fix: portable checksum on darwin, anchor grep pattern

- sha256sum is not available on macOS; use shasum -a 256 on darwin. Select based on steps.version.outputs.os which is already computed. Fixes MAJOR finding from gpt-review-bot (PR #127 review). - Anchor checksum grep with ^ to avoid matching on partial lines. Fixes MINOR finding from gpt-review-bot (PR #127 review).
feat(action): derive binary name from uname for multi-arch support (#124 )
2026-05-14 05:48:21 +00:00 · 2026-05-14 05:45:20 +00:00
1 changed files with 34 additions and 5 deletions
@@ -124,14 +124,38 @@ runs:
        else
          VERSION="${{ inputs.version }}"
        fi
+
+        # Detect OS and architecture for platform-specific binary download
+        OS_RAW=$(uname -s | tr '[:upper:]' '[:lower:]')
+        case "$OS_RAW" in
+          linux)  OS="linux" ;;
+          darwin) OS="darwin" ;;
+          *)
+            echo "Error: unsupported OS: $(uname -s)" >&2
+            exit 1
+            ;;
+        esac
+
+        RAW_ARCH=$(uname -m)
+        case "$RAW_ARCH" in
+          x86_64)           ARCH="amd64" ;;
+          aarch64 | arm64)  ARCH="arm64" ;;
+          *)
+            echo "Error: unsupported architecture: $RAW_ARCH" >&2
+            exit 1
+            ;;
+        esac
+
        echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+        echo "os=${OS}" >> "$GITHUB_OUTPUT"
+        echo "arch=${ARCH}" >> "$GITHUB_OUTPUT"

    - name: Cache review-bot binary
      id: cache
      uses: actions/cache@v4
      with:
        path: ${{ runner.temp }}/review-bot
-        key: review-bot-linux-amd64-${{ steps.version.outputs.version }}
+        key: review-bot-${{ steps.version.outputs.os }}-${{ steps.version.outputs.arch }}-${{ steps.version.outputs.version }}

    - name: Install review-bot
      if: steps.cache.outputs.cache-hit != 'true'
@@ -140,7 +164,7 @@ runs:
        GITEA_URL="${{ inputs.gitea-url || github.server_url }}"
        REPO="${{ inputs.repo || 'rodin/review-bot' }}"
        VERSION="${{ steps.version.outputs.version }}"
-        BINARY="review-bot-linux-amd64"
+        BINARY="review-bot-${{ steps.version.outputs.os }}-${{ steps.version.outputs.arch }}"

        curl -sSfL "${GITEA_URL}/${REPO}/releases/download/${VERSION}/${BINARY}" \
          -o "${{ runner.temp }}/review-bot"
@@ -149,8 +173,13 @@ runs:

        # Verify SHA-256 checksum
        cd "${{ runner.temp }}"
-        EXPECTED=$(grep "${BINARY}" checksums.txt | awk '{print $1}')
-        ACTUAL=$(sha256sum review-bot | awk '{print $1}')
+        EXPECTED=$(grep -E "^[[:xdigit:]]+[[:space:]]+\*?${BINARY}$" checksums.txt | awk '{print $1}')
+        # sha256sum (GNU) is not available on macOS; use shasum -a 256 on darwin.
+        if [ "${{ steps.version.outputs.os }}" = "darwin" ]; then
+          ACTUAL=$(shasum -a 256 review-bot | awk '{print $1}')
+        else
+          ACTUAL=$(sha256sum review-bot | awk '{print $1}')
+        fi

        if [ -z "$EXPECTED" ]; then
          echo "Error: no checksum found for ${BINARY}" >&2
@@ -164,7 +193,7 @@ runs:
        fi

        chmod +x "${{ runner.temp }}/review-bot"
-        echo "Installed review-bot ${VERSION} (checksum verified)"
+        echo "Installed review-bot-${{ steps.version.outputs.os }}-${{ steps.version.outputs.arch }} ${VERSION} (checksum verified)"

    - name: Run review
      shell: bash
Author	SHA1	Message	Date
aweiker	f8b9d7d282	fix: portable checksum on darwin, anchor grep pattern PR Ready Gate / clear-labels (pull_request) Successful in 2s Details CI / test (pull_request) Successful in 17s Details CI / review (anthropic--claude-4.6-sonnet, sonnet, SONNET_REVIEW_TOKEN) (pull_request) Successful in 27s Details CI / review (gpt-5, security, ., rodin/security-patterns, SECURITY_REVIEW.md, SECURITY_REVIEW_TOKEN) (pull_request) Successful in 1m4s Details CI / review (gpt-5, gpt, GPT_REVIEW_TOKEN) (pull_request) Successful in 1m13s Details CI / test (push) Successful in 17s Details CI / review (anthropic--claude-4.6-sonnet, sonnet, SONNET_REVIEW_TOKEN) (push) Has been skipped Details CI / review (gpt-5, gpt, GPT_REVIEW_TOKEN) (push) Has been skipped Details CI / review (gpt-5, security, ., rodin/security-patterns, SECURITY_REVIEW.md, SECURITY_REVIEW_TOKEN) (push) Has been skipped Details - sha256sum is not available on macOS; use shasum -a 256 on darwin. Select based on steps.version.outputs.os which is already computed. Fixes MAJOR finding from gpt-review-bot (PR #127 review). - Anchor checksum grep with ^ to avoid matching on partial lines. Fixes MINOR finding from gpt-review-bot (PR #127 review).	2026-05-14 05:48:21 +00:00
aweiker	7a8fc166ec	feat(action): derive binary name from uname for multi-arch support (#124 ) CI / test (pull_request) Successful in 17s Details CI / review (anthropic--claude-4.6-sonnet, sonnet, SONNET_REVIEW_TOKEN) (pull_request) Successful in 26s Details CI / review (gpt-5, security, ., rodin/security-patterns, SECURITY_REVIEW.md, SECURITY_REVIEW_TOKEN) (pull_request) Successful in 1m12s Details CI / review (gpt-5, gpt, GPT_REVIEW_TOKEN) (pull_request) Successful in 1m33s Details Previously the Install step hard-coded 'review-bot-linux-amd64'. This fails on arm64 runners (Graviton, Apple Silicon) where uname -m returns 'aarch64' or 'arm64'. Changes: - Add OS/arch detection in 'Determine version' step using uname -s/-m - Map uname output to asset name format: x86_64→amd64, aarch64/arm64→arm64, linux→linux, darwin→darwin - Emit 'os' and 'arch' as step outputs alongside 'version' - Update cache key: review-bot-{os}-{arch}-{version} - Update Install step: BINARY derived from step outputs - Anchor checksum grep to exact filename (not substring match) - Unsupported OS or arch exits with a clear error message Supported platforms: linux-amd64, linux-arm64, darwin-amd64, darwin-arm64 (matches what the release workflow builds)	2026-05-14 05:45:20 +00:00