip
65+
./target/dist/RELEASE_HASHES.txt
66+
./target/dist/RELEASE_HASHES.txt.asc
67+
./target/dist/public-key.asc
68+
69+
publish-trust-anchor:
70+
name: Publish Trust Anchor to GitHub Pages
71+
needs: verify-and-release
72+
runs-on: ubuntu-latest
73+
74+
environment:
75+
name: github-pages
76+
url: ${{ steps.deployment.outputs.page_url }}
77+
78+
steps:
79+
- name: Checkout Repository
80+
uses: actions/checkout@v4
81+
82+
- name: Extract Tag Version
83+
id: version
84+
run: echo "tag=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
85+
86+
- name: Build Pages Site
87+
env:
88+
RELEASE_TAG: ${{ steps.version.outputs.tag }}
89+
run: |
90+
mkdir -p _site/keys "_site/releases/${RELEASE_TAG}"
91+
92+
cp ./public/public-key.asc _site/keys/public-key.asc
93+
94+
cp ./target/dist/RELEASE_HASHES.txt \
95+
"_site/releases/${RELEASE_TAG}/RELEASE_HASHES.txt"
96+
cp ./target/dist/RELEASE_HASHES.txt.asc \
97+
"_site/releases/${RELEASE_TAG}/RELEASE_HASHES.txt.asc"
98+
99+
cat > _site/index.html << 'PAGE'
100+
<!DOCTYPE html>
101+
<html lang="en">
102+
<head><meta charset="utf-8"><title>entlib-native Trust Anchor</title></head>
103+
<body>
104+
<h1>entlib-native Trust Anchor</h1>
105+
<h2>PGP Public Key</h2>
106+
<p><a href="keys/public-key.asc">public-key.asc</a></p>
107+
<h2>Verification</h2>
108+
<pre>
109+
# 1. Import the public key
110+
curl -sO https://quant-off.github.io/entlib-native/keys/public-key.asc
111+
gpg --import public-key.asc
112+
113+
# 2. Download the release hashes and signature
114+
VERSION="vX.Y.Z"
115+
curl -sO "https://quant-off.github.io/entlib-native/releases/${VERSION}/RELEASE_HASHES.txt"
116+
curl -sO "https://quant-off.github.io/entlib-native/releases/${VERSION}/RELEASE_HASHES.txt.asc"
117+
118+
# 3. Verify the signature
119+
gpg --verify RELEASE_HASHES.txt.asc RELEASE_HASHES.txt
120+
</pre>
121+
</body>
122+
</html>
123+
PAGE
124+
125+
- name: Upload Pages Artifact
126+
uses: actions/upload-pages-artifact@v3
127+
with:
128+
path: _site
129+
130+
- name: Deploy to GitHub Pages
131+
id: deployment
132+
uses: actions/deploy-pages@v4

0 commit comments

Comments
 (0)