45 lines
1.8 KiB
TypeScript
45 lines
1.8 KiB
TypeScript
import { appendFile } from "node:fs/promises";
|
|
|
|
import { finalizeVerifiedPromotion } from "./lib/promotion-stager.ts";
|
|
|
|
const required = (name: string): string => {
|
|
const value = process.env[name];
|
|
if (!value) throw new TypeError(`promotion staging environment is missing ${name}`);
|
|
return value;
|
|
};
|
|
|
|
const staged = await finalizeVerifiedPromotion({
|
|
repositoryRoot: process.cwd(),
|
|
archivePath: required("CANDIDATE_ARCHIVE_PATH"),
|
|
expectedArchiveSha256: required("CANDIDATE_ARCHIVE_SHA256"),
|
|
vulnerabilityReportPath: required("VULNERABILITY_REPORT_PATH"),
|
|
provenanceAttestationPath: required("PROVENANCE_ATTESTATION_PATH"),
|
|
vulnerabilityPublicKeyPath: required("VULNERABILITY_PUBLIC_KEY_PATH"),
|
|
vulnerabilityKeyId: required("VULNERABILITY_KEY_ID"),
|
|
provenancePublicKeyPath: required("PROVENANCE_PUBLIC_KEY_PATH"),
|
|
provenanceKeyId: required("PROVENANCE_KEY_ID"),
|
|
expectedRun: {
|
|
id: process.env.GITEA_RUN_ID ?? process.env.GITHUB_RUN_ID ?? required("CI_RUN_ID"),
|
|
attempt: Number(process.env.GITEA_RUN_ATTEMPT ?? process.env.GITHUB_RUN_ATTEMPT ?? required("CI_RUN_ATTEMPT")),
|
|
sourceRevision: process.env.EXPECTED_SOURCE_REVISION ?? required("VITE_COMMIT_SHA"),
|
|
},
|
|
vulnerabilityInvocationNonce: required("VULNERABILITY_INVOCATION_NONCE"),
|
|
provenanceInvocationNonce: required("PROVENANCE_INVOCATION_NONCE"),
|
|
runnerTempRoot: required("RUNNER_TEMP"),
|
|
});
|
|
const output = required("GITHUB_OUTPUT");
|
|
await appendFile(
|
|
output,
|
|
[
|
|
`staging_root=${staged.stagingRoot}`,
|
|
`cleanup_token=${staged.cleanupToken}`,
|
|
`runner_temp_dev=${staged.runnerTempIdentity.dev}`,
|
|
`runner_temp_ino=${staged.runnerTempIdentity.ino}`,
|
|
"",
|
|
].join("\n"),
|
|
{ encoding: "utf8" },
|
|
);
|
|
process.stdout.write(
|
|
`Promotion staging: ${staged.files.map(({ name, sha256 }) => `${name}=${sha256}`).join(", ")} PASS\n`,
|
|
);
|