ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-28 13:26:04 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(release): trust remote tooling tag identity

Browse Source
This commit is contained in:
Vincent Koc
2026-08-21 01:54:19 -07:00
parent d84609f26d
commit ddf592bf8a
2 changed files with 10 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/release-plan-producer.mts
-3
View File
@@ -476,9 +476,6 @@ function resolveSource(params: ReleasePlanSource) {
if (params.intent !== "main-qualification" && verifiedTooling.route !== "protected-tag") {
throw new Error(`${params.intent} tooling must use a release-publish tag bound to its SHA`);
}
if (resolveCommit(repoRoot, toolingFullRef, "tooling full ref") !== toolingSha) {
throw new Error("tooling full ref does not resolve to the requested tooling SHA");
}
return { candidateSha, repoRoot, toolingFullRef, toolingSha };
}
test/scripts/release-plan-producer.test.ts
+10 -16
View File
@@ -189,9 +189,6 @@ function createFixtureRepo(
writeFixture(root, "package.json", JSON.stringify({ name: "openclaw", version: "2099.1.1" }));
const toolingSha = commit(root, "tooling");
const toolingFullRef = `refs/tags/release-publish/${toolingSha.slice(0, 12)}-1`;
execFileSync("git", ["tag", toolingFullRef.slice("refs/tags/".length), toolingSha], {
cwd: root,
});
return { candidateRef, candidateSha, root, toolingFullRef, toolingSha };
}
@@ -268,6 +265,12 @@ describe("release plan producer", () => {
{ cwd: fixture.root, stdio: "ignore" },
),
).toBeNull();
expect(() =>
execFileSync("git", ["cat-file", "-e", fixture.toolingFullRef], {
cwd: fixture.root,
stdio: "ignore",
}),
).toThrow();
const plan = produceReleasePlan(sourceParams(fixture));
expect(plan).toMatchObject({
@@ -328,20 +331,14 @@ describe("release plan producer", () => {
expect(() =>
produceReleasePlan({ ...sourceParams(fixture), candidateSha: "f".repeat(40) }),
).toThrow("candidate SHA does not resolve");
const mismatchedToolingRef = `refs/tags/release-publish/${fixture.candidateSha.slice(0, 12)}-9`;
execFileSync(
"git",
["tag", mismatchedToolingRef.slice("refs/tags/".length), fixture.toolingSha],
{ cwd: fixture.root },
);
expect(() =>
produceReleasePlan({
...sourceParams(fixture),
toolingSha: fixture.candidateSha,
toolingFullRef: mismatchedToolingRef,
runGh: trustedToolingGh(mismatchedToolingRef, fixture.candidateSha),
runGh: trustedToolingGh(fixture.toolingFullRef, fixture.candidateSha),
}),
).toThrow("tooling full ref does not resolve");
).toThrow(
"protected release tooling tag is missing, moved, annotated, or bound to the wrong SHA",
);
expect(() =>
produceReleasePlan({ ...sourceParams(fixture), candidateRef: "refs/heads/tooling" }),
).toThrow("candidate ref must be");
@@ -370,9 +367,6 @@ describe("release plan producer", () => {
writeFixture(fixture.root, "scripts/release-plan-producer.mts", "// placeholder producer\n");
const toolingSha = commit(fixture.root, "different producer");
const toolingFullRef = `refs/tags/release-publish/${toolingSha.slice(0, 12)}-2`;
execFileSync("git", ["tag", toolingFullRef.slice("refs/tags/".length), toolingSha], {
cwd: fixture.root,
});
expect(() =>
produceReleasePlan({