ERP-Team/kaidi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 35 Wiki Activity

feat: add verified clean reinstall workflow
Release / release (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
Qiufeng
2026-08-18 01:13:05 +08:00
parent 2c73ad7eb0
commit fa4517c263
10 changed files with 374 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/package-release.sh
+10 -3
View File
@@ -143,8 +143,10 @@ else
fi
install -m 0755 "$ROOT/deploy/install.sh" "$OUTPUT_DIR/install.sh"
install -m 0755 "$ROOT/deploy/purge.sh" "$OUTPUT_DIR/purge.sh"
PUBLIC_KEY_SHA256=$(sha256_file "$OUTPUT_DIR/release-public.pem")
INSTALLER_SHA256=$(sha256_file "$OUTPUT_DIR/install.sh")
PURGER_SHA256=$(sha256_file "$OUTPUT_DIR/purge.sh")
if [ -n "$TRUSTED_PUBLIC_KEY_SHA256" ]; then
NORMALIZED_TRUSTED_PUBLIC_KEY_SHA256=$(printf '%s' "$TRUSTED_PUBLIC_KEY_SHA256" | tr '[:upper:]' '[:lower:]')
[[ "$NORMALIZED_TRUSTED_PUBLIC_KEY_SHA256" =~ ^[0-9a-f]{64}$ ]] \
@@ -158,6 +160,7 @@ fi
cat > "$OUTPUT_DIR/bootstrap-checksums.txt" <<EOF
KAIDI_RELEASE_PUBLIC_KEY_SHA256=$PUBLIC_KEY_SHA256
KAIDI_INSTALLER_SHA256=$INSTALLER_SHA256
KAIDI_PURGER_SHA256=$PURGER_SHA256
EOF
BOOTSTRAP_SHA256=$(sha256_file "$OUTPUT_DIR/bootstrap-checksums.txt")
@@ -165,7 +168,8 @@ RELEASE_NOTES_VALUE=${KAIDI_RELEASE_NOTES:-"Kaidi Finance Preview $VERSION"}
VERSION="$VERSION" ARTIFACT="$ARTIFACT" SHA256="$SHA256" RELEASE_NOTES="$RELEASE_NOTES_VALUE" \
BACKEND_SBOM_SHA256="$BACKEND_SBOM_SHA256" FRONTEND_SBOM_SHA256="$FRONTEND_SBOM_SHA256" \
BACKEND_BUILD_VERSION="$BACKEND_BUILD_VERSION" FRONTEND_BUILD_VERSION="$FRONTEND_BUILD_VERSION" \
INSTALLER_SHA256="$INSTALLER_SHA256" PUBLIC_KEY_SHA256="$PUBLIC_KEY_SHA256" \
INSTALLER_SHA256="$INSTALLER_SHA256" PURGER_SHA256="$PURGER_SHA256" \
PUBLIC_KEY_SHA256="$PUBLIC_KEY_SHA256" \
BOOTSTRAP_SHA256="$BOOTSTRAP_SHA256" SOURCE_REVISION="$SOURCE_REVISION" SOURCE_REF="$SOURCE_REF" \
SOURCE_DIRTY="$SOURCE_DIRTY" \
node <<'NODE' > "$OUTPUT_DIR/release-manifest.json"
@@ -192,6 +196,8 @@ const manifest = {
bootstrap: {
installer: 'install.sh',
installerSha256: process.env.INSTALLER_SHA256,
purger: 'purge.sh',
purgerSha256: process.env.PURGER_SHA256,
publicKey: 'release-public.pem',
publicKeySha256: process.env.PUBLIC_KEY_SHA256,
checksums: 'bootstrap-checksums.txt',
@@ -211,14 +217,15 @@ fi
cd "$OUTPUT_DIR"
if command -v sha256sum >/dev/null 2>&1; then
sha256sum "$ARTIFACT" backend-sbom.cdx.json frontend-sbom.cdx.json \
release-manifest.json release-manifest.sig release-public.pem install.sh \
release-manifest.json release-manifest.sig release-public.pem install.sh purge.sh \
bootstrap-checksums.txt > SHA256SUMS
else
shasum -a 256 "$ARTIFACT" backend-sbom.cdx.json frontend-sbom.cdx.json \
release-manifest.json release-manifest.sig release-public.pem install.sh \
release-manifest.json release-manifest.sig release-public.pem install.sh purge.sh \
bootstrap-checksums.txt > SHA256SUMS
fi
)
printf 'Release assets created in %s\n' "$OUTPUT_DIR"
printf 'Trusted release public-key SHA-256: %s\n' "$PUBLIC_KEY_SHA256"
printf 'Installer SHA-256: %s\n' "$INSTALLER_SHA256"
printf 'Purger SHA-256: %s\n' "$PURGER_SHA256"