Fimeg/SouveraineOS
Watch
1
0
Fork
You've already forked SouveraineOS
 0
Code Releases Activity

ci: hold the public edge through DNS

Browse source
This commit is contained in:
Fimeg 2026-08-25 08:07:07 -04:00
commit 4f5eb9b34d
1 changed files with 27 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

31
.gitea/workflows/distribution.yml
View file

@ -5,6 +5,7 @@ on:
branches: [main, public]
pull_request:
branches: [main, public]
workflow_dispatch:
jobs:
validate:
@ -31,7 +32,14 @@ jobs:
: "${PUBLIC_FORGE_TOKEN:?PUBLIC_FORGE_TOKEN is required}"
expected="${GITHUB_SHA}"
forge_url='https://forge.caseytunturi.com/Fimeg/SouveraineOS.git'
remote_sha="$(git ls-remote "$forge_url" refs/heads/public | awk '{print $1}')"
remote_sha=''
for attempt in 1 2 3; do
if remote_sha="$(git ls-remote "$forge_url" refs/heads/public | awk '{print $1}')"; then
break
fi
test "$attempt" -lt 3 || exit 1
sleep $((attempt * 10))
done
if [ -n "$remote_sha" ]; then
git cat-file -e "${remote_sha}^{commit}" 2>/dev/null || {
echo "[publish] remote public SHA is not in tested history" >&2; exit 1; }
@ -39,7 +47,22 @@ jobs:
echo "[publish] refusing non-fast-forward public history" >&2; exit 1; }
fi
auth="$(printf 'publisher-souveraineos:%s' "$PUBLIC_FORGE_TOKEN" | base64 -w0)"
git -c "http.https://forge.caseytunturi.com/.extraheader=Authorization: Basic $auth" \
push "$forge_url" public:public
test "$(git ls-remote "$forge_url" refs/heads/public | awk '{print $1}')" = "$expected"
for attempt in 1 2 3; do
if git -c "http.https://forge.caseytunturi.com/.extraheader=Authorization: Basic $auth" \
push "$forge_url" public:public; then
break
fi
test "$attempt" -lt 3 || exit 1
sleep $((attempt * 10))
done
observed=''
for attempt in 1 2 3; do
if observed="$(git ls-remote "$forge_url" refs/heads/public | awk '{print $1}')"; then
test "$observed" = "$expected"
break
fi
test "$attempt" -lt 3 || exit 1
sleep $((attempt * 10))
done
test "$observed" = "$expected"
echo "[publish] exact SHA is anonymous on Forgejo: $expected"