Sign hash list seq 1 #25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: validate | |
| # The published list is served by requiring it, so a file that does not load takes the endpoint | |
| # down. The signer runs validate.js itself before pushing; this run covers human PRs and stands as | |
| # the live tripwire on master -- the signer's deploy-key pushes trigger it, so every signing commit | |
| # gets a green check and a red one always means something real. | |
| on: | |
| pull_request: | |
| push: | |
| branches: [master] | |
| permissions: | |
| contents: read | |
| jobs: | |
| validate: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| # The outputs guard below diffs the merge commit against its first parent. | |
| fetch-depth: 2 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '20' | |
| # The three outputs are generated by the signer; edit the ledger instead. This catches | |
| # honest mistakes, not attacks: pull_request runs the PR head's copy of this workflow, so a | |
| # hostile PR could weaken the check it is judged by. The control against a hostile PR is | |
| # required review on the ruleset -- this step just makes the mistake loud before a human | |
| # looks. | |
| # | |
| # HEAD is the PR merge commit and HEAD^1 is the base branch as it stands NOW, so this sees | |
| # exactly what merging the PR would change. (The event payload's base.sha is the base at the | |
| # last synchronize -- stale on any PR whose base has since moved, and the signer moves master | |
| # daily, so diffing against it flags every hash published since the PR was opened.) | |
| - name: Outputs are generated, not edited | |
| if: github.event_name == 'pull_request' | |
| run: | | |
| CHANGED=$(git diff --name-only HEAD^1 HEAD -- \ | |
| src/hashes/hashes.js src/hashes/hashlist-signed.json src/hashes/provenance.json) | |
| if [ -n "$CHANGED" ]; then | |
| echo 'these files are generated by the signing workflow; edit src/hashes/ledger.json instead:' | |
| echo "$CHANGED" | |
| exit 1 | |
| fi | |
| - run: node scripts/validate.js | |
| # The reconciler's own logic, driven against a local fake flux remote: bootstrap, derivation, | |
| # claimed-hash mismatch, culls, duplicates, corruption, a wiped document, v1 compatibility, | |
| # and the empty-tree hash. No network and no secrets -- it builds its own git remote in a | |
| # temp dir, so it runs on fork pull requests like everything else here. | |
| - name: Reconciler tests | |
| run: npm test |