| 1 | import assert from "node:assert/strict"; |
| 2 | import { execFileSync } from "node:child_process"; |
| 3 | import { pathToFileURL } from "node:url"; |
| 4 | import path from "node:path"; |
| 5 | |
| 6 | const endpoint = "repos/esengine/DeepSeek-Reasonix/actions/runs/34816299501"; |
| 7 | const read = suffix => JSON.parse(execFileSync("gh", ["api", endpoint + suffix], { encoding: "utf8" })); |
| 8 | export function verifyProducer(run, jobs) { |
| 9 | assert.equal(run.repository.full_name, "esengine/DeepSeek-Reasonix"); |
| 10 | assert.equal(run.head_sha, "09cdab3866d77c6ff0d007ee61b6aca3128ebe54"); |
| 11 | assert.equal(run.head_branch, "main-v2"); |
| 12 | assert.equal(run.event, "workflow_dispatch"); |
| 13 | assert.equal(run.path, ".github/workflows/release-stable.yml"); |
| 14 | assert.equal(run.run_attempt, 1); |
| 15 | assert.equal(run.status, "completed"); |
| 16 | for (const platform of ["darwin-arm64", "darwin-amd64", "darwin-universal", "windows-amd64", "windows-arm64", "linux-amd64"]) { |
| 17 | const matches = jobs.filter(job => job.name === `verify stable SignPath control plane / build (${platform}, preflight)`); |
| 18 | assert.equal(matches.length, 1); |
| 19 | assert.equal(matches[0].conclusion, "success"); |
| 20 | } |
| 21 | } |
| 22 | if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) { |
| 23 | verifyProducer(read(""), read("/attempts/1/jobs?per_page=100").jobs); |
| 24 | console.log("Verified the protected producer and all six native build jobs; artifact identity and digests must still pass collection."); |
| 25 | } |
| 26 |