From b3419f4ae5c677c26e67f9192a9e2f4e9d943883 Mon Sep 17 00:00:00 2001 From: Jason Murray Date: Thu, 30 Jul 2026 19:58:41 -0700 Subject: [PATCH] Pin split_tests to a checksummed release + auto-bump workflow action.yml previously fetched split_tests from /latest/download/ on every run, unauthenticated and unpinned - two runs of the same workflow could silently execute different splitting logic with no corresponding commit in this repo. - Pin to split_tests v0.5.0 and verify a sha256 checksum before use; the install step now fails loudly (with the actual hash) on a mismatch instead of accepting whatever the URL currently serves. - Add .github/workflows/bump-split-tests.yaml: a weekly scheduled (+ workflow_dispatch) workflow that checks upstream for a new release, downloads and hashes it, and opens a PR updating both SPLIT_TESTS_VERSION and SPLIT_TESTS_SHA256 together. A plain Dependabot/Renovate version bump can't compute a checksum for an arbitrary release binary, so this is a small purpose-built workflow instead - no third-party Action dependency, just git/gh, both preinstalled on GitHub-hosted runners. --- .github/workflows/bump-split-tests.yaml | 83 +++++++++++++++++++++++++ action.yml | 18 +++++- 2 files changed, 100 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/bump-split-tests.yaml diff --git a/.github/workflows/bump-split-tests.yaml b/.github/workflows/bump-split-tests.yaml new file mode 100644 index 0000000..825224f --- /dev/null +++ b/.github/workflows/bump-split-tests.yaml @@ -0,0 +1,83 @@ +name: Bump split_tests version + +on: + schedule: + - cron: '0 6 * * 1' # weekly, Monday 06:00 UTC + workflow_dispatch: {} + +permissions: + contents: write + pull-requests: write + +jobs: + check-and-bump: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Check for a newer split_tests release + id: check + env: + GH_TOKEN: ${{ github.token }} + run: | + set -euo pipefail + CURRENT_VERSION=$(grep -oP 'SPLIT_TESTS_VERSION:\s*\K\S+' action.yml) + LATEST_VERSION=$(gh api repos/leonid-shevtsov/split_tests/releases/latest --jq '.tag_name') + echo "current=${CURRENT_VERSION}" >> "$GITHUB_OUTPUT" + echo "latest=${LATEST_VERSION}" >> "$GITHUB_OUTPUT" + if [ "$CURRENT_VERSION" = "$LATEST_VERSION" ]; then + echo "up-to-date=true" >> "$GITHUB_OUTPUT" + else + echo "up-to-date=false" >> "$GITHUB_OUTPUT" + fi + + - name: Skip if a bump PR is already open + id: existing + if: steps.check.outputs.up-to-date == 'false' + env: + GH_TOKEN: ${{ github.token }} + BRANCH: bump-split-tests-${{ steps.check.outputs.latest }} + run: | + set -euo pipefail + COUNT=$(gh pr list --head "$BRANCH" --state open --json number --jq 'length') + echo "skip=$([ "$COUNT" -gt 0 ] && echo true || echo false)" >> "$GITHUB_OUTPUT" + + - name: Compute checksum and update action.yml + if: steps.check.outputs.up-to-date == 'false' && steps.existing.outputs.skip == 'false' + env: + VERSION: ${{ steps.check.outputs.latest }} + run: | + set -euo pipefail + curl -fL "https://github.com/leonid-shevtsov/split_tests/releases/download/${VERSION}/split_tests.linux.gz" -o /tmp/split_tests.gz + SHA256=$(sha256sum /tmp/split_tests.gz | cut -d' ' -f1) + sed -i "s/SPLIT_TESTS_VERSION: .*/SPLIT_TESTS_VERSION: ${VERSION}/" action.yml + sed -i "s/SPLIT_TESTS_SHA256: .*/SPLIT_TESTS_SHA256: ${SHA256}/" action.yml + + - name: Commit and open pull request + if: steps.check.outputs.up-to-date == 'false' && steps.existing.outputs.skip == 'false' + env: + GH_TOKEN: ${{ github.token }} + VERSION: ${{ steps.check.outputs.latest }} + PREV_VERSION: ${{ steps.check.outputs.current }} + run: | + set -euo pipefail + BRANCH="bump-split-tests-${VERSION}" + git config user.name "github-actions[bot]" + git config user.email "github-actions[bot]@users.noreply.github.com" + git checkout -b "$BRANCH" + git add action.yml + git commit -m "Bump split_tests ${PREV_VERSION} -> ${VERSION}" + git push origin "$BRANCH" + { + echo "Automated bump of the pinned \`split_tests\` dependency (opened by .github/workflows/bump-split-tests.yaml)." + echo "" + echo "- Previous: \`${PREV_VERSION}\`" + echo "- New: \`${VERSION}\`" + echo "" + echo "The SHA256 for the new \`split_tests.linux.gz\` asset was downloaded and hashed in this workflow run, so both values are updated together — no manual checksum step needed. Review the upstream release notes at https://github.com/leonid-shevtsov/split_tests/releases/tag/${VERSION} before merging." + } > /tmp/pr-body.md + gh pr create \ + --title "Bump split_tests ${PREV_VERSION} -> ${VERSION}" \ + --body-file /tmp/pr-body.md \ + --base main \ + --head "$BRANCH" diff --git a/action.yml b/action.yml index 0b64483..d9a53d2 100644 --- a/action.yml +++ b/action.yml @@ -36,7 +36,23 @@ runs: using: composite steps: - name: Install split_tests - run: curl -L "https://github.com/leonid-shevtsov/split_tests/releases/latest/download/split_tests.linux.gz" | gunzip -v > split_tests && chmod +x split_tests + env: + # Pinned to a specific leonid-shevtsov/split_tests release + checksum + # instead of /latest/download/, so this action's behavior can't + # change out from under a workflow without a commit in this repo. + # .github/workflows/bump-split-tests.yaml checks weekly for a new + # upstream release and opens a PR that updates both values together. + SPLIT_TESTS_VERSION: v0.5.0 + SPLIT_TESTS_SHA256: 6988628a956f065c9eced4bb77bcc0b5c111717c1d4748b701c03afabb8349dd + run: | + set -euo pipefail + curl -fL "https://github.com/leonid-shevtsov/split_tests/releases/download/${SPLIT_TESTS_VERSION}/split_tests.linux.gz" -o split_tests.gz + if ! echo "${SPLIT_TESTS_SHA256} split_tests.gz" | sha256sum -c -; then + echo "::error::split_tests ${SPLIT_TESTS_VERSION} checksum mismatch. Actual sha256: $(sha256sum split_tests.gz | cut -d' ' -f1)" >&2 + exit 1 + fi + gunzip -v split_tests.gz + chmod +x split_tests shell: bash - name: Split Tests id: split-tests