Skip to content

Fix release gate workflow identity binding #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
YanagiKH merged 2 commits into from
Sep 1, 2026
Merged

Fix release gate workflow identity binding #13

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
eef63a3
fix: bind release gates to trusted workflows
YanagiKH Sep 1, 2026
263ff5a
fix: grant and resolve trusted action runs
YanagiKH Sep 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
102 changes: 99 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 35
permissions:
actions: read
checks: read
contents: read
outputs:
Expand Down Expand Up @@ -77,10 +78,43 @@ jobs:
run: |
set -euo pipefail
REQUIRED=("All green" "CodeQL" "Code scanning high-severity policy" "pnpm audit and security suite")
check_runs_file="$RUNNER_TEMP/disrunner-main-check-runs.json"
for attempt in $(seq 1 60); do
main_suite_ids="$(
for workflow in ci.yml security.yml; do
gh api --paginate \
"repos/${GITHUB_REPOSITORY}/actions/workflows/${workflow}/runs?head_sha=${RELEASE_SHA}&branch=main&event=push&per_page=100" \
--jq '.workflow_runs[]'
done |
jq -sc --arg sha "$RELEASE_SHA" --arg repository "$GITHUB_REPOSITORY" '
[.[] |
select(
.repository.full_name == $repository and
.event == "push" and
.head_branch == "main" and
.head_sha == $sha
) | .check_suite_id] | unique
'
)"
test "$main_suite_ids" != '[]' || {
echo "No GitHub Actions check suite is bound to main at $RELEASE_SHA yet."
}
gh api --paginate --slurp \
"repos/${GITHUB_REPOSITORY}/commits/${RELEASE_SHA}/check-runs?per_page=100" \
> "$check_runs_file"
all_green=true
for check in "${REQUIRED[@]}"; do
conclusion="$(gh api "repos/${GITHUB_REPOSITORY}/commits/${RELEASE_SHA}/check-runs?per_page=100" --jq ".check_runs | map(select(.name == \"${check}\" and .app.slug == \"github-actions\" and .check_suite.head_branch == \"main\")) | sort_by(.started_at) | last | (.conclusion // \"pending\")")"
conclusion="$(
jq -r --arg check "$check" --argjson suite_ids "$main_suite_ids" '
[.[] | .check_runs[] |
select(
.name == $check and
.app.slug == "github-actions" and
(.check_suite.id as $id | $suite_ids | index($id))
)] |
sort_by(.started_at) | last | (.conclusion // "pending")
' "$check_runs_file"
)"
echo "${check}: ${conclusion}"
case "$conclusion" in
success) ;;
Expand Down Expand Up @@ -318,9 +352,40 @@ jobs:
git fetch --force origin "refs/tags/$RELEASE_TAG:refs/tags/disrunner-release-verify"
test "$(git cat-file -t refs/tags/disrunner-release-verify)" = tag
test "$(git rev-parse 'refs/tags/disrunner-release-verify^{commit}')" = "$RELEASE_SHA"
main_suite_ids="$(
for workflow in ci.yml security.yml; do
gh api --paginate \
"repos/${GITHUB_REPOSITORY}/actions/workflows/${workflow}/runs?head_sha=${RELEASE_SHA}&branch=main&event=push&per_page=100" \
--jq '.workflow_runs[]'
done |
jq -sc --arg sha "$RELEASE_SHA" --arg repository "$GITHUB_REPOSITORY" '
[.[] |
select(
.repository.full_name == $repository and
.event == "push" and
.head_branch == "main" and
.head_sha == $sha
) | .check_suite_id] | unique
'
)"
test "$main_suite_ids" != '[]'
check_runs_file="$RUNNER_TEMP/disrunner-final-main-check-runs.json"
gh api --paginate --slurp \
"repos/${GITHUB_REPOSITORY}/commits/${RELEASE_SHA}/check-runs?per_page=100" \
> "$check_runs_file"
REQUIRED=("All green" "CodeQL" "Code scanning high-severity policy" "pnpm audit and security suite")
for check in "${REQUIRED[@]}"; do
conclusion="$(gh api "repos/${GITHUB_REPOSITORY}/commits/${RELEASE_SHA}/check-runs?per_page=100" --jq ".check_runs | map(select(.name == \"${check}\" and .app.slug == \"github-actions\" and .check_suite.head_branch == \"main\")) | sort_by(.started_at) | last | (.conclusion // \"missing\")")"
conclusion="$(
jq -r --arg check "$check" --argjson suite_ids "$main_suite_ids" '
[.[] | .check_runs[] |
select(
.name == $check and
.app.slug == "github-actions" and
(.check_suite.id as $id | $suite_ids | index($id))
)] |
sort_by(.started_at) | last | (.conclusion // "missing")
' "$check_runs_file"
)"
test "$conclusion" = success || {
echo "Final required check is not green: ${check} (${conclusion})." >&2
exit 1
Expand Down Expand Up @@ -635,9 +700,40 @@ jobs:

git fetch --force --no-tags origin '+refs/heads/main:refs/remotes/origin/main'
test "$(git rev-parse refs/remotes/origin/main)" = "$RELEASE_SHA"
main_suite_ids="$(
for workflow in ci.yml security.yml; do
gh api --paginate \
"repos/${GITHUB_REPOSITORY}/actions/workflows/${workflow}/runs?head_sha=${RELEASE_SHA}&branch=main&event=push&per_page=100" \
--jq '.workflow_runs[]'
done |
jq -sc --arg sha "$RELEASE_SHA" --arg repository "$GITHUB_REPOSITORY" '
[.[] |
select(
.repository.full_name == $repository and
.event == "push" and
.head_branch == "main" and
.head_sha == $sha
) | .check_suite_id] | unique
'
)"
test "$main_suite_ids" != '[]'
check_runs_file="$RUNNER_TEMP/disrunner-publish-main-check-runs.json"
gh api --paginate --slurp \
"repos/${GITHUB_REPOSITORY}/commits/${RELEASE_SHA}/check-runs?per_page=100" \
> "$check_runs_file"
REQUIRED=("All green" "CodeQL" "Code scanning high-severity policy" "pnpm audit and security suite")
for check in "${REQUIRED[@]}"; do
conclusion="$(gh api "repos/${GITHUB_REPOSITORY}/commits/${RELEASE_SHA}/check-runs?per_page=100" --jq ".check_runs | map(select(.name == \"${check}\" and .app.slug == \"github-actions\" and .check_suite.head_branch == \"main\")) | sort_by(.started_at) | last | (.conclusion // \"missing\")")"
conclusion="$(
jq -r --arg check "$check" --argjson suite_ids "$main_suite_ids" '
[.[] | .check_runs[] |
select(
.name == $check and
.app.slug == "github-actions" and
(.check_suite.id as $id | $suite_ids | index($id))
)] |
sort_by(.started_at) | last | (.conclusion // "missing")
' "$check_runs_file"
)"
test "$conclusion" = success || {
echo "Final required check is not green: ${check} (${conclusion})." >&2
exit 1
Expand Down
Loading