From e77a34872875bd231c66a5a9c8e6f35934e6a162 Mon Sep 17 00:00:00 2001 From: Jon Langevin Date: Sun, 24 May 2026 02:15:53 -0400 Subject: [PATCH] ci: wire wfctl plugin verify-capabilities + bump wfctl pin to v0.63.1 (workflow#765) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Layer 3b extension from workflow#765 sweep. Adds post-goreleaser `wfctl plugin verify-capabilities` step to release.yml; bumps Install wfctl pin v0.62.0 → v0.63.1 (carries the new subcommand). jq filter selects this plugin's linux/ binary from `dist/artifacts.json`; skip-with-warning if no match. Closes the runtime truth-loop on releases: validate-contract (static) + verify-capabilities (runtime) confirm both the source-tree shape AND the actual built binary's GetManifest match plugin.json. --- .github/workflows/release.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d2ac178..14aeaad 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -39,6 +39,19 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # workflow#765: runtime truth-check via plugin verify-capabilities. + - name: Verify capabilities (runtime truth-check) + run: | + RUNNER_ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') + BIN=$(jq -r --arg arch "$RUNNER_ARCH" \ + '[.[] | select(.type=="Binary" and .goos=="linux" and .goarch==$arch and (.name|startswith("workflow-plugin-aws")))] | .[0].path // ""' \ + dist/artifacts.json) + if [ -z "$BIN" ] || [ "$BIN" = "null" ]; then + echo "::warning::No matching linux/$RUNNER_ARCH binary in dist/artifacts.json; skipping verify-capabilities" + jq '.[] | {name, type, goos, goarch, path}' dist/artifacts.json + exit 0 + fi + "${{ runner.temp }}/wfctl-bin/wfctl" plugin verify-capabilities --binary "$BIN" . - name: Verify shipped plugin.json carries tag (post-build) run: | if [ -f .release/plugin.json ]; then