release.yml

name: Verify published release
on:
  release:
    types: [published]
permissions:
  contents: read
jobs:
  verify:
    name: Verify uploaded DMG
    runs-on: macos-15
    timeout-minutes: 15
    env:
      GH_TOKEN: ${{ github.token }}
      RELEASE_TAG: ${{ github.event.release.tag_name }}
      APPLE_TEAM_ID: 8S66M2ZLD5
      APPLE_CODESIGN_IDENTITY: 'Developer ID Application: Guangzhou Guangbei Vertex Technology co.,Ltd (8S66M2ZLD5)'
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          ref: ${{ github.event.release.tag_name }}
          persist-credentials: false
      - name: Download published assets
        run: |
          set -euo pipefail
          [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || exit 2
          version="${RELEASE_TAG#v}"
          mkdir -p dist
          gh release download "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" \
            --pattern "FileMint-$version.dmg" --pattern "FileMint-$version.dmg.sha256" \
            --dir dist
          gh release download "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --pattern appcast.xml --dir dist
          echo "VERSION=$version" >> "$GITHUB_ENV"
      - name: Verify checksum, signatures and release-specific ticket state
        run: |
          if [[ "$VERSION" == 0.5.3 ]]; then
            FILEMINT_ALLOW_PENDING_053=1 bash scripts/verify_release_artifact.sh "dist/FileMint-$VERSION.dmg" "$VERSION"
          else
            bash scripts/verify_release_artifact.sh "dist/FileMint-$VERSION.dmg" "$VERSION"
          fi