From b14ea22aa85240056c1e923afd3f5a5b9a2268c4 Mon Sep 17 00:00:00 2001 From: Feng Ruohang Date: Thu, 6 Aug 2026 22:21:17 +0800 Subject: [PATCH] fix(ci): match checksum manifest entries exactly in docker-release The substring grep for the archive line also captured the archive's .sbom.json entry, whose file is deliberately not downloaded in this lane, so the sha256sum check failed on every run. awk now matches the manifest filename column exactly. Co-Authored-By: Claude Fable 5 --- .github/workflows/docker-release.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml index f258bb39a..0106fb856 100644 --- a/.github/workflows/docker-release.yml +++ b/.github/workflows/docker-release.yml @@ -102,10 +102,12 @@ jobs: # The binaries going into the images are the published ones, checked # against the published checksums, not a rebuild that merely ought to - # match them. + # match them. awk matches the manifest filename column exactly: a + # substring grep would also pull in the archive's .sbom.json line, + # whose file is deliberately not downloaded in this lane. cd "${assets_dir}" - grep -F " ${amd64_archive}" "${checksums}" | sha256sum --check - grep -F " ${arm64_archive}" "${checksums}" | sha256sum --check + awk -v name="${amd64_archive}" '$2 == name' "${checksums}" | sha256sum --check + awk -v name="${arm64_archive}" '$2 == name' "${checksums}" | sha256sum --check # The checksum manifest and both archives must have provenance from # this repository's release workflow at the exact checked-out tag.