Fix release pipeline warnings and add SLSA verification#293
Merged
Conversation
config.w32 already emits MSVC-correct /libpath: and /I flags via CHECK_LIB() and CHECK_HEADER_ADD_INCLUDE(). The Unix-style -L flag is rejected by link.exe (LNK4044 warning), and -I is redundantly tolerated by cl.exe. --with-firebird=FIREBIRD_HOME drives all path resolution; these env vars were pure dead weight.
Add missing .md5 files to softprops upload patterns (were generated and copied to release-assets/ but never uploaded). Remove per-platform CHECKSUMS-SHA256.txt uploads from Linux and macOS workflows. publish-release.yml already generates consolidated CHECKSUMS-SHA256.txt and CHECKSUMS-MD5.txt covering all artifacts (.tar.gz and .zip). This also avoids the softprops #767 same-filename collision when both workflows upload concurrently.
v6.0.0 still defaulted to Node.js 20 runtime despite preliminary Node 24 support. v7.0.0 runs on Node.js 24 by default, resolving the Node.js 20 deprecation warning. No breaking changes (unlike v8.0.0 which has ESM migration and hash-mismatch-error defaults). Affects 5 occurrences across 3 release workflows.
Verifies all release artifacts (.tar.gz, .zip) have valid SLSA provenance attestations before publishing the release. Uses gh attestation verify with --signer-workflow for stronger provenance (validates certificate SAN against our workflow path). Fails fast if any artifact lacks a valid attestation, keeping the release in draft state. Satisfies spec-v10.4-supply-chain.md acceptance criteria (line 24, 94).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes 4 issues found during the v11.0.2-rc.1 E2E release test.
Changes
1. Remove Unix-style CFLAGS/LDFLAGS from Windows build (LNK4044)
release-windows.yml: RemovedCFLAGS=-I...andLDFLAGS=-L...env vars.PHP's
config.w32already emits MSVC-correct/libpath:and/Iflagsvia
CHECK_LIB()andCHECK_HEADER_ADD_INCLUDE(). The Unix-Lflagwas rejected by
link.exe(LNK4044 warning).2. Upload missing .md5 checksums, remove per-platform CHECKSUMS
release-linux.yml+release-macos.yml: Added*.md5to softprops uploadpatterns (were generated but never uploaded). Removed per-platform
CHECKSUMS-SHA256.txtuploads —publish-release.ymlalready generatesconsolidated checksums covering all artifacts. Also avoids softprops #767
same-filename collision.
3. Bump actions/download-artifact v6 to v7 (Node.js 24)
v6.0.0 still defaulted to Node.js 20 despite preliminary Node 24 support.
v7.0.0 runs on Node.js 24 by default. No breaking changes (unlike v8.0.0
which has ESM + hash-mismatch-error defaults). 5 occurrences across 3 files.
4. Add SLSA attestation verification step
publish-release.yml: Addedgh attestation verifystep between attestationgeneration and release publishing. Uses
--signer-workflowfor strongerprovenance. Fails fast if any artifact lacks valid attestation, keeping
release in draft state. Satisfies
spec-v10.4-supply-chain.mdacceptancecriteria.
Testing
v11.0.2-rc.2tag