From bcc3e04eeff461ab1b090902ece6006905c574ed Mon Sep 17 00:00:00 2001 From: Jon Langevin Date: Sun, 24 May 2026 02:16:25 -0400 Subject: [PATCH] ci: wire wfctl plugin verify-capabilities + bump wfctl pin to v0.63.1 (workflow#765) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Layer 3b extension from workflow#765 sweep. Adds post-goreleaser `wfctl plugin verify-capabilities` step to release.yml; bumps Install wfctl pin v0.62.0 → v0.63.1 (carries the new subcommand). jq filter selects this plugin's linux/ binary from `dist/artifacts.json`; skip-with-warning if no match. Closes the runtime truth-loop on releases: validate-contract (static) + verify-capabilities (runtime) confirm both the source-tree shape AND the actual built binary's GetManifest match plugin.json. --- .github/workflows/release.yml | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 65614f7..a9da5dc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -22,12 +22,12 @@ jobs: run: | git config --global url."https://x-access-token:${RELEASES_TOKEN}@github.com/GoCodeAlone/".insteadOf "https://github.com/GoCodeAlone/" go env -w GOPRIVATE=github.com/GoCodeAlone/* - - name: Install wfctl v0.62.0 + - name: Install wfctl v0.63.1 run: | mkdir -p "${RUNNER_TEMP}/wfctl-bin" curl -sSfL -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \ -o "${RUNNER_TEMP}/wfctl-bin/wfctl" \ - "https://github.com/GoCodeAlone/workflow/releases/download/v0.62.0/wfctl-linux-amd64" + "https://github.com/GoCodeAlone/workflow/releases/download/v0.63.1/wfctl-linux-amd64" chmod +x "${RUNNER_TEMP}/wfctl-bin/wfctl" - name: Validate plugin contract for publish (pre-build) run: "${{ runner.temp }}/wfctl-bin/wfctl plugin validate-contract --for-publish --tag ${{ github.ref_name }} ." @@ -50,6 +50,19 @@ jobs: && !contains(github.ref_name, '-') && github.repository == 'GoCodeAlone/workflow-plugin-compute' steps: + # workflow#765: runtime truth-check via plugin verify-capabilities. + - name: Verify capabilities (runtime truth-check) + run: | + RUNNER_ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') + BIN=$(jq -r --arg arch "$RUNNER_ARCH" \ + '[.[] | select(.type=="Binary" and .goos=="linux" and .goarch==$arch and (.name|startswith("workflow-plugin-compute")))] | .[0].path // ""' \ + dist/artifacts.json) + if [ -z "$BIN" ] || [ "$BIN" = "null" ]; then + echo "::warning::No matching linux/$RUNNER_ARCH binary in dist/artifacts.json; skipping verify-capabilities" + jq '.[] | {name, type, goos, goarch, path}' dist/artifacts.json + exit 0 + fi + "${{ runner.temp }}/wfctl-bin/wfctl" plugin verify-capabilities --binary "$BIN" . - name: Trigger registry manifest sync uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4 with: