Modify release workflow to allow immutable releases #410
+105
−10
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Instead of creating the release by hand and then having a workflow triggered to add the release, which is not possible if immutable releases are enabled, we will now: - run the release workflow on "tag" instead of "release" - the workflow creates a DRAFT release based on the tag that triggered - the workflow then attaches the PHAR to the release - maintainer must then review the release, ensure it is correct, then publish Once the release is published (assuming immutable releases are enabled): - the tag is immutable - the attached assets on the release are immutable - the flag that dictates pre-release/latest release status is immutable - the release changelog may still be changed - the release title may still be changed - a release attestation is added to the release which can be verified The release can be verified with: ```shell gh release verify <release-tag> ``` A given `pie.phar` on your machine can be verified as the release asset with: ```shell gh release verify-asset <release-tag> pie.phar ``` For more documentation, see: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases
asgrim
added
documentation
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #411
Instead of creating the release by hand and then having a workflow triggered to add the release, which is not possible if immutable releases are enabled, we will now:
Once the release is published (assuming immutable releases are enabled):
The release can be verified with:
A given
pie.pharon your machine can be verified as the release asset with:For more documentation, see:
https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases