Add .sha256 file to the release note as an asset

Author: harrryr

.github/workflows/post_release_version_bump.yml

@@ -102,43 +102,8 @@ jobs:
           VERSION="${{ github.event.inputs.version }}"
           git add src/AWS.Distro.OpenTelemetry.AutoInstrumentation/Version.cs
           git add build/Build.InstallationScripts.cs
-
-      - name: Append latest release checksum to release-build-metadata.json
-        run: |
-          ARTIFACT_NAMES=(
-            "aws-distro-opentelemetry-dotnet-instrumentation-linux-glibc-arm64.zip"
-            "aws-distro-opentelemetry-dotnet-instrumentation-linux-glibc-x64.zip"
-            "aws-distro-opentelemetry-dotnet-instrumentation-linux-musl-arm64.zip"
-            "aws-distro-opentelemetry-dotnet-instrumentation-linux-musl-x64.zip"
-            "aws-distro-opentelemetry-dotnet-instrumentation-windows.zip"
-            "aws-otel-dotnet-install.sh"
-            "AWS.Otel.DotNet.Auto.psm1"
-          )
-
-
-          BASE_URL="https://github.com/aws-observability/aws-otel-dotnet-instrumentation/releases/download/v${{ github.event.inputs.version }}"
-          NEW_RELEASE=$(jq -n --arg version "${{ github.event.inputs.version }}" \
-            '{version: $version, checksum: []}')
-          for ARTIFACT_NAME in "${ARTIFACT_NAMES[@]}"; do
-            curl -L -o "$ARTIFACT_NAME" "${BASE_URL}/${ARTIFACT_NAME}"
-            CHECKSUM=$(shasum -a 256 $ARTIFACT_NAME | awk '{ print $1 }')
-
-            NEW_RELEASE=$(echo "$NEW_RELEASE" | jq --arg name "$ARTIFACT_NAME" \
-              --arg checksum "$CHECKSUM" \
-              '.checksum += [{"name": $name, "checksum": $checksum}]')
-          done
-
-          FILE="release-build-metadata.json"
-          UPDATED_JSON=$(jq --argjson new_release "$NEW_RELEASE" \
-            '.release += [$new_release]' "$FILE")
-          echo "$UPDATED_JSON" > "$FILE"
-
-          git add release-build-metadata.json
-
-      - name: Push changes to Github
-        run: |
-          git commit -m "Prepare main for next development cycle: Update version to ${{ github.event.inputs.version }}"
-          git push --set-upstream origin "prepare-main-for-next-dev-cycle-${{ github.event.inputs.version }}"
+          git commit -m "Prepare main for next development cycle: Update version to $DEV_VERSION"
+          git push --set-upstream origin "prepare-main-for-next-dev-cycle-${VERSION}"
 
       - name: Create Pull Request to main
         env:

.github/workflows/release_build.yml

@@ -116,7 +116,7 @@ jobs:
              "v${{ github.event.inputs.version }}" \
               --notes "Release Verions v${{ github.event.inputs.version }}"
 
-      - name: Upload artifacts to release
+      - name: Upload artifacts and checksum to release 
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
@@ -125,15 +125,21 @@ jobs:
           find ./artifacts/ -name "*.zip" | while read file; do
           base=$(basename "$file")
           cp "$file" "$base"
+          shasum -a 256 $base > $base.sha256
           gh release upload "v${{ github.event.inputs.version }}" \
             $base \
+            $base.sha256 \
             --clobber
           done
+          shasum -a 256 ./installationScripts/aws-otel-dotnet-install.sh | sed "s|./installationScripts/||" > aws-otel-dotnet-install.sh.sha256
+          shasum -a 256 ./installationScripts/AWS.Otel.DotNet.Auto.psm1 | sed "s|./installationScripts/||" > AWS.Otel.DotNet.Auto.psm1.sha256
           gh release upload "v${{ github.event.inputs.version }}" \
             ./installationScripts/aws-otel-dotnet-install.sh \
+            aws-otel-dotnet-install.sh.sha256 \
             --clobber
           gh release upload "v${{ github.event.inputs.version }}" \
             ./installationScripts/AWS.Otel.DotNet.Auto.psm1 \
+            AWS.Otel.DotNet.Auto.psm1.sha256 \
             --clobber
           gh release upload "v${{ github.event.inputs.version }}" \
             ./artifacts/nuget/nuget-packages.zip \

README.md

@@ -55,3 +55,9 @@ See [CONTRIBUTING](CONTRIBUTING.md#security-issue-notifications) for more inform
 ## License
 
 This project is licensed under the Apache-2.0 License.
+
+## Checksum Verification
+
+Artifacts released will include a `.sha256` file for checksum verification starting from v1.32.6
+To verify, run the command `shasum -a 256 -c <artifact_name>.sha256` 
+It should return the output `<artifact_name>: OK` if the validation is successful