Set v0.1.0-pf-core release SHA to 5ddb36e in release docs. #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PF-Core Release Gate | |
| on: | |
| workflow_dispatch: | |
| push: | |
| tags: ["v*"] | |
| jobs: | |
| certifyedge-release-gate: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install pcs-core | |
| run: | | |
| cd python | |
| pip install -e . | |
| - name: CertifyEdge live attestation (required on release) | |
| env: | |
| PF_CORE_CERTIFYEDGE_CLI: ${{ secrets.PF_CORE_CERTIFYEDGE_CLI }} | |
| PF_CORE_CERTIFYEDGE_REQUIRE_LIVE: "1" | |
| run: | | |
| cd python | |
| CLI="${PF_CORE_CERTIFYEDGE_CLI:-}" | |
| if [ -n "${CLI}" ] && [ -f "${CLI}" ]; then | |
| echo "Using PF_CORE_CERTIFYEDGE_CLI=${CLI}" | |
| elif command -v certifyedge >/dev/null 2>&1; then | |
| CLI="$(command -v certifyedge)" | |
| echo "Using certifyedge on PATH: ${CLI}" | |
| else | |
| echo "FAIL: release gate requires live CertifyEdge CLI (PF_CORE_CERTIFYEDGE_CLI secret or certifyedge on PATH)." | |
| echo "Format stub and mock attestation are rejected on the release path." | |
| echo "See docs/pf-core/certifyedge-ci.md" | |
| exit 1 | |
| fi | |
| export PF_CORE_CERTIFYEDGE_CLI="${CLI}" | |
| export PF_CORE_CERTIFYEDGE_MODE=live | |
| certifyedge --version || "${CLI}" --version || true | |
| pcs pf-core certifyedge-check \ | |
| --require-live \ | |
| --trace ../examples/pf-core-valid/labtrust_replay/trace.json \ | |
| --property qc_release.temporal.safety \ | |
| --out /tmp/PFCoreCertificate.certifyedge.release.json | |
| test -f /tmp/PFCoreCertificate.certifyedge.release.json | |
| pcs validate /tmp/PFCoreCertificate.certifyedge.release.json | |
| python3 - <<'PY' | |
| import json | |
| import os | |
| import sys | |
| cert = json.load(open("/tmp/PFCoreCertificate.certifyedge.release.json", encoding="utf-8")) | |
| attestation = None | |
| for item in cert.get("obligations") or []: | |
| if isinstance(item, dict) and item.get("proof_ref"): | |
| attestation = str(item["proof_ref"]) | |
| break | |
| if not attestation: | |
| print("FAIL: release certificate missing attestation_ref/proof_ref") | |
| sys.exit(1) | |
| allow_stub = os.environ.get("PF_CORE_CERTIFYEDGE_ALLOW_STUB", "").strip().lower() in { | |
| "1", | |
| "true", | |
| "yes", | |
| } | |
| if attestation.startswith("mock://"): | |
| print(f"FAIL: mock attestation rejected on release path: {attestation}") | |
| sys.exit(1) | |
| if attestation.startswith("stub://") and not allow_stub: | |
| print(f"FAIL: stub attestation rejected on release path: {attestation}") | |
| print("Set PF_CORE_CERTIFYEDGE_ALLOW_STUB=1 only for documented staging exceptions.") | |
| sys.exit(1) | |
| if not cert.get("checker") or not cert.get("checker_version"): | |
| print("FAIL: release certificate missing checker metadata") | |
| sys.exit(1) | |
| print(f"OK CertifyEdge live attestation: {attestation}") | |
| PY | |
| - name: Reject mock-only CertifyEdge on release tags | |
| run: | | |
| cd python | |
| export PF_CORE_CERTIFYEDGE_MODE=mock | |
| if pcs pf-core certifyedge-check \ | |
| --trace ../examples/pf-core-valid/certifyedge_mock/trace.json \ | |
| --property qc_release.temporal.safety \ | |
| --out /tmp/PFCoreCertificate.certifyedge.mock.json; then | |
| attestation="$(python3 -c 'import json; c=json.load(open("/tmp/PFCoreCertificate.certifyedge.mock.json")); print(next((str(i.get("proof_ref") or "") for i in c.get("obligations") or [] if isinstance(i, dict)), ""))')" | |
| if echo "${attestation}" | grep -q '^mock://'; then | |
| echo "OK mock path remains available for dev but is not accepted as release attestation" | |
| exit 0 | |
| fi | |
| fi | |
| echo "WARN: mock CertifyEdge path did not produce expected mock:// attestation" |