Rodin
29ab19c94d
PR Ready Gate / clear-labels (pull_request) Successful in 2s
CI / test (pull_request) Successful in 18s
CI / review (anthropic--claude-4.6-sonnet, sonnet, SONNET_REVIEW_TOKEN) (pull_request) Successful in 39s
CI / review (gpt-5, gpt, GPT_REVIEW_TOKEN) (pull_request) Successful in 1m32s
CI / review (gpt-5, security, ., rodin/security-patterns, SECURITY_REVIEW.md, SECURITY_REVIEW_TOKEN) (pull_request) Successful in 3m18s
MAJOR fixes: - ci.yml: Add fork protection (github.event.pull_request.head.repo.full_name check) to prevent secret exfiltration from malicious fork PRs. Added security comment explaining the trust model for this private repo. - ci.yml: Set GITHUB_SERVER_URL to explicit Gitea URL instead of github.server_url since reviews are posted to Gitea, not GitHub. - release.yml: Set GITEA_URL explicitly to https://gitea.weiker.me since releases are created on Gitea. - action.yml: Change gitea-url default from empty (fallback to github.server_url) to explicit https://gitea.weiker.me. Update all internal uses to rely on this default rather than falling back to server_url. MINOR fixes: - action.yml: Update header comment to reflect dual-platform (Gitea Actions + GitHub Actions) support. - action.yml: Fix repo input description to say it defaults to rodin/review-bot for version lookup, matching the actual code behavior. - pr-ready-gate.yml: Add comments explaining why Gitea URL is hardcoded (intentional: we update Gitea PR from GitHub mirror) and noting the PR number matching assumption. All findings from sonnet-review, gpt-review, and security-review addressed.
99 lines
4.0 KiB
YAML
99 lines
4.0 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.26'
|
|
|
|
- name: Run tests
|
|
run: |
|
|
go vet ./...
|
|
go test ./...
|
|
|
|
- name: Build binaries
|
|
run: |
|
|
VERSION=${GITHUB_REF_NAME}
|
|
mkdir -p dist
|
|
|
|
GOOS=linux GOARCH=amd64 go build -ldflags "-s -w -X main.version=${VERSION}" -o dist/review-bot-linux-amd64 ./cmd/review-bot
|
|
GOOS=linux GOARCH=arm64 go build -ldflags "-s -w -X main.version=${VERSION}" -o dist/review-bot-linux-arm64 ./cmd/review-bot
|
|
GOOS=darwin GOARCH=amd64 go build -ldflags "-s -w -X main.version=${VERSION}" -o dist/review-bot-darwin-amd64 ./cmd/review-bot
|
|
GOOS=darwin GOARCH=arm64 go build -ldflags "-s -w -X main.version=${VERSION}" -o dist/review-bot-darwin-arm64 ./cmd/review-bot
|
|
|
|
cd dist && sha256sum * > checksums.txt
|
|
|
|
- name: Create release and upload assets
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
|
run: |
|
|
VERSION=${GITHUB_REF_NAME}
|
|
# Releases are created on Gitea, not GitHub - use explicit Gitea URL
|
|
GITEA_URL="https://gitea.weiker.me"
|
|
REPO="rodin/review-bot"
|
|
|
|
# Create release (or find existing one for this tag)
|
|
HTTP_CODE=$(curl -s -o /tmp/release_response.json -w "%{http_code}" -X POST \
|
|
-H "Authorization: token ${GITEA_TOKEN}" \
|
|
-H "Content-Type: application/json" \
|
|
"${GITEA_URL}/api/v1/repos/${REPO}/releases" \
|
|
-d "{\"tag_name\": \"${VERSION}\", \"name\": \"${VERSION}\", \"body\": \"Release ${VERSION}\", \"draft\": false, \"prerelease\": false}")
|
|
|
|
if [ "$HTTP_CODE" = "409" ]; then
|
|
echo "Release for ${VERSION} already exists, fetching existing..."
|
|
curl -sSf -o /tmp/release_response.json \
|
|
-H "Authorization: token ${GITEA_TOKEN}" \
|
|
"${GITEA_URL}/api/v1/repos/${REPO}/releases/tags/${VERSION}"
|
|
elif [ "$HTTP_CODE" != "201" ]; then
|
|
echo "Failed to create release (HTTP ${HTTP_CODE})" >&2
|
|
cat /tmp/release_response.json >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Parse release ID (python3 available on ubuntu-24.04 runners)
|
|
RELEASE_ID=$(python3 -c "import json; print(json.load(open('/tmp/release_response.json'))['id'])")
|
|
|
|
if [ -z "$RELEASE_ID" ]; then
|
|
echo "Failed to parse release ID" >&2
|
|
cat /tmp/release_response.json >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "Release ID: ${RELEASE_ID}"
|
|
|
|
# Upload each asset (idempotent: delete existing asset with same name first)
|
|
for file in dist/*; do
|
|
filename=$(basename "$file")
|
|
echo "Uploading ${filename}..."
|
|
|
|
# Check if asset already exists and delete it
|
|
EXISTING_ID=$(export ASSET_NAME="${filename}"; curl -sS \
|
|
-H "Authorization: token ${GITEA_TOKEN}" \
|
|
"${GITEA_URL}/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets" \
|
|
| python3 -c "import json,sys,os; name=os.environ['ASSET_NAME']; assets=json.load(sys.stdin); print(next((str(a['id']) for a in assets if a['name']==name),''))" 2>/dev/null)
|
|
|
|
if [ -n "$EXISTING_ID" ]; then
|
|
echo " Asset ${filename} already exists (id=${EXISTING_ID}), deleting..."
|
|
curl -sSf -X DELETE \
|
|
-H "Authorization: token ${GITEA_TOKEN}" \
|
|
"${GITEA_URL}/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets/${EXISTING_ID}"
|
|
fi
|
|
|
|
curl -sSf -X POST \
|
|
-H "Authorization: token ${GITEA_TOKEN}" \
|
|
-H "Content-Type: application/octet-stream" \
|
|
"${GITEA_URL}/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets?name=$(printf '%s' "${filename}" | jq -sRr @uri)" \
|
|
--data-binary "@${file}"
|
|
done
|
|
|
|
echo "Release ${VERSION} created with assets"
|