ci: gate RCs on verifiable artifacts (#339)

.gitea/workflows/ci.yml

@@ -17,13 +17,69 @@ jobs:
       - run: pip install -r requirements.txt
       - run: python3 -m pytest tests/ -q
 
-  build-frontend:
+  build-release:
     runs-on: ubuntu-latest
     needs: lint
     steps:
       - uses: actions/checkout@v4
-      - name: Pack frontend
-        run: tar -czf frontend.tar.gz frontend
-      - name: Upload artifact
+      - name: Build deterministic release bundle
+        run: |
+          SOURCE_DATE_EPOCH="$(git show -s --format=%ct "$GITHUB_SHA")"
+          python3 scripts/build_release.py \
+            --root . \
+            --output-dir dist \
+            --commit "$GITHUB_SHA" \
+            --source-date-epoch "$SOURCE_DATE_EPOCH"
+      - name: Upload tested release bundle
         uses: actions/upload-artifact@v3
-        with: { name: frontend, path: frontend.tar.gz }
+        with:
+          name: release-bundle
+          path: dist/
+
+  release-candidate:
+    runs-on: ubuntu-latest
+    needs: [lint, build-release]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Download tested release bundle
+        uses: actions/download-artifact@v3
+        with:
+          name: release-bundle
+          path: dist
+      - name: Verify and publish release candidate
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          TARGET="${{ github.sha }}"
+          TAG="v0.1.0-rc.${{ github.run_number }}"
+          RELEASE_URL="${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases"
+
+          (cd dist && sha256sum -c ./*.sha256)
+          python3 scripts/verify_release.py --input-dir dist --commit "$TARGET"
+
+          printf '{"tag_name":"%s","target_commitish":"%s","name":"Release Candidate %s","body":"CI-tested release candidate for commit %s. Verify downloads with the attached SHA-256 checksum.","draft":true,"prerelease":true}\n' \
+            "$TAG" "$TARGET" "$TAG" "$TARGET" > /tmp/release.json
+          curl --fail-with-body -sS -X POST "$RELEASE_URL" \
+            -H "Authorization: token $TOKEN" \
+            -H "Content-Type: application/json" \
+            --data-binary @/tmp/release.json > /tmp/release-response.json
+          RELEASE_ID="$(python3 -c 'import json; print(json.load(open("/tmp/release-response.json"))["id"])')"
+
+          for ASSET in dist/*; do
+            NAME="$(basename "$ASSET")"
+            ENCODED_NAME="$(python3 -c 'import sys,urllib.parse; print(urllib.parse.quote(sys.argv[1]))' "$NAME")"
+            curl --fail-with-body -sS -X POST "$RELEASE_URL/$RELEASE_ID/assets?name=$ENCODED_NAME" \
+              -H "Authorization: token $TOKEN" \
+              -H "Content-Type: application/octet-stream" \
+              --data-binary "@$ASSET"
+          done
+
+          printf '{"draft":false,"prerelease":true}\n' > /tmp/publish.json
+          curl --fail-with-body -sS -X PATCH "$RELEASE_URL/$RELEASE_ID" \
+            -H "Authorization: token $TOKEN" \
+            -H "Content-Type: application/json" \
+            --data-binary @/tmp/publish.json

.gitea/workflows/release.yml

@@ -1,40 +0,0 @@
-name: Release
-
-on:
-  push:
-    branches: [main]
-  workflow_dispatch:
-
-jobs:
-  release-candidate:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Create Gitea tag and release candidate
-        env:
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          TAG="v0.1.0-rc.${{ github.run_number }}"
-          TARGET="${{ github.sha }}"
-          TAG_URL="${{ github.server_url }}/api/v1/repos/${{ github.repository }}/tags"
-          RELEASE_URL="${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases"
-
-          printf '{"tag_name":"%s","target":"%s","message":"Automated release candidate %s"}\n' \
-            "$TAG" "$TARGET" "$TAG" > /tmp/tag.json
-          curl --fail-with-body -sS -X POST "$TAG_URL" \
-            -H "Authorization: token $TOKEN" \
-            -H "Content-Type: application/json" \
-            --data-binary @/tmp/tag.json
-
-          printf '{"tag_name":"%s","target_commitish":"%s","name":"Release Candidate %s","body":"Automated release candidate for commit %s.","draft":false,"prerelease":true}\n' \
-            "$TAG" "$TARGET" "$TAG" "$TARGET" > /tmp/release.json
-          curl --fail-with-body -sS -X POST "$RELEASE_URL" \
-            -H "Authorization: token $TOKEN" \
-            -H "Content-Type: application/json" \
-            --data-binary @/tmp/release.json