mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-11-07 05:03:00 -05:00
Nic Boet
cb176ceffc
release-source-tarball pasted ${{ inputs.tag }},
${{ github.event.release.tag_name }} and the step outputs derived from
them straight into the run: scripts. GitHub substitutes expressions
into the script text before bash parses it, so a tag containing shell
syntax ran as code in a job with contents: write. Only people who can
publish a release or dispatch the workflow can set the tag, so this is
hardening, not an exposure.
Pass each value through env: and read it as a shell variable, as
GitHub's security hardening guide recommends. Normal tags produce the
same outputs and tarball name as before; the `with:` inputs are not
shell and are unchanged.
85 lines
3.1 KiB
YAML
85 lines
3.1 KiB
YAML
name: release-source-tarball
|
|
|
|
# GitHub's auto-generated "Source code" release assets are plain `git archive`
|
|
# output and do not contain submodules, so they cannot be built (see #3781,
|
|
# #4725). This workflow attaches a complete source tarball, submodules
|
|
# included, to every release. It can also be dispatched manually to backfill
|
|
# the asset onto an existing release tag.
|
|
|
|
on:
|
|
release:
|
|
types: [published]
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: 'Existing release tag to build and attach the tarball to'
|
|
required: true
|
|
type: string
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
tarball:
|
|
name: Build full source tarball
|
|
if: github.repository == 'ZoneMinder/zoneminder' || github.event_name == 'workflow_dispatch'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Determine release tag
|
|
id: tag
|
|
# Expressions go through env: so the shell sees them as data; inline
|
|
# ${{ }} in run: is pasted into the script before the shell parses it.
|
|
env:
|
|
DISPATCH_TAG: ${{ inputs.tag }}
|
|
RELEASE_TAG: ${{ github.event.release.tag_name }}
|
|
run: |
|
|
if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then
|
|
echo "tag=${DISPATCH_TAG}" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "tag=${RELEASE_TAG}" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
ref: ${{ steps.tag.outputs.tag }}
|
|
submodules: recursive
|
|
|
|
- name: Create tarball
|
|
id: tarball
|
|
env:
|
|
TAG: ${{ steps.tag.outputs.tag }}
|
|
run: |
|
|
set -eux
|
|
TARBALL="zoneminder-${TAG}.tar.gz"
|
|
# Reproducible: fixed mtime from the tagged commit, sorted entries,
|
|
# no owner info, no gzip timestamp. Re-running the workflow for the
|
|
# same tag produces byte-identical output.
|
|
COMMIT_TS="$(git log -1 --format=%ct)"
|
|
tar --exclude-vcs \
|
|
--sort=name \
|
|
--mtime="@${COMMIT_TS}" \
|
|
--owner=0 --group=0 --numeric-owner \
|
|
--transform "s,^\.,zoneminder-${TAG}," \
|
|
-cf - . | gzip -n > "../${TARBALL}"
|
|
mv "../${TARBALL}" .
|
|
sha256sum "${TARBALL}" > "${TARBALL}.sha256"
|
|
echo "tarball=${TARBALL}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Sanity check submodules are populated
|
|
env:
|
|
TARBALL: ${{ steps.tarball.outputs.tarball }}
|
|
run: |
|
|
set -eux
|
|
# The same file CMakeLists.txt checks before allowing a build
|
|
tar -tzf "${TARBALL}" | grep -q 'web/api/app/Plugin/Crud/Lib/CrudControllerTrait.php'
|
|
tar -tzf "${TARBALL}" | grep -q 'dep/RtspServer/CMakeLists.txt'
|
|
tar -tzf "${TARBALL}" | grep -q 'dep/CxxUrl/CMakeLists.txt'
|
|
|
|
- name: Attach to release
|
|
uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
|
|
with:
|
|
tag_name: ${{ steps.tag.outputs.tag }}
|
|
files: |
|
|
${{ steps.tarball.outputs.tarball }}
|
|
${{ steps.tarball.outputs.tarball }}.sha256
|