OpenSource/reverse-engineering-anything
1
0 Fork 0
mirror of https://github.com/morluto/rea.git synced 2026-11-11 01:13:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): bind dependency evidence to original release inputs

Browse Source
This commit is contained in:
gensokyo-dev committed 2026-10-23 13:28:24 +00:00
1 parent 48a1312237
commit 473bcdd204
13 files changed
+228 -62
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/workflows/ci.yml
+1 -1
View File
@@ -1126,7 +1126,7 @@ jobs:
if: always()
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: dependency-security
name: dependency-security-${{ github.run_attempt }}
path: .cache/dependency-security/
if-no-files-found: warn
retention-days: 14
.github/workflows/release-recovery.yml
+5 -3
View File
@@ -77,11 +77,13 @@ jobs:
- name: Rehearse the original qualified tarball
env:
RECOVERY_VERSION: ${{ steps.release.outputs.version }}
run: node scripts/verify-release-artifact.mjs .cache/verified-package/package.tgz "$RECOVERY_VERSION" --dependency-security=.cache/dependency-security
RECOVERY_SOURCE_SHA: ${{ steps.release.outputs.source_sha }}
run: node scripts/verify-release-artifact.mjs .cache/verified-package/package.tgz "$RECOVERY_VERSION" --dependency-security=.cache/dependency-security --dependency-source=.cache/release-source --dependency-source-sha="$RECOVERY_SOURCE_SHA"
- name: Verify published CLI, MCP and update
env:
RECOVERY_VERSION: ${{ steps.release.outputs.version }}
run: node scripts/verify-published-package.mjs "$RECOVERY_VERSION" --dependency-security=.cache/dependency-security
RECOVERY_SOURCE_SHA: ${{ steps.release.outputs.source_sha }}
run: node scripts/verify-published-package.mjs "$RECOVERY_VERSION" --dependency-security=.cache/dependency-security --dependency-source=.cache/release-source --dependency-source-sha="$RECOVERY_SOURCE_SHA"
- name: Validate released registry metadata
working-directory: .cache/release-source
run: npm run mcp-registry:check
@@ -90,7 +92,7 @@ jobs:
if: always()
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: recovery-consumer-security
name: recovery-consumer-security-${{ github.run_attempt }}
path: .cache/dependency-security/
if-no-files-found: warn
retention-days: 14
.github/workflows/release.yml
+2 -2
View File
@@ -348,7 +348,7 @@ jobs:
if: always()
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: qualified-consumer-security
name: qualified-consumer-security-${{ github.run_attempt }}
path: .cache/dependency-security/
if-no-files-found: warn
retention-days: 14
@@ -430,7 +430,7 @@ jobs:
if: always()
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: published-consumer-security
name: published-consumer-security-${{ github.run_attempt }}
path: .cache/dependency-security/
if-no-files-found: warn
retention-days: 14