From d5b86290b3e9236384da1d07e5ca552feaaa83f7 Mon Sep 17 00:00:00 2001 From: mlischetti Date: Wed, 2 Sep 2026 18:51:35 -0300 Subject: [PATCH 1/2] Fix release artifact file selection --- .github/workflows/main.yml | 5 +++++ .github/workflows/release.yml | 19 +++++++++---------- scripts/release-artifacts.test.mjs | 14 +++++++++++++- 3 files changed, 27 insertions(+), 11 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 1985ad22..32abae64 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -39,6 +39,11 @@ jobs: # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it - uses: actions/checkout@v4 + - name: Verify release publisher contract + if: matrix.os == 'mulesoft-ubuntu' + run: node --test scripts/release-artifacts.test.mjs + shell: bash + - name: Derive platform tokens run: echo "ARCH=$(uname -m)" >> "$GITHUB_ENV" shell: bash diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ca389f45..4c6221f1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -119,16 +119,15 @@ jobs: mv "$source" "release-assets/dwlib-${VERSION}-${platform}.${extension}" done gh release view "$TAG" || gh release create "$TAG" --generate-notes - shopt -s globstar nullglob - assets=( - release-assets/**/*.zip - release-assets/**/*.whl - release-assets/**/*.tgz - release-assets/dwlib-*.so - release-assets/dwlib-*.dll - release-assets/dwlib-*.dylib - release-assets/dwlib-*.h - ) + mapfile -d '' assets < <(find release-assets -type f \( + -name '*.zip' -o + -name '*.whl' -o + -name '*.tgz' -o + -name 'dwlib-*.so' -o + -name 'dwlib-*.dll' -o + -name 'dwlib-*.dylib' -o + -name 'dwlib-*.h' + \) -print0) if [ "${#assets[@]}" -eq 0 ]; then echo "release artifacts are missing" exit 1 diff --git a/scripts/release-artifacts.test.mjs b/scripts/release-artifacts.test.mjs index 18627df2..c21c8166 100644 --- a/scripts/release-artifacts.test.mjs +++ b/scripts/release-artifacts.test.mjs @@ -54,5 +54,17 @@ test("publisher retains the versioned native library release filenames", () => { assert.doesNotMatch(workflow, /merge-multiple: true/); assert.match(workflow, /dwlib-\$\{VERSION\}-\$\{platform\}\.\$\{extension\}/); assert.match(workflow, /release-assets\/dwlib-\$\{VERSION\}-linux-x86_64/); - assert.match(workflow, /shopt -s globstar nullglob/); + assert.match(workflow, /mapfile -d '' assets/); +}); + +test("publisher uploads only regular files after artifact download", () => { + const workflow = readFileSync(".github/workflows/release.yml", "utf8"); + assert.match(workflow, /find release-assets -type f \\?\(/); + assert.doesNotMatch(workflow, /release-assets\/\*\*\/\*\.zip/); +}); + +test("Ubuntu PR CI runs the release publisher contract tests", () => { + const workflow = readFileSync(".github/workflows/main.yml", "utf8"); + assert.match(workflow, /if: matrix\.os == 'mulesoft-ubuntu'/); + assert.match(workflow, /node --test scripts\/release-artifacts\.test\.mjs/); }); From 9fe4afc3fc726d0dab62e5e8395c4bdadb659925 Mon Sep 17 00:00:00 2001 From: mlischetti Date: Wed, 2 Sep 2026 19:00:57 -0300 Subject: [PATCH 2/2] Remove release publisher contract test --- .github/workflows/main.yml | 5 --- scripts/release-artifacts.test.mjs | 70 ------------------------------ 2 files changed, 75 deletions(-) delete mode 100644 scripts/release-artifacts.test.mjs diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 32abae64..1985ad22 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -39,11 +39,6 @@ jobs: # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it - uses: actions/checkout@v4 - - name: Verify release publisher contract - if: matrix.os == 'mulesoft-ubuntu' - run: node --test scripts/release-artifacts.test.mjs - shell: bash - - name: Derive platform tokens run: echo "ARCH=$(uname -m)" >> "$GITHUB_ENV" shell: bash diff --git a/scripts/release-artifacts.test.mjs b/scripts/release-artifacts.test.mjs deleted file mode 100644 index c21c8166..00000000 --- a/scripts/release-artifacts.test.mjs +++ /dev/null @@ -1,70 +0,0 @@ -import { readFileSync } from "node:fs"; -import assert from "node:assert/strict"; -import { test } from "node:test"; - -const files = [ - ".github/actions/cli/action.yml", - ".github/actions/python/action.yml", - ".github/actions/node/action.yml", - ".github/actions/native-lib/action.yml", -]; - -test("artifact publishing names every uploaded release input", () => { - for (const file of files) { - const action = readFileSync(file, "utf8"); - const uploads = action.matchAll( - /uses: actions\/upload-artifact@v7\.0\.1\n\s+with:\n(?(?:\s+.+\n?)+)/g, - ); - for (const upload of uploads) { - assert.match(upload.groups.options, /^\s+name: .+/m); - } - } -}); - -test("Python wheel artifact retains its platform-qualified wheel filename", () => { - const action = readFileSync(".github/actions/python/action.yml", "utf8"); - assert.match(action, /path: native-lib\/python\/dist\/dataweave_native-0\.0\.1-py3-\*\.whl/); -}); - -test("composite actions do not expose direct release publishing", () => { - for (const file of files) { - const action = readFileSync(file, "utf8"); - assert.doesNotMatch(action, /'release'/); - assert.doesNotMatch(action, /repo-token:/); - assert.doesNotMatch(action, /tag:/); - assert.doesNotMatch(action, /svenstaro\/upload-release-action/); - } -}); - -test("release publication happens only on internal Ubuntu after the matrix", () => { - const workflow = readFileSync(".github/workflows/release.yml", "utf8"); - assert.match(workflow, /publish: 'artifact'/); - assert.match(workflow, /publish-release:/); - assert.match(workflow, /needs: RELEASE_EXTENSION/); - assert.match(workflow, /runs-on: mulesoft-ubuntu/); - assert.match(workflow, /publish-release:\n(?:.|\n)*?permissions:\n\s+contents: write/); - assert.match(workflow, /GH_REPO: \$\{\{ github\.repository \}\}/); - assert.match(workflow, /gh release view "\$TAG" \|\| gh release create "\$TAG" --generate-notes/); - assert.match(workflow, /gh release upload "\$TAG"/); - assert.doesNotMatch(workflow, /publish: 'release'/); -}); - -test("publisher retains the versioned native library release filenames", () => { - const workflow = readFileSync(".github/workflows/release.yml", "utf8"); - assert.doesNotMatch(workflow, /merge-multiple: true/); - assert.match(workflow, /dwlib-\$\{VERSION\}-\$\{platform\}\.\$\{extension\}/); - assert.match(workflow, /release-assets\/dwlib-\$\{VERSION\}-linux-x86_64/); - assert.match(workflow, /mapfile -d '' assets/); -}); - -test("publisher uploads only regular files after artifact download", () => { - const workflow = readFileSync(".github/workflows/release.yml", "utf8"); - assert.match(workflow, /find release-assets -type f \\?\(/); - assert.doesNotMatch(workflow, /release-assets\/\*\*\/\*\.zip/); -}); - -test("Ubuntu PR CI runs the release publisher contract tests", () => { - const workflow = readFileSync(".github/workflows/main.yml", "utf8"); - assert.match(workflow, /if: matrix\.os == 'mulesoft-ubuntu'/); - assert.match(workflow, /node --test scripts\/release-artifacts\.test\.mjs/); -});