Hardening: workflows safety/robustness + installer integrity #1293
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -6,39 +6,75 @@ on: | |
|
|
||
| jobs: | ||
| publish-winget: | ||
| if: github.repository == 'github/copilot-cli' | ||
| name: Submit to WinGet repository | ||
|
|
||
| # GitHub token permissions needed for winget-create to submit a PR | ||
| permissions: | ||
| contents: read | ||
|
|
||
|
Comment on lines
12
to
15
There was a problem hiding this comment. The comment says the job’s “GitHub token permissions” are needed for winget-create to submit a PR, but the workflow actually uses There was a problem hiding this comment. Dete red line 14, add the Green line this is the fix There was a problem hiding this comment. Dete red line 14, add the Green line this is the fix |
||
| # winget-create is only supported on Windows | ||
| runs-on: windows-latest | ||
| timeout-minutes: 30 | ||
|
|
||
| # winget-create will read the following environment variable to access the GitHub token needed for submitting a PR | ||
| # See https://aka.ms/winget-create-token | ||
| env: | ||
| WINGET_CREATE_GITHUB_TOKEN: ${{ secrets.WINGET_CREATE_GITHUB_TOKEN }} | ||
| RELEASE_ASSETS_JSON: ${{ toJSON(github.event.release.assets) }} | ||
| RELEASE_TAG: ${{ github.event.release.tag_name }} | ||
| IS_PRERELEASE: ${{ github.event.release.prerelease }} | ||
|
|
||
| steps: | ||
| - name: Validate required secret | ||
| shell: pwsh | ||
| run: | | ||
| if ([string]::IsNullOrWhiteSpace($env:WINGET_CREATE_GITHUB_TOKEN)) { | ||
| Write-Error "WINGET_CREATE_GITHUB_TOKEN secret is not configured" | ||
| exit 1 | ||
| } | ||
|
|
||
| - name: Submit package using wingetcreate | ||
| shell: pwsh | ||
| run: | | ||
| # Set the package ID based on the release info | ||
| $isPrerelease = ($env:IS_PRERELEASE -eq 'true') | ||
| $packageId = if ($isPrerelease) { 'GitHub.Copilot.Prerelease' } else { 'GitHub.Copilot' } | ||
|
|
||
| # Get installer info from release event (passed via env to avoid script injection patterns) | ||
| $assets = $env:RELEASE_ASSETS_JSON | ConvertFrom-Json | ||
| $packageVersion = $env:RELEASE_TAG | ||
|
|
||
| # Find the download URLs for the x64 and arm64 installers separately | ||
| # This allows overrides to be used so that wingetcreate does not have to guess the architecture from the filename | ||
| $installerUrlx64 = $assets | Where-Object -Property name -like '*win32-x64.zip' | Select-Object -ExpandProperty browser_download_url | ||
| $installerUrlarm64 = $assets | Where-Object -Property name -like '*win32-arm64.zip' | Select-Object -ExpandProperty browser_download_url | ||
|
|
||
| if ([string]::IsNullOrWhiteSpace($installerUrlx64) -or [string]::IsNullOrWhiteSpace($installerUrlarm64)) { | ||
| Write-Error "Could not determine installer URLs from release assets" | ||
| exit 1 | ||
| } | ||
|
|
||
| # Download wingetcreate (with retries) | ||
| $maxRetries = 3 | ||
| $retryDelaySeconds = 5 | ||
| for ($i = 1; $i -le $maxRetries; $i++) { | ||
| try { | ||
| curl.exe -JLO https://aka.ms/wingetcreate/latest | ||
| if (Test-Path "wingetcreate.exe") { break } | ||
| } catch { | ||
| Write-Warning "Download attempt $i failed: $($_.Exception.Message)" | ||
|
Comment on lines
+58
to
+66
There was a problem hiding this comment. The retry loop wraps There was a problem hiding this comment. The retry loop wraps curl.exe in try/catch, but external executables don’t throw terminating PowerShell exceptions on failure; they set $LASTEXITCODE. This means transient download failures may not be logged as intended, and a non-zero exit can still leave a partial file. Consider using Invoke-WebRequest with -ErrorAction Stop, or explicitly check $LASTEXITCODE/file size and use curl’s --fail/--retry options. There was a problem hiding this comment. The retry loop wraps curl.exe in try/catch, but external executables don’t throw terminating PowerShell exceptions on failure; they set $LASTEXITCODE. This means transient download failures may not be logged as intended, and a non-zero exit can still leave a partial file. Consider using Invoke-WebRequest with -ErrorAction Stop, or explicitly check $LASTEXITCODE/file size and use curl’s --fail/--retry options. Configure There was a problem hiding this comment. The retry loop wraps curl.exe in try/catch, but external executables don’t throw terminating PowerShell exceptions on failure; they set $LASTEXITCODE. This means transient download failures may not be logged as intended, and a non-zero exit can still leave a partial file. Consider using Invoke-WebRequest with -ErrorAction Stop, or explicitly check $LASTEXITCODE/file size and use curl’s --fail/--retry options. Configure |
||
| } | ||
| Start-Sleep -Seconds $retryDelaySeconds | ||
| } | ||
|
|
||
| if (-not (Test-Path "wingetcreate.exe")) { | ||
| Write-Error "Failed to download wingetcreate after $maxRetries attempts" | ||
| exit 1 | ||
| } | ||
|
|
||
| # Update package using wingetcreate | ||
| .\wingetcreate.exe update $packageId ` | ||
| --version "$packageVersion" ` | ||
| --urls "$installerUrlx64|x64" "$installerUrlarm64|arm64" ` | ||
| --submit | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Grammar: “Personal identifiable information (PII)” should be “Personally identifiable information (PII)”.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Delete red 15 , Keep add green 15 use suggest
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Delete red 15 , Keep add green 15