Jannik/PaperClipAI
1
0 Fork 0
mirror of https://github.com/paperclipai/paperclip.git synced 2026-10-15 20:53:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: pin ARM qualification helper to workflow source

Browse Source 
Keep frozen product and reusable workflow tooling identities separate. Preserve clean-consumer and package integrity checks.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
DottaandPaperclip committed 2026-10-12 13:26:56 -05:00
1 parent 0690801f13
commit a5b16834c8
3 files changed
+134 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/workflows/release-smoke.yml
+40 -1
View File
@@ -308,10 +308,49 @@ jobs:
path: ${{ runner.temp }}/public-runner-packs
- name: Install only the existing verifier tooling
run: pnpm install --ignore-scripts --no-frozen-lockfile
- name: Checkout immutable ARM qualification tooling
if: ${{ matrix.target == 'linux-arm64' }}
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
with:
# job.workflow_* identifies this reusable workflow, not its caller.
repository: ${{ job.workflow_repository }}
ref: ${{ job.workflow_sha }}
path: .qualification-tooling
sparse-checkout: scripts/prepare-linux-arm64-qualification.sh
sparse-checkout-cone-mode: false
persist-credentials: false
- name: Prepare Linux ARM sandbox prerequisites
if: ${{ matrix.target == 'linux-arm64' }}
timeout-minutes: 5
run: bash scripts/prepare-linux-arm64-qualification.sh
env:
SOURCE_SHA: ${{ inputs.qualification_source_sha }}
TOOLING_SHA: ${{ job.workflow_sha }}
TOOLING_REPOSITORY: ${{ job.workflow_repository }}
TOOLING_WORKFLOW_REF: ${{ job.workflow_ref }}
TOOLING_WORKFLOW_PATH: ${{ job.workflow_file_path }}
run: |
set -euo pipefail
[[ "$SOURCE_SHA" =~ ^[a-f0-9]{40}$ ]] || exit 1
[[ "$TOOLING_SHA" =~ ^[a-f0-9]{40}$ ]] || exit 1
[[ "$(git rev-parse HEAD)" == "$SOURCE_SHA" ]] || exit 1
[[ "$(git -C .qualification-tooling rev-parse HEAD)" == "$TOOLING_SHA" ]] || exit 1
node --input-type=module <<'NODE'
import { createHash } from 'node:crypto';
import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
import { join } from 'node:path';
const directory = join(process.env.RUNNER_TEMP, 'paperclip-arm-bwrap-prerequisite');
mkdirSync(directory, { recursive: true });
const helper = '.qualification-tooling/scripts/prepare-linux-arm64-qualification.sh';
writeFileSync(join(directory, 'qualification-identity.json'), JSON.stringify({
productSourceSha: process.env.SOURCE_SHA,
toolingSourceSha: process.env.TOOLING_SHA,
toolingRepository: process.env.TOOLING_REPOSITORY,
toolingWorkflowRef: process.env.TOOLING_WORKFLOW_REF,
toolingWorkflowPath: process.env.TOOLING_WORKFLOW_PATH,
helperSha256: createHash('sha256').update(readFileSync(helper)).digest('hex'),
}, null, 2) + '\n');
NODE
bash .qualification-tooling/scripts/prepare-linux-arm64-qualification.sh
- name: Verify host identity and actual clean npm consumer
env:
SOURCE_SHA: ${{ inputs.qualification_source_sha }}