Skip to content

Commit f65ac22

Browse files
author
Marcus Pousette
committed
fix: hardening
1 parent 517d093 commit f65ac22

File tree

1 file changed

+48
-29
lines changed

1 file changed

+48
-29
lines changed

‎.github/workflows/prebuilt.yml‎

Lines changed: 48 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -129,17 +129,33 @@ jobs:
129129
HASH=$(node -e "const fs=require('fs');const c=require('crypto');const d=fs.readFileSync(process.argv[1]);process.stdout.write(c.createHash('sha256').update(d).digest('hex'));" "${{ steps.find_art.outputs.artifact }}")
130130
printf "%s %s" "$HASH" "$NAME" > "$NAME.sha256"
131131
gh release upload "${{ needs.ensure-release.outputs.tag }}" "$NAME.sha256" --clobber -R "$GITHUB_REPOSITORY"
132-
# Verify asset is present on the release (retry to dodge eventual consistency)
132+
# Verify asset is present on the release (tolerate eventual consistency)
133133
TAG='${{ needs.ensure-release.outputs.tag }}'
134-
for i in {1..6}; do
134+
DIRECT_URL="https://github.com/$GITHUB_REPOSITORY/releases/download/$TAG/$NAME"
135+
ok="false"
136+
for i in $(seq 1 30); do
137+
CODE=$(curl -sI "$DIRECT_URL" | awk 'NR==1{print $2}') || true
138+
if [ "$CODE" = "200" ] || [ "$CODE" = "302" ]; then ok="true"; break; fi
139+
# Also check the assets list as a fallback view
135140
NAMES=$(gh release view "$TAG" --json assets -q '.assets[].name' -R "$GITHUB_REPOSITORY" || true)
136-
if echo "$NAMES" | grep -Fqx "$NAME"; then
137-
echo "Verified asset present: $NAME"; break
138-
fi
139-
echo "Asset $NAME not visible yet; retry $i/6"; sleep 5
141+
if echo "$NAMES" | grep -Fqx "$NAME"; then ok="true"; break; fi
142+
echo "Asset $NAME not visible yet (HTTP $CODE); retry $i/30"; sleep 10
140143
done
141-
NAMES=$(gh release view "$TAG" --json assets -q '.assets[].name' -R "$GITHUB_REPOSITORY" || true)
142-
echo "$NAMES" | grep -Fqx "$NAME" || { echo "::error::Missing asset after upload: $NAME"; exit 1; }
144+
if [ "$ok" != "true" ]; then
145+
echo "Asset still missing; attempting re-upload of $NAME"
146+
gh release upload "$TAG" "${{ steps.find_art.outputs.artifact }}#${NAME}" --clobber -R "$GITHUB_REPOSITORY" || true
147+
# Final tries after re-upload
148+
for i in $(seq 1 6); do
149+
CODE=$(curl -sI "$DIRECT_URL" | awk 'NR==1{print $2}') || true
150+
if [ "$CODE" = "200" ] || [ "$CODE" = "302" ]; then ok="true"; break; fi
151+
echo "Post re-upload wait; retry $i/6"; sleep 10
152+
done
153+
fi
154+
if [ "$ok" != "true" ]; then
155+
echo "::error::Missing asset after upload attempts: $NAME ($DIRECT_URL)";
156+
echo "Release assets:"; gh release view "$TAG" --json assets -q '.assets[].name' -R "$GITHUB_REPOSITORY" || true
157+
exit 1
158+
fi
143159
144160
prebuild-alpine:
145161
name: Prebuild on alpine
@@ -185,15 +201,16 @@ jobs:
185201
HASH=$(node -e "const fs=require('fs');const c=require('crypto');const d=fs.readFileSync(process.argv[1]);process.stdout.write(c.createHash('sha256').update(d).digest('hex'));" "$ART")
186202
printf "%s %s" "$HASH" "$NAME" > "$NAME.sha256"
187203
gh release upload "${{ needs.ensure-release.outputs.tag }}" "$NAME.sha256" --clobber -R "$GITHUB_REPOSITORY"
188-
# Verify asset exists
204+
# Verify asset exists (HEAD the direct URL with retries)
189205
TAG='${{ needs.ensure-release.outputs.tag }}'
190-
for i in 1 2 3 4 5 6; do
191-
NAMES=$(gh release view "$TAG" --json assets -q '.assets[].name' -R "$GITHUB_REPOSITORY" || true)
192-
echo "$NAMES" | grep -Fqx "$NAME" && { echo "Verified $NAME"; break; }
193-
echo "Waiting for $NAME to appear ($i/6)"; sleep 5
206+
DIRECT_URL="https://github.com/$GITHUB_REPOSITORY/releases/download/$TAG/$NAME"
207+
ok=false
208+
for i in 1 2 3 4 5 6 7 8 9 10; do
209+
CODE=$(curl -sI "$DIRECT_URL" | awk 'NR==1{print $2}') || true
210+
if [ "$CODE" = "200" ] || [ "$CODE" = "302" ]; then ok=true; break; fi
211+
echo "Waiting for $NAME (HTTP $CODE) ($i/10)"; sleep 6
194212
done
195-
NAMES=$(gh release view "$TAG" --json assets -q '.assets[].name' -R "$GITHUB_REPOSITORY" || true)
196-
echo "$NAMES" | grep -Fqx "$NAME" || { echo "::error::Missing asset after upload: $NAME"; exit 1; }
213+
$ok || { echo "::error::Missing asset after upload: $NAME"; exit 1; }
197214
198215
prebuild-alpine-arm:
199216
name: Prebuild on alpine (arm)
@@ -235,15 +252,16 @@ jobs:
235252
HASH=$(node -e "const fs=require('fs');const c=require('crypto');const d=fs.readFileSync(process.argv[1]);process.stdout.write(c.createHash('sha256').update(d).digest('hex'));" "$ART")
236253
printf "%s %s" "$HASH" "$NAME" > "$NAME.sha256"
237254
gh release upload "${{ needs.ensure-release.outputs.tag }}" "$NAME.sha256" --clobber -R "$GITHUB_REPOSITORY"
238-
# Verify asset exists
255+
# Verify asset exists (HEAD the direct URL with retries)
239256
TAG='${{ needs.ensure-release.outputs.tag }}'
240-
for i in 1 2 3 4 5 6; do
241-
NAMES=$(gh release view "$TAG" --json assets -q '.assets[].name' -R "$GITHUB_REPOSITORY" || true)
242-
echo "$NAMES" | grep -Fqx "$NAME" && { echo "Verified $NAME"; break; }
243-
echo "Waiting for $NAME to appear ($i/6)"; sleep 5
257+
DIRECT_URL="https://github.com/$GITHUB_REPOSITORY/releases/download/$TAG/$NAME"
258+
ok=false
259+
for i in 1 2 3 4 5 6 7 8 9 10; do
260+
CODE=$(curl -sI "$DIRECT_URL" | awk 'NR==1{print $2}') || true
261+
if [ "$CODE" = "200" ] || [ "$CODE" = "302" ]; then ok=true; break; fi
262+
echo "Waiting for $NAME (HTTP $CODE) ($i/10)"; sleep 6
244263
done
245-
NAMES=$(gh release view "$TAG" --json assets -q '.assets[].name' -R "$GITHUB_REPOSITORY" || true)
246-
echo "$NAMES" | grep -Fqx "$NAME" || { echo "::error::Missing asset after upload: $NAME"; exit 1; }
264+
$ok || { echo "::error::Missing asset after upload: $NAME"; exit 1; }
247265
248266
prebuild-linux-arm:
249267
name: Prebuild on Linux (arm64)
@@ -272,14 +290,15 @@ jobs:
272290
HASH=$(node -e "const fs=require('fs');const c=require('crypto');const d=fs.readFileSync(process.argv[1]);process.stdout.write(c.createHash('sha256').update(d).digest('hex'));" "$ART")
273291
printf "%s %s" "$HASH" "$NAME" > "$NAME.sha256"
274292
gh release upload "${{ needs.ensure-release.outputs.tag }}" "$NAME.sha256" --clobber -R "$GITHUB_REPOSITORY"
275-
# Verify asset exists
293+
# Verify asset exists (HEAD the direct URL with retries)
276294
TAG='${{ needs.ensure-release.outputs.tag }}'
277-
for i in 1 2 3 4 5 6; do
278-
NAMES=$(gh release view "$TAG" --json assets -q '.assets[].name' -R "$GITHUB_REPOSITORY" || true)
279-
echo "$NAMES" | grep -Fqx "$NAME" && { echo "Verified $NAME"; break; }
280-
echo "Waiting for $NAME to appear ($i/6)"; sleep 5
295+
DIRECT_URL="https://github.com/$GITHUB_REPOSITORY/releases/download/$TAG/$NAME"
296+
ok=false
297+
for i in 1 2 3 4 5 6 7 8 9 10; do
298+
CODE=$(curl -sI "$DIRECT_URL" | awk 'NR==1{print $2}') || true
299+
if [ "$CODE" = "200" ] || [ "$CODE" = "302" ]; then ok=true; break; fi
300+
echo "Waiting for $NAME (HTTP $CODE) ($i/10)"; sleep 6
281301
done
282-
NAMES=$(gh release view "$TAG" --json assets -q '.assets[].name' -R "$GITHUB_REPOSITORY" || true)
283-
echo "$NAMES" | grep -Fqx "$NAME" || { echo "::error::Missing asset after upload: $NAME"; exit 1; }
302+
$ok || { echo "::error::Missing asset after upload: $NAME"; exit 1; }
284303
permissions:
285304
contents: write

0 commit comments

Comments
 (0)