From b2c6d093b2900b1a34036824a3e86565b5c7a21d Mon Sep 17 00:00:00 2001 From: Tingluo Huang Date: Mon, 14 Mar 2022 09:21:13 -0400 Subject: [PATCH] Validate packages hash before uploading to github release in CD workflow. (#1745) --- .github/workflows/release.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index dd4db371a..677c6bf2a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -260,6 +260,17 @@ jobs: console.log(releaseNote) core.setOutput('version', runnerVersion); core.setOutput('note', releaseNote); + + - name: Validate Packages HASH + working-directory: _package + run: | + ls -l + echo "${{needs.build.outputs.win-x64-sha}} actions-runner-win-x64-${{ steps.releaseNote.outputs.version }}.zip" | shasum -a 256 -c + echo "${{needs.build.outputs.osx-x64-sha}} actions-runner-osx-x64-${{ steps.releaseNote.outputs.version }}.tar.gz" | shasum -a 256 -c + echo "${{needs.build.outputs.linux-x64-sha}} actions-runner-linux-x64-${{ steps.releaseNote.outputs.version }}.tar.gz" | shasum -a 256 -c + echo "${{needs.build.outputs.linux-arm-sha}} actions-runner-linux-arm-${{ steps.releaseNote.outputs.version }}.tar.gz" | shasum -a 256 -c + echo "${{needs.build.outputs.linux-arm64-sha}} actions-runner-linux-arm64-${{ steps.releaseNote.outputs.version }}.tar.gz" | shasum -a 256 -c + # Create GitHub release - uses: actions/create-release@master id: createRelease