| 1 | #!/usr/bin/env bash |
| 2 | set -euo pipefail |
| 3 | |
| 4 | repo_root="$(git rev-parse --show-toplevel)" |
| 5 | export ACTUAL_CALLER_WORKFLOW_REF='example/reasonix/.github/workflows/release-candidate.yml@refs/heads/main-v2' |
| 6 | export EXPECTED_CALLER_WORKFLOW_REF="$ACTUAL_CALLER_WORKFLOW_REF" |
| 7 | export CALLER_REF=refs/heads/main-v2 CALLER_REF_PROTECTED=true |
| 8 | export CALLER_WORKFLOW_SHA=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa |
| 9 | export CALLER_SHA="$CALLER_WORKFLOW_SHA" APPROVED_SHA="$CALLER_WORKFLOW_SHA" |
| 10 | export APPROVED_CLI_TAG=v1.2.3 APPROVED_CHANNEL=stable |
| 11 | |
| 12 | for event in push workflow_dispatch; do |
| 13 | CALLER_EVENT_NAME="$event" bash "$repo_root/scripts/verify-release-authorization.sh" |
| 14 | done |
| 15 | refuse() { |
| 16 | if env "$@" bash "$repo_root/scripts/verify-release-authorization.sh" >/dev/null 2>&1; then |
| 17 | echo "unsafe release caller unexpectedly authorized: $*" >&2 |
| 18 | exit 1 |
| 19 | fi |
| 20 | } |
| 21 | for event in pull_request_target pull_request workflow_call; do refuse CALLER_EVENT_NAME="$event"; done |
| 22 | refuse CALLER_EVENT_NAME=push CALLER_REF_PROTECTED=false |
| 23 | refuse CALLER_EVENT_NAME=push CALLER_REF=refs/heads/topic |
| 24 | refuse CALLER_EVENT_NAME=push CALLER_SHA=bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb |
| 25 | refuse CALLER_EVENT_NAME=push APPROVED_SHA=bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb |
| 26 | refuse CALLER_EVENT_NAME=push ACTUAL_CALLER_WORKFLOW_REF='example/reasonix/.github/workflows/other.yml@refs/heads/main-v2' |
| 27 | refuse CALLER_EVENT_NAME=push \ |
| 28 | ACTUAL_CALLER_WORKFLOW_REF='example/reasonix/.github/workflows/release-promote.yml@refs/heads/main-v2' \ |
| 29 | EXPECTED_CALLER_WORKFLOW_REF='example/reasonix/.github/workflows/release-promote.yml@refs/heads/main-v2' |
| 30 | echo "protected candidate authorization tests: PASS" |
| 31 |