fix(arcup): guard curl 8.14.x retry/exit-code bug in download paths #7
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SECURITY: This workflow uses pull_request_target. Do NOT add actions/checkout | |
| # with a PR-controlled ref: that would execute attacker code with write access | |
| # to secrets. Only read pull_request metadata. | |
| name: PR | |
| on: | |
| pull_request_target: | |
| types: | |
| - opened | |
| - reopened | |
| - edited | |
| - synchronize | |
| jobs: | |
| lint: | |
| name: Check PR title | |
| if: github.repository == 'circlefin/arc-node' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| pull-requests: read | |
| steps: | |
| - uses: step-security/action-semantic-pull-request@9142b539761b0ed6761de569f3a5020a7462a7f3 # v5.5.6 | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| with: | |
| types: | | |
| feat | |
| fix | |
| chore | |
| refactor | |
| doc | |
| docs | |
| test | |
| deps | |
| ci | |
| build | |
| perf | |
| style | |
| revert | |
| verify-signatures: | |
| name: Verify commit signatures | |
| if: github.repository == 'circlefin/arc-node' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - name: Check signatures and cleanup comments | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| with: | |
| script: | | |
| // 1. Fetch all commits in the PR (handling pagination) | |
| const commits = await github.paginate(github.rest.pulls.listCommits, { | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| pull_number: context.issue.number, | |
| }); | |
| const unsigned = commits | |
| .filter(c => !c.commit.verification.verified) | |
| .map(c => `- \`${c.sha.substring(0, 7)}\` by **${c.commit.author.name}**`); | |
| // 2. Find and delete previous bot comments to avoid spam | |
| const { data: comments } = await github.rest.issues.listComments({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: context.issue.number, | |
| }); | |
| const botCommentIdentifier = "### ⚠️ Unsigned Commits Detected"; | |
| const previousComments = comments.filter(c => c.body.includes(botCommentIdentifier)); | |
| for (const comment of previousComments) { | |
| await github.rest.issues.deleteComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| comment_id: comment.id, | |
| }); | |
| } | |
| // 3. Post new comment if unsigned commits exist | |
| if (unsigned.length > 0) { | |
| const body = `${botCommentIdentifier}\n\n` + | |
| `The following commits are missing a verified signature:\n\n` + | |
| unsigned.join('\n') + | |
| `\n\n**How to fix:** [Sign your commits](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits).`; | |
| await github.rest.issues.createComment({ | |
| issue_number: context.issue.number, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| body: body | |
| }); | |
| core.setFailed("Unsigned commits detected."); | |
| } |