Skip to content

ci: gate release publication on smoke tests #8955

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
atavism wants to merge 4 commits into
base: main
Choose a base branch
from
Open

ci: gate release publication on smoke tests #8955

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6048487
ci: gate nightly releases on smoke tests
atavism Jul 30, 2026
4a7b92b
Merge remote-tracking branch 'origin/main' into atavism/ci-updates
atavism Aug 4, 2026
6d3565b
code review updates
atavism Aug 5, 2026
a6b71cf
Merge remote-tracking branch 'origin/main' into atavism/ci-updates
atavism Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 21 additions & 21 deletions .github/workflows/build-linux.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -184,6 +184,27 @@ jobs:
run: |
./scripts/ci/verify_linux_package.sh "./${{ env.FULL_INSTALLER_NAME }}.deb" "${{ matrix.arch }}"

- name: Upload Linux RPM candidate
uses: actions/upload-artifact@v4
with:
name: lantern-installer-rpm-${{ matrix.arch }}
path: ${{ env.FULL_INSTALLER_NAME }}.rpm
retention-days: 2

- name: Upload Linux DEB candidate
uses: actions/upload-artifact@v4
with:
name: lantern-installer-deb-${{ matrix.arch }}
path: ${{ env.FULL_INSTALLER_NAME }}.deb
retention-days: 2

- name: Upload Linux Arch candidate
uses: actions/upload-artifact@v4
with:
name: lantern-installer-pkg-${{ matrix.arch }}
path: ${{ env.FULL_INSTALLER_NAME }}.pkg.tar.zst
retention-days: 2

- name: Install .deb and verify postinst started daemon
shell: bash
run: |
Expand Down Expand Up @@ -295,24 +316,3 @@ jobs:
if [[ "$AUTH_SMOKE_EXIT" -ne 0 ]]; then
exit "$AUTH_SMOKE_EXIT"
fi

- name: Upload Linux build
uses: actions/upload-artifact@v4
with:
name: lantern-installer-rpm-${{ matrix.arch }}
path: ${{ env.FULL_INSTALLER_NAME }}.rpm
retention-days: 2

- name: Upload Linux build
uses: actions/upload-artifact@v4
with:
name: lantern-installer-deb-${{ matrix.arch }}
path: ${{ env.FULL_INSTALLER_NAME }}.deb
retention-days: 2

- name: Upload Linux build (Arch)
uses: actions/upload-artifact@v4
with:
name: lantern-installer-pkg-${{ matrix.arch }}
path: ${{ env.FULL_INSTALLER_NAME }}.pkg.tar.zst
retention-days: 2
32 changes: 17 additions & 15 deletions .github/workflows/build-windows.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -287,6 +287,21 @@ jobs:

Move-Item "dist/$env:APP_VERSION/$env:APP_NAME-$env:APP_VERSION-windows-setup.exe" "$env:FULL_INSTALLER_NAME.exe"

- name: Sign installer
if: ${{ !inputs.skip_signing }}
shell: pwsh
env:
SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }}
FULL_INSTALLER_NAME: ${{ inputs.installer_base_name }}${{ inputs.build_type != 'production' && format('-{0}', inputs.build_type) || '' }}
run: |
./scripts/ci/sign-windows.ps1 `
-FilePath "$env:FULL_INSTALLER_NAME.exe" `
-SigningPolicy "${{ env.SIGNPATH_SIGNING_POLICY }}" `
-OrganizationId "${{ vars.SIGNPATH_ORG_ID }}" `
-ProjectSlug "${{ vars.SIGNPATH_PROJECT_SLUG }}" `
-ApiToken $env:SIGNPATH_API_TOKEN `
-Description "Installer - GitHub Actions build ${{ inputs.version }}"
Comment on lines +290 to +303

@coderabbitai coderabbitai Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

rg -n -C 8 'workflow_dispatch|workflow_call|inputs:|version:|SIGNPATH_' .github/workflows || true
rg -n -C 8 'sign-windows\.ps1|SIGNPATH_API_TOKEN' .github scripts || true

Repository: getlantern/lantern

Length of output: 50374

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "== build-windows workflow trigger/calls =="
sed -n '1,120p' .github/workflows/build-windows.yml

echo
echo "== build-windows release call and installer sign step =="
sed -n '330,405p' .github/workflows/release.yml
sed -n '286,305p' .github/workflows/build-windows.yml

echo
echo "== scripts/ci/sign-windows.ps1 outline and sign step =="
ast-grep outline scripts/ci/sign-windows.ps1 || true
sed -n '1,260p' scripts/ci/sign-windows.ps1

echo
echo "== workflow call inputs passed to build-windows from release.yml =="
rg -n -C 5 '\.github/workflows/build-windows\.yml|use: \.github/workflows/build-windows|inputs:|version:|installer_base_name:|skip_signing:|SIGNPATH' .github/workflows/release.yml .github/workflows/build-windows.yml .github/workflows/app-smoke-tests.yml

Repository: getlantern/lantern

Length of output: 38000

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "== release.yml set-metadata version/build_type logic =="
sed -n '120,200p' .github/workflows/release.yml

echo
echo "== release.yml build-windows call inputs =="
sed -n '486,507p' .github/workflows/release.yml

echo
echo "== all callers of build-windows with signing/signing-related inputs =="
rg -n -C 3 '\.github/workflows/build-windows\.yml|with:|skip_signing:|sign_windows:' .github/workflows/release.yml .github/workflows/app-smoke-tests.yml .github/workflows/build-windows.yml

echo
echo "== GitHub variable secrets declarations =="
rg -n 'SIGNPATH_ORG_ID|SIGNPATH_PROJECT_SLUG|SIGNPATH_SIGNING_POLICY_SLUG|SIGNPATH_API_TOKEN' .github/workflows/release.yml .github/workflows/build-windows.yml

Repository: getlantern/lantern

Length of output: 27220

Keep release values out of PowerShell source.

Interpolating release metadata directly into a PowerShell command risks syntax escaping or injection. Set per-step environment variables for the signing call values, then reference them as $env:... in the sign-windows.ps1 arguments.

🧰 Tools
🪛 zizmor (1.29.0)

[warning] 299-299: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[info] 300-300: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[info] 301-301: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[error] 303-303: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-windows.yml around lines 290 - 303, Update the “Sign
installer” step to expose the version, signing policy, organization ID, and
project slug through step-level environment variables, then pass those variables
via $env: references to sign-windows.ps1. Keep the existing FULL_INSTALLER_NAME
and API token handling unchanged, and remove direct GitHub expression
interpolation from the PowerShell command arguments.

Source: Linters/SAST tools


- name: Windows installer smoke suite
shell: pwsh
timeout-minutes: 30
Expand Down Expand Up @@ -320,24 +335,11 @@ jobs:
run: |
flutter test integration_test/auth/auth_smoke_test.dart -d windows --reporter=expanded --dart-define=DISABLE_SYSTEM_TRAY=true

- name: Sign installer
if: ${{ !inputs.skip_signing }}
shell: pwsh
env:
SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }}
FULL_INSTALLER_NAME: ${{ inputs.installer_base_name }}${{ inputs.build_type != 'production' && format('-{0}', inputs.build_type) || '' }}
run: |
./scripts/ci/sign-windows.ps1 `
-FilePath "$env:FULL_INSTALLER_NAME.exe" `
-SigningPolicy "${{ env.SIGNPATH_SIGNING_POLICY }}" `
-OrganizationId "${{ vars.SIGNPATH_ORG_ID }}" `
-ProjectSlug "${{ vars.SIGNPATH_PROJECT_SLUG }}" `
-ApiToken $env:SIGNPATH_API_TOKEN `
-Description "Installer - GitHub Actions build ${{ inputs.version }}"

- name: Upload Windows installer
if: ${{ always() }}
uses: actions/upload-artifact@v4
with:
name: lantern-installer-exe
path: ${{ inputs.installer_base_name }}${{ inputs.build_type != 'production' && format('-{0}', inputs.build_type) || '' }}.exe
if-no-files-found: warn
retention-days: 2
2 changes: 1 addition & 1 deletion .github/workflows/go.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ jobs:
run: go version

- name: Cache Go modules
uses: actions/cache@v3
uses: actions/cache@v4
with:
path: |
~/Library/Caches/go-build
Expand Down
Loading
Loading