Prepare release artifacts from tags - #97
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
623d863 to
647dc9d
Compare
01ac93e to
a62a99d
Compare
| "terraform-provider-kernel_${version}_windows_arm64.zip" | ||
| )" | ||
| actual_assets="$(awk 'NF == 2 { print $2 }' "$checksum" | sort)" | ||
| diff -u <(printf '%s\n' "$expected_assets") <(printf '%s\n' "$actual_assets") |
There was a problem hiding this comment.
Asset list compare not order-safe
Low Severity
The artifact contract check sorts only actual_assets before diff, while expected_assets stays in hand-written order. The check is meant to assert set equality, but it actually requires the printf list to stay lexicographically sorted. Reordering or inserting a platform name out of sort order makes a valid release fail verification.
Reviewed by Cursor Bugbot for commit a62a99d. Configure here.
There was a problem hiding this comment.
Fixed in the rebuilt branch. The shared artifact verifier now sorts both the generated expected filename set and the checksum-derived actual filename set before comparing them. I also exercised the verifier with the checksum lines reversed; the valid release still passes.
a62a99d to
b85cf78
Compare
400811b to
4d802d1
Compare
b85cf78 to
18cfeea
Compare
a89c140 to
ef813b3
Compare
1163a2f to
f8ef464
Compare
ef813b3 to
888edd0
Compare
f8ef464 to
15de1e0
Compare
094fc64 to
efa2797
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
There are 2 total unresolved issues (including 1 from previous review).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit efa2797. Configure here.
c76e86a to
59a6014
Compare
efa2797 to
17d0c8a
Compare
KERNEL-1559 Terraform provider v1: production-ready durable Kernel configuration
tldrShip v1 of the Kernel Terraform provider so a user can describe their durable Kernel platform config — project, browser infra, profiles, proxies, extensions, deployments, and carefully-scoped API keys — entirely in Terraform. Durable desired-state only; runtime/session activity is explicitly out of scope. Start from the merged v0 state, produce a scope-audit + plan before coding, and ship in small per-resource PRs. Current groundwork already doneAPI-contract prerequisites and the security hardening surfaced while auditing them are in flight as draft PRs on API contract prep (draft PRs):
Security fixes surfaced during the audit (draft PRs):
Open decisions before the late phases:
v1 product definitionv1 should manage durable Kernel platform configuration. core v1 resources:
core v1 data sources:
important adjustment:
explicit non-goalsdo not add Terraform resources for temporary/runtime activity:
do not add these unless explicitly approved later:
do not manually edit generated files. do not include private Slack, Linear, customer, or internal discussion context in code, comments, commits, branches, docs, or PR bodies. required first step: v1 scope auditbefore writing code, inspect:
produce a concise v1 implementation plan before coding. the plan must classify every candidate resource as:
github issues to resolve in v1handle these explicitly:
|
Sayan-
left a comment
Sayan-
left a comment
There was a problem hiding this comment.
Strong PR. The gates are the right ones (strict semver, ancestor-of-main, public-visibility), actions are SHA-pinned, persist-credentials: false is set, and the tag reaches the shell through $GITHUB_REF_NAME rather than ${{ }} interpolation, so there's no injection path. I also like that the GORELEASER_CURRENT_TAG fix added an independent dist/metadata.json version cross-check instead of just trusting the env var — belt and braces is correct for a release path. And your read on actions/upload-artifact was right: it authenticates through ACTIONS_RUNTIME_TOKEN, not GITHUB_TOKEN, so contents: read is the correct least-privilege setting.
One thing worth planning around: this workflow has never executed, and it can't until the repository is public, because the visibility gate exits 1. There's no workflow_dispatch, so it's tag-only. That leaves three paths unexercised — test -s LICENSE, the visibility check, and git merge-base --is-ancestor "$GITHUB_SHA" origin/main. The last one depends on origin/main existing as a remote-tracking ref after a tag-triggered checkout. fetch-depth: 0 should provide that, but as written the first time it is ever evaluated would be the real first release tag.
Cheap insurance: once the repo is public and before the first real tag, push a throwaway v0.0.1 and confirm the workflow goes green. It's safe to do — --skip=publish,sign means no GitHub Release, no signature, and nothing reaches the registry. Worth writing into docs/release.md as an explicit step so it isn't left to memory on release day.
59a6014 to
ee70610
Compare
17d0c8a to
6a40866
Compare
2 participants
Summary
This PR adds the preparation half of the provider release path. A stable
vMAJOR.MINOR.PATCHtag triggers a workflow that rejects missing licensing,non-public visibility, and commits outside
mainbefore building.The workflow uses pinned GoReleaser OSS v2.17.0 to build unsigned, unpublished
artifacts. A shared verifier checks the exact 13-platform archive contract,
platform-correct provider binary names, the versioned Registry manifest,
checksum coverage, and checksum contents before retaining the artifacts for
seven days.
Why this is v1 work
The first public provider release needs a reproducible artifact handoff before
signing and publication. This PR has read-only repository permissions and
cannot access signing secrets or create a GitHub Release.
Provider surface
Verification
gofmt -l cmd internalgo test -short -timeout=2m ./...go vet ./...terraform fmt -check -recursive examplesbash scripts/check-docs.shbash scripts/check-markdown-links.shbash scripts/check-examples.shbash scripts/check-registry-manifest.shgoreleaser checkshellcheck scripts/check-release-artifacts.sh scripts/check-release-snapshot.shv99.99.99exact checksum coverage, and SHA-256 contents
malformed checksum files
Live acceptance tests were not rerun because this PR does not change provider
behavior. The complete acceptance matrix remains a manual pre-tag gate.
Deferred release gates
Signed checksum publication and GitHub Release creation remain in the next
focused release PR. Before the first public tag, the stack must be merged to
main, the complete acceptance matrix must pass on the release commit, andrepository visibility must be public.
Issues #24 and #25 remain outside this PR.
Note
Low Risk
Changes are limited to release CI scripts and documentation; the workflow uses read-only
contentspermissions and does not touch provider runtime code or secrets.Overview
Adds a tag-driven release preparation workflow that runs on
v*pushes and builds unsigned, unpublished Terraform Registry assets without creating a GitHub Release or signing checksums.Before GoReleaser runs, the job enforces stable semver tags, a non-empty LICENSE, public repository visibility, and that the tagged commit is reachable from
origin/main. It pins GoReleaser v2.17.0, setsGORELEASER_CURRENT_TAGto the pushed tag, runsrelease --clean --skip=publish,sign, copies the registry manifest intodist, and runs shared verification. Verified zips, manifest, andSHA256SUMSare uploaded as a 7-day workflow artifact.Release contract checks move into
scripts/check-release-artifacts.sh(13 platforms, archive contents, manifest match, checksum coverage andsha256sum -c).check-release-snapshot.shnow only runs a snapshot build and delegates to that script.docs/release.mddocuments the workflow and notes that GPG signing and registry publication stay a separate step.Reviewed by Cursor Bugbot for commit 6a40866. Bugbot is set up for automated code reviews on this repo. Configure here.