fix(release): restore win32-x64 binary (Socket Firewall breaks pnpm i… #16
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| # SECURITY: Limit permissions at workflow level | |
| permissions: | |
| contents: read | |
| jobs: | |
| # ========================================== | |
| # Job 1: Security Audit (gates all other jobs) | |
| # ========================================== | |
| security-audit: | |
| name: Security Audit | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Verify tag is on main | |
| shell: bash | |
| run: | | |
| git fetch origin main | |
| if ! git merge-base --is-ancestor "${{ github.sha }}" origin/main; then | |
| echo "::error::Tagged commit is not on main branch — aborting release" | |
| exit 1 | |
| fi | |
| - name: Setup Node.js | |
| uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 | |
| with: | |
| node-version: "24" | |
| package-manager-cache: false | |
| - name: Install pnpm | |
| shell: bash | |
| run: | | |
| npm install -g corepack@0.35.0 --force | |
| corepack enable | |
| corepack prepare pnpm@10.33.1 --activate | |
| - name: Set up Socket Firewall | |
| uses: socketdev/action@937f824ec476dfd164d4a4d9995751427b0be143 # v1 | |
| with: | |
| mode: firewall | |
| env: | |
| SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }} | |
| - name: Install dependencies | |
| run: sfw pnpm install --frozen-lockfile | |
| - name: Security audit | |
| run: pnpm audit --audit-level=critical | |
| # ========================================== | |
| # Job 2: Publish to NPM | |
| # ========================================== | |
| publish: | |
| name: Publish to NPM | |
| needs: security-audit | |
| runs-on: ubuntu-latest | |
| environment: production | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Verify tag is on main | |
| shell: bash | |
| run: | | |
| git fetch origin main | |
| if ! git merge-base --is-ancestor "${{ github.sha }}" origin/main; then | |
| echo "::error::Tagged commit is not on main branch — aborting publish" | |
| exit 1 | |
| fi | |
| - name: Setup Node.js | |
| uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 | |
| with: | |
| node-version: "24" | |
| registry-url: "https://registry.npmjs.org" | |
| package-manager-cache: false | |
| - name: Install pnpm | |
| shell: bash | |
| run: | | |
| npm install -g corepack@0.35.0 --force | |
| corepack enable | |
| corepack prepare pnpm@10.33.1 --activate | |
| - name: Update npm | |
| run: npm install -g npm@11.15.0 | |
| - name: Set up Socket Firewall | |
| uses: socketdev/action@937f824ec476dfd164d4a4d9995751427b0be143 # v1 | |
| with: | |
| mode: firewall | |
| env: | |
| SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }} | |
| - name: Install dependencies | |
| run: sfw pnpm install --frozen-lockfile | |
| - name: Run tests | |
| run: pnpm test | |
| - name: Build package | |
| run: pnpm run build | |
| - name: Publish to NPM | |
| run: pnpm publish --access public --no-git-checks | |
| env: | |
| NPM_CONFIG_PROVENANCE: "true" | |
| # ========================================== | |
| # Job 3: Build binaries for all platforms | |
| # ========================================== | |
| build-binaries: | |
| name: Build Binary (${{ matrix.platform }}-${{ matrix.arch }}) | |
| needs: security-audit | |
| runs-on: ${{ matrix.os }} | |
| permissions: | |
| contents: read | |
| attestations: write | |
| id-token: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - os: ubuntu-latest | |
| platform: linux | |
| arch: x64 | |
| - os: macos-latest | |
| platform: darwin | |
| arch: arm64 | |
| - os: macos-latest | |
| platform: darwin | |
| arch: x64 | |
| node_arch: x64 | |
| - os: windows-latest | |
| platform: win32 | |
| arch: x64 | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Verify tag is on main | |
| shell: bash | |
| run: | | |
| git fetch origin main | |
| if ! git merge-base --is-ancestor "${{ github.sha }}" origin/main; then | |
| echo "::error::Tagged commit is not on main branch — aborting build" | |
| exit 1 | |
| fi | |
| - name: Setup Node.js | |
| if: ${{ !matrix.node_arch }} | |
| uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 | |
| with: | |
| node-version: "24" | |
| package-manager-cache: false | |
| - name: Setup Node.js (x64 via Rosetta) | |
| if: ${{ matrix.node_arch }} | |
| uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 | |
| with: | |
| node-version: "24" | |
| architecture: ${{ matrix.node_arch }} | |
| package-manager-cache: false | |
| - name: Install pnpm | |
| shell: bash | |
| run: | | |
| npm install -g corepack@0.35.0 --force | |
| corepack enable | |
| corepack prepare pnpm@10.33.1 --activate | |
| - name: Set up Socket Firewall | |
| uses: socketdev/action@937f824ec476dfd164d4a4d9995751427b0be143 # v1 | |
| with: | |
| mode: firewall | |
| env: | |
| SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }} | |
| - name: Install dependencies (Unix — Socket Firewall) | |
| if: matrix.platform != 'win32' | |
| run: sfw pnpm install --frozen-lockfile | |
| - name: Install dependencies (Windows — sfw breaks pnpm install on win32) | |
| if: matrix.platform == 'win32' | |
| run: pnpm install --frozen-lockfile | |
| - name: Build TypeScript | |
| run: pnpm build | |
| - name: Bundle CLI for SEA | |
| run: pnpm build:cli:bundle | |
| - name: Prepare SEA blob | |
| run: pnpm build:sea:prepare | |
| - name: Build binary | |
| run: pnpm build:sea | |
| - name: Rename binary (Windows) | |
| if: matrix.platform == 'win32' | |
| shell: bash | |
| run: mv shield.exe shield-windows-${{ matrix.arch }}.exe | |
| - name: Generate checksum (Unix) | |
| if: matrix.platform != 'win32' | |
| run: | | |
| shasum -a 256 shield-${{ matrix.platform }}-${{ matrix.arch }} > shield-${{ matrix.platform }}-${{ matrix.arch }}.sha256 | |
| cat shield-${{ matrix.platform }}-${{ matrix.arch }}.sha256 | |
| - name: Generate checksum (Windows) | |
| if: matrix.platform == 'win32' | |
| shell: pwsh | |
| run: | | |
| $hash = Get-FileHash -Algorithm SHA256 shield-windows-${{ matrix.arch }}.exe | |
| "$($hash.Hash.ToLower()) shield-windows-${{ matrix.arch }}.exe" | Out-File -Encoding utf8 shield-windows-${{ matrix.arch }}.exe.sha256 | |
| Get-Content shield-windows-${{ matrix.arch }}.exe.sha256 | |
| - name: Generate artifact attestation | |
| uses: actions/attest-build-provenance@e4d4f7c39adfa4c260fb5c147f0622000aa14b99 | |
| with: | |
| subject-path: "shield-*" | |
| - name: Upload artifacts | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f | |
| with: | |
| name: binary-${{ matrix.platform }}-${{ matrix.arch }} | |
| path: | | |
| shield-${{ matrix.platform == 'win32' && 'windows' || matrix.platform }}-${{ matrix.arch }}${{ matrix.platform == 'win32' && '.exe' || '' }} | |
| shield-${{ matrix.platform == 'win32' && 'windows' || matrix.platform }}-${{ matrix.arch }}${{ matrix.platform == 'win32' && '.exe' || '' }}.sha256 | |
| # ========================================== | |
| # Job 4: Create GitHub Release with all binaries | |
| # ========================================== | |
| create-release: | |
| name: Create GitHub Release | |
| needs: build-binaries | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1 | |
| with: | |
| egress-policy: audit | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 | |
| with: | |
| pattern: binary-* | |
| merge-multiple: true | |
| - name: List release files | |
| run: ls -la shield-* | |
| - name: Create Release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh release create "${GITHUB_REF_NAME}" shield-* \ | |
| --repo "${GITHUB_REPOSITORY}" \ | |
| --title "${GITHUB_REF_NAME}" \ | |
| --generate-notes |