From 4420a1a7971834da954ac12c6ab532cb0e1204ec Mon Sep 17 00:00:00 2001 From: KeyffMS <124252104+KeyffMS@users.noreply.github.com> Date: Thu, 23 Jul 2026 21:32:39 +0200 Subject: [PATCH 1/3] Add guarded workflow for audit release tags --- .../workflows/create-audit-release-tags.yml | 65 +++++++++++++++++++ 1 file changed, 65 insertions(+) create mode 100644 .github/workflows/create-audit-release-tags.yml diff --git a/.github/workflows/create-audit-release-tags.yml b/.github/workflows/create-audit-release-tags.yml new file mode 100644 index 00000000..fe6d012d --- /dev/null +++ b/.github/workflows/create-audit-release-tags.yml @@ -0,0 +1,65 @@ +name: Create validated audit release tags + +on: + pull_request: + branches: [main] + +permissions: + contents: write + pull-requests: read + +jobs: + tag: + if: >- + github.event.pull_request.head.repo.full_name == github.repository && + github.head_ref == 'agent/create-audit-release-tags' + runs-on: ubuntu-latest + + steps: + - name: Check out full history + uses: actions/checkout@v4 + with: + ref: ${{ github.head_ref }} + fetch-depth: 0 + token: ${{ secrets.GITHUB_TOKEN }} + + - name: Verify commits and create release tags + shell: bash + run: | + set -euo pipefail + git fetch --tags --force + + create_tag() { + local tag="$1" + local commit="$2" + + if ! git cat-file -e "${commit}^{commit}"; then + echo "Missing release commit ${commit} for ${tag}." >&2 + exit 1 + fi + + local project + project="$(git show "${commit}:src/SightAdapt/SightAdapt.csproj")" + grep -Fq "${tag}" <<<"${project}" + grep -Fq "${tag}" <<<"${project}" + grep -Fq "${tag}" <<<"${project}" + + if git rev-parse -q --verify "refs/tags/${tag}" >/dev/null; then + local existing + existing="$(git rev-list -n 1 "${tag}")" + if [[ "${existing}" != "${commit}" ]]; then + echo "Tag ${tag} already points to ${existing}, expected ${commit}." >&2 + exit 1 + fi + echo "Tag ${tag} already exists at the validated commit." + return + fi + + git tag -a "${tag}" "${commit}" -m "SightAdapt ${tag}" + git push origin "refs/tags/${tag}" + } + + create_tag 0.5.0.31 af7d8a20b51ad587dab5cf279d15c7cd952af1aa + create_tag 0.5.0.32 bccd6d2046726803e7ec67c88bc03a7d97ce56cc + create_tag 0.5.0.33 d8f5e41be042371f38207693a6dd1c578a6d5547 + create_tag 0.5.0.34 f502b11221578a9686be42c2626313eb973b60dd From 4a9e1ce6a2d087bfc2274a3f68f1c53443de50e0 Mon Sep 17 00:00:00 2001 From: KeyffMS <124252104+KeyffMS@users.noreply.github.com> Date: Thu, 23 Jul 2026 21:34:04 +0200 Subject: [PATCH 2/3] Configure release tag author --- .github/workflows/create-audit-release-tags.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/create-audit-release-tags.yml b/.github/workflows/create-audit-release-tags.yml index fe6d012d..e2ae175a 100644 --- a/.github/workflows/create-audit-release-tags.yml +++ b/.github/workflows/create-audit-release-tags.yml @@ -27,6 +27,8 @@ jobs: shell: bash run: | set -euo pipefail + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" git fetch --tags --force create_tag() { From 0ba732742b551bcad0a969087ae9724e4aab7bba Mon Sep 17 00:00:00 2001 From: KeyffMS <124252104+KeyffMS@users.noreply.github.com> Date: Thu, 23 Jul 2026 21:34:58 +0200 Subject: [PATCH 3/3] Remove temporary release tag workflow --- .../workflows/create-audit-release-tags.yml | 67 ------------------- 1 file changed, 67 deletions(-) delete mode 100644 .github/workflows/create-audit-release-tags.yml diff --git a/.github/workflows/create-audit-release-tags.yml b/.github/workflows/create-audit-release-tags.yml deleted file mode 100644 index e2ae175a..00000000 --- a/.github/workflows/create-audit-release-tags.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Create validated audit release tags - -on: - pull_request: - branches: [main] - -permissions: - contents: write - pull-requests: read - -jobs: - tag: - if: >- - github.event.pull_request.head.repo.full_name == github.repository && - github.head_ref == 'agent/create-audit-release-tags' - runs-on: ubuntu-latest - - steps: - - name: Check out full history - uses: actions/checkout@v4 - with: - ref: ${{ github.head_ref }} - fetch-depth: 0 - token: ${{ secrets.GITHUB_TOKEN }} - - - name: Verify commits and create release tags - shell: bash - run: | - set -euo pipefail - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git fetch --tags --force - - create_tag() { - local tag="$1" - local commit="$2" - - if ! git cat-file -e "${commit}^{commit}"; then - echo "Missing release commit ${commit} for ${tag}." >&2 - exit 1 - fi - - local project - project="$(git show "${commit}:src/SightAdapt/SightAdapt.csproj")" - grep -Fq "${tag}" <<<"${project}" - grep -Fq "${tag}" <<<"${project}" - grep -Fq "${tag}" <<<"${project}" - - if git rev-parse -q --verify "refs/tags/${tag}" >/dev/null; then - local existing - existing="$(git rev-list -n 1 "${tag}")" - if [[ "${existing}" != "${commit}" ]]; then - echo "Tag ${tag} already points to ${existing}, expected ${commit}." >&2 - exit 1 - fi - echo "Tag ${tag} already exists at the validated commit." - return - fi - - git tag -a "${tag}" "${commit}" -m "SightAdapt ${tag}" - git push origin "refs/tags/${tag}" - } - - create_tag 0.5.0.31 af7d8a20b51ad587dab5cf279d15c7cd952af1aa - create_tag 0.5.0.32 bccd6d2046726803e7ec67c88bc03a7d97ce56cc - create_tag 0.5.0.33 d8f5e41be042371f38207693a6dd1c578a6d5547 - create_tag 0.5.0.34 f502b11221578a9686be42c2626313eb973b60dd