build: stage deterministic updater package contract

2026-07-10 15:03:21 +02:00
parent 1fb62916bc
commit 33aaaaea1e
1 changed files with 74 additions and 0 deletions
@@ -0,0 +1,74 @@
+name: Patch Updater 3.4 Deterministic Package
+
+on:
+  push:
+    branches:
+      - feature/updater-3.4-lifecycle
+
+permissions:
+  contents: write
+
+concurrency:
+  group: patch-updater-34-deterministic-package
+  cancel-in-progress: false
+
+jobs:
+  patch:
+    if: ${{ github.actor != 'github-actions[bot]' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: feature/updater-3.4-lifecycle
+          fetch-depth: 0
+
+      - name: Paketjob und Gate deterministisch härten
+        shell: python
+        run: |
+          from pathlib import Path
+
+          ci = Path('.github/workflows/ci.yml')
+          text = ci.read_text(encoding='utf-8')
+          old = '''          (
+            cd release-output
+            zip -qr "${release_name}.zip" "${release_name}"
+            sha256sum "${release_name}.zip" > "${release_name}.zip.sha256"
+            sha256sum --check "${release_name}.zip.sha256"
+          )'''
+          new = '''          archive="release-output/${release_name}.zip"
+          python tools/build-deterministic-zip.py "$package_dir" "$archive"
+          first_hash="$(sha256sum "$archive" | awk '{print $1}')"
+          python tools/build-deterministic-zip.py "$package_dir" "$archive"
+          second_hash="$(sha256sum "$archive" | awk '{print $1}')"
+          if [[ "$first_hash" != "$second_hash" ]]; then
+            echo "Der ZIP-Build ist nicht byte-reproduzierbar." >&2
+            exit 1
+          fi
+          python -m zipfile -t "$archive"
+          (
+            cd release-output
+            sha256sum "${release_name}.zip" > "${release_name}.zip.sha256"
+            sha256sum --check "${release_name}.zip.sha256"
+          )'''
+          if text.count(old) != 1:
+              raise SystemExit(f'ZIP-Block nicht eindeutig gefunden: {text.count(old)}')
+          ci.write_text(text.replace(old, new), encoding='utf-8', newline='\n')
+
+          verifier = Path('tools/verify-updater-ci-lifecycle-3.4.mjs')
+          text = verifier.read_text(encoding='utf-8')
+          old = "assert(ci.includes('actions/upload-artifact@v4'), 'Das geprüfte Paket wird nicht als CI-Artefakt bereitgestellt.');"
+          new = old + "\nassert(ci.includes('tools/build-deterministic-zip.py'), 'Paketjob verwendet keinen deterministischen ZIP-Build.');\nassert(ci.includes('first_hash') && ci.includes('second_hash'), 'Paketjob weist die Byte-Reproduzierbarkeit des ZIPs nicht nach.');\nassert(!ci.includes('zip -qr'), 'Paketjob verwendet weiterhin den zeitstempelabhängigen Standard-ZIP-Build.');\nconst deterministicZip = read('tools/build-deterministic-zip.py');\nassert(deterministicZip.includes('FIXED_TIMESTAMP = (1980, 1, 1, 0, 0, 0)'), 'Deterministischer ZIP-Build besitzt keinen fixierten Zeitstempel.');\nassert(deterministicZip.includes('sorted(source.rglob'), 'Deterministischer ZIP-Build sortiert die Payload nicht.');"
+          if text.count(old) != 1:
+              raise SystemExit(f'CI-Gate-Anker nicht eindeutig gefunden: {text.count(old)}')
+          verifier.write_text(text.replace(old, new), encoding='utf-8', newline='\n')
+
+      - name: Patch committen und Hilfsworkflow entfernen
+        shell: bash
+        run: |
+          set -euo pipefail
+          rm -f .github/workflows/patch-updater34-deterministic-package.yml
+          git config user.name 'vendoo-updater-build'
+          git config user.email 'vendoo-updater-build@users.noreply.github.com'
+          git add --all
+          git commit -m 'build: make updater 3.4 package byte-reproducible'
+          git push origin HEAD:feature/updater-3.4-lifecycle