dandri/MeshChatX
1
0
Fork 0
mirror of https://git.quad4.io/RNS-Things/MeshChatX.git synced 2026-04-27 04:15:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(ci): update release notes generation to include integrity information and SBOM details

Browse Source
This commit is contained in:
Ivan
2026-04-22 13:24:08 -05:00
parent fa1b57e349
commit 73dd7f42b1
1 changed files with 7 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/build.yml
+7 -21
View File
@@ -136,27 +136,13 @@ jobs:
sh scripts/ci/exec-priv.sh dpkg -i /tmp/trivy.deb || sh scripts/ci/exec-priv.sh apt-get install -f -y
trivy fs --format cyclonedx --include-dev-deps --output release-assets/sbom.cyclonedx.json .
# Generate checksums
cd release-assets
for file in *; do
if [ -f "$file" ] && [[ "$file" != *.sha256 ]]; then
sha256sum "$file" | tee "${file}.sha256"
fi
done
# Generate release notes (outside release-assets directory)
cd ..
echo "## SHA256 Checksums" > release-body.md
echo "" >> release-body.md
for file in release-assets/*; do
if [ -f "$file" ] && [[ "$file" != *.sha256 ]] && [[ "$file" != *.cosign.bundle ]] && [[ "$file" != *release-body.md* ]]; then
filename=$(basename "$file")
if [ -f "release-assets/${filename}.sha256" ]; then
# Extract just the filename and its sha256 (format: <sha256> <filename>)
echo "\`$(cat "release-assets/${filename}.sha256")\`" >> release-body.md
fi
fi
done
{
echo "## Integrity"
echo ""
echo "Each artifact may have a matching **\`*.cosign.bundle\`** (SLSA v1 provenance via cosign; see \`SECURITY.md\` for verification)."
echo ""
echo "SBOM: **\`sbom.cyclonedx.json\`** (CycloneDX)."
} > release-body.md
- name: SLSA attestations (cosign)
env: