From 6251fa4f7a74948043771063f261dccf8aca75c8 Mon Sep 17 00:00:00 2001 From: Shivanshu07 Date: Wed, 21 Oct 2026 22:43:54 +0530 Subject: [PATCH 1/3] ci: publish SHA256SUMS and build provenance attestations for release executables Percy releases shipped percy-{linux,osx,win}.zip with no checksums or signatures, so nothing that downloads them (including BrowserStack's own SDKs) can verify what it runs. Add a "Publish Checksums" job to the Build Executables workflow. It runs after the macOS build and the Windows signing job, downloads the published zips, writes SHA256SUMS, attests all four files with GitHub artifact attestations (Sigstore keyless; verify with `gh attestation verify`), and uploads SHA256SUMS to the release. A workflow_dispatch trigger with a tag input runs only this job, to backfill already-published releases. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/executable.yml | 44 ++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) diff --git a/.github/workflows/executable.yml b/.github/workflows/executable.yml index eb7902f9d..f4a36c4cb 100644 --- a/.github/workflows/executable.yml +++ b/.github/workflows/executable.yml @@ -2,11 +2,18 @@ name: Build Executables on: release: types: [published] + # Backfill SHA256SUMS and attestations for an already-published release + workflow_dispatch: + inputs: + tag: + description: 'Release tag to publish checksums for (e.g. v1.32.12)' + required: true permissions: contents: read jobs: build: name: Build Executables + if: github.event_name == 'release' runs-on: macos-latest permissions: contents: write # upload release assets via softprops/action-gh-release @@ -41,6 +48,7 @@ jobs: notify: needs: build name: Sign Win Executable + if: github.event_name == 'release' runs-on: windows-2022 permissions: contents: write # upload signed Windows executable to the release @@ -117,3 +125,39 @@ jobs: percy-win.zip env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + checksums: + # Runs after both upload jobs so the hashes cover the final (signed) zips + # exactly as published, letting consumers pin a version and its hash. + needs: [build, notify] + name: Publish Checksums + if: >- + !cancelled() && (github.event_name == 'workflow_dispatch' || + (needs.build.result == 'success' && needs.notify.result == 'success')) + runs-on: ubuntu-latest + permissions: + contents: write # upload SHA256SUMS to the release + id-token: write # sign attestations with Sigstore + attestations: write # store attestations for `gh attestation verify` + steps: + - name: Download release assets + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG: ${{ github.event.release.tag_name || inputs.tag }} + run: gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --pattern 'percy-*.zip' + - name: Generate SHA256SUMS + run: | + sha256sum percy-linux.zip percy-osx.zip percy-win.zip > SHA256SUMS + cat SHA256SUMS + - name: Attest release assets + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 + with: + subject-path: | + percy-linux.zip + percy-osx.zip + percy-win.zip + SHA256SUMS + - name: Upload SHA256SUMS + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG: ${{ github.event.release.tag_name || inputs.tag }} + run: gh release upload "$TAG" SHA256SUMS --repo "$GITHUB_REPOSITORY" --clobber From 811b4bad2e678bd874b5a1610eb084251b45a8f6 Mon Sep 17 00:00:00 2001 From: Shivanshu07 Date: Wed, 21 Oct 2026 22:58:40 +0530 Subject: [PATCH 2/3] ci: only attest provenance when the same run built the executables A workflow_dispatch backfill downloads already-published zips it did not build, so attesting them would record the backfill run as their provenance. Backfills now publish SHA256SUMS only. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/executable.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/executable.yml b/.github/workflows/executable.yml index f4a36c4cb..e20935bcf 100644 --- a/.github/workflows/executable.yml +++ b/.github/workflows/executable.yml @@ -2,7 +2,7 @@ name: Build Executables on: release: types: [published] - # Backfill SHA256SUMS and attestations for an already-published release + # Backfill SHA256SUMS for an already-published release (no attestation) workflow_dispatch: inputs: tag: @@ -149,6 +149,9 @@ jobs: sha256sum percy-linux.zip percy-osx.zip percy-win.zip > SHA256SUMS cat SHA256SUMS - name: Attest release assets + # only this run's build and signing jobs produced the zips; a backfill + # did not build them, so it must not claim their provenance + if: github.event_name == 'release' uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-path: | From 831c290fdb31d9ea2e17b256a9f8a3486f40f0d6 Mon Sep 17 00:00:00 2001 From: Shivanshu07 Date: Wed, 21 Oct 2026 23:05:45 +0530 Subject: [PATCH 3/3] ci: serialize executable release and checksum backfill runs per tag Co-Authored-By: Claude Opus 5.5 --- .github/workflows/executable.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/executable.yml b/.github/workflows/executable.yml index e20935bcf..18f0937cf 100644 --- a/.github/workflows/executable.yml +++ b/.github/workflows/executable.yml @@ -8,6 +8,10 @@ on: tag: description: 'Release tag to publish checksums for (e.g. v1.32.12)' required: true +# Never let a backfill hash a release's assets while its build is replacing them +concurrency: + group: executable-${{ github.event.release.tag_name || inputs.tag }} + cancel-in-progress: false permissions: contents: read jobs: