apply/.github/workflows/determinism-check.yml at main · Verifrax/apply · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
name: Determinism Check

on:
  pull_request:
  push:
    branches: [ main ]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  determinism:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Hard clean
        shell: bash
        run: |
          set -euo pipefail
          git reset --hard
          git clean -ffd

      - name: Verify clean workspace
        shell: bash
        run: |
          set -euo pipefail
          test -z "$(git status --porcelain=v1)"
          git diff --exit-code

      - name: Build artifact twice and compare digests
        shell: bash
        run: |
          set -euo pipefail

          build_once() {
            out="$1"
rm -rf "$out/dist"
mkdir -p "$out/dist/submit" "$out/dist/task" "$out/dist/confirm"
cp CNAME "$out/dist/CNAME"
cp public/index.html "$out/dist/index.html"
cp public/404.html "$out/dist/404.html"
cp public/submit/index.html "$out/dist/submit/index.html"
cp public/task/index.html "$out/dist/task/index.html"
cp public/confirm/index.html "$out/dist/confirm/index.html"
cp -R surface-system "$out/dist/surface-system"
test -f "$out/dist/CNAME"
test -f "$out/dist/index.html"
test -f "$out/dist/404.html"
test -f "$out/dist/submit/index.html"
test -f "$out/dist/task/index.html"
test -f "$out/dist/confirm/index.html"
test -f "$out/dist/surface-system/shell/base.css"
grep -Fx "apply.verifrax.net" "$out/dist/CNAME"

          }

          tree_hash() {
            python3 - "$1" <<PY2
import hashlib
import sys
from pathlib import Path

root = Path(sys.argv[1])
h = hashlib.sha256()

for p in sorted(root.rglob("*")):
    if p.is_file():
        rel = p.relative_to(root).as_posix().encode()
        h.update(rel)
        h.update(b"\0")
        h.update(p.read_bytes())
        h.update(b"\0")

print(h.hexdigest())
PY2
          }

          A="$(mktemp -d)"
          B="$(mktemp -d)"

          build_once "$A"
          build_once "$B"

          HASH_A="$(tree_hash "$A/dist")"
          HASH_B="$(tree_hash "$B/dist")"

          echo "HASH_A=$HASH_A"
          echo "HASH_B=$HASH_B"

          test "$HASH_A" = "$HASH_B"
          diff -ru "$A/dist" "$B/dist"

      - name: Verify clean workspace after build
        shell: bash
        run: |
          set -euo pipefail
          test -z "$(git status --porcelain=v1)"
          git diff --exit-code