From 8717f7dcf7d5f9b9bc2c914fd6b16472af82ee2e Mon Sep 17 00:00:00 2001 From: Tony Giorgio Date: Sat, 23 May 2026 22:06:02 -0500 Subject: [PATCH] Revert "Validate release workflow parity" This reverts commit 76aaefbd45562bb9431ad1271cdf18080b56f5d6. --- flake.nix | 9 -- .../ci/validate-release-workflow-parity.sh | 109 ------------------ 2 files changed, 118 deletions(-) delete mode 100755 scripts/ci/validate-release-workflow-parity.sh diff --git a/flake.nix b/flake.nix index 60fe66d5..4e4ab007 100644 --- a/flake.nix +++ b/flake.nix @@ -671,15 +671,6 @@ bash ./scripts/ci/validate-release-version.sh >/dev/null touch "$out" ''; - - release-workflow-parity = pkgs.runCommand "maple-release-workflow-parity-check" { - nativeBuildInputs = commonPackages; - src = ./.; - } '' - cd "$src" - bash ./scripts/ci/validate-release-workflow-parity.sh - touch "$out" - ''; }; apps = { diff --git a/scripts/ci/validate-release-workflow-parity.sh b/scripts/ci/validate-release-workflow-parity.sh deleted file mode 100755 index da356215..00000000 --- a/scripts/ci/validate-release-workflow-parity.sh +++ /dev/null @@ -1,109 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -repo_root="$(cd "${script_dir}/../.." && pwd)" - -require_contains() { - local file="$1" - local needle="$2" - local description="$3" - - if ! grep -Fq -- "${needle}" "${repo_root}/${file}"; then - echo "Missing release workflow parity invariant: ${description}" >&2 - echo "file=${file}" >&2 - echo "needle=${needle}" >&2 - return 1 - fi -} - -require_master_and_release() { - local master_file="$1" - local release_needle="$2" - local description="$3" - shift 3 - - for master_needle in "$@"; do - require_contains "${master_file}" "${master_needle}" "master ${description}" - done - require_contains ".github/workflows/release.yml" "${release_needle}" "release ${description}" -} - -require_master_and_release \ - ".github/workflows/desktop-build.yml" \ - "nix develop .#\${{ matrix.nix_shell }} -c ./scripts/ci/desktop-release.sh" \ - "desktop release build script" \ - "nix develop .#ci -c ./scripts/ci/desktop-release.sh" -require_contains ".github/workflows/desktop-build.yml" "desktop-release-macos-final.sha256" "master macOS desktop final proof" -require_contains ".github/workflows/desktop-build.yml" "desktop-release-linux-final.sha256" "master Linux desktop final proof" -require_contains ".github/workflows/release.yml" "desktop-release-\${{ matrix.artifact_prefix }}-final.sha256" "release desktop matrix final proof" -require_contains ".github/workflows/release.yml" "-path '*/reproducibility/desktop-release-*.sha256'" "release desktop proof upload" -require_master_and_release \ - ".github/workflows/desktop-build.yml" \ - "nix develop .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts linux macos" \ - "desktop release verifier targets" \ - "nix develop .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts linux macos" - -require_master_and_release \ - ".github/workflows/android-build.yml" \ - "nix develop .#android -c ./scripts/ci/android-release.sh" \ - "Android release build script" \ - "nix develop .#android -c ./scripts/ci/android-release.sh" -require_master_and_release \ - ".github/workflows/android-build.yml" \ - "MAPLE_REQUIRE_ANDROID_SIGNATURE_VERIFICATION: \"1\"" \ - "Android signature verification enforcement" \ - "MAPLE_REQUIRE_ANDROID_SIGNATURE_VERIFICATION: \"1\"" -require_contains ".github/workflows/android-build.yml" "android-release-final.sha256" "master Android final proof" -require_contains ".github/workflows/release.yml" "android-release-final.sha256" "release Android final proof" -require_contains ".github/workflows/release.yml" "-path '*/reproducibility/android-release-*.sha256'" "release Android proof upload" -require_master_and_release \ - ".github/workflows/android-build.yml" \ - "nix develop .#android -c ./scripts/ci/verify-release-artifacts.sh artifacts android" \ - "Android release verifier target" \ - "nix develop .#android -c ./scripts/ci/verify-release-artifacts.sh artifacts android" - -require_master_and_release \ - ".github/workflows/mobile-build.yml" \ - "nix develop .#apple -c ./scripts/ci/ios-release.sh" \ - "iOS release build script" \ - "nix develop .#apple -c ./scripts/ci/ios-release.sh" -require_master_and_release \ - ".github/workflows/mobile-build.yml" \ - "MAPLE_ENFORCE_IOS_SIGNED_REPRODUCIBILITY: \"1\"" \ - "iOS signed reproducibility enforcement" \ - "MAPLE_ENFORCE_IOS_SIGNED_REPRODUCIBILITY: \"1\"" -require_contains ".github/workflows/mobile-build.yml" "ios-release-final.sha256" "master iOS final proof" -require_contains ".github/workflows/mobile-build.yml" "ios-release-*.txt" "master iOS diff proof upload" -require_contains ".github/workflows/release.yml" "ios-release-final.sha256" "release iOS final proof" -require_contains ".github/workflows/release.yml" "-path '*/reproducibility/ios-release-*.txt'" "release iOS diff proof upload" -require_contains ".github/workflows/mobile-build.yml" "nix develop .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts ios" "master iOS release verifier target" -require_contains ".github/workflows/release.yml" "nix develop .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts linux macos ios web latest-json" "release final verifier target set" - -require_master_and_release \ - ".github/workflows/web-build.yml" \ - "nix develop .#ci -c ./scripts/ci/web.sh" \ - "web release build script" \ - "nix develop .#ci -c ./scripts/ci/web.sh" -require_master_and_release \ - ".github/workflows/web-build.yml" \ - "MAPLE_WEB_ENVIRONMENT: release" \ - "web release environment" \ - "MAPLE_WEB_ENVIRONMENT: release" -require_master_and_release \ - ".github/workflows/web-build.yml" \ - "web-final.sha256" \ - "web final proof" \ - "web-final.sha256" -require_contains ".github/workflows/web-build.yml" "nix develop .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts web" "master web release verifier target" - -require_contains ".github/workflows/release.yml" "needs: verify-desktop-release-artifacts" "latest.json waits for verified desktop artifacts" -require_contains ".github/workflows/release.yml" "nix develop .#ci -c ./scripts/ci/latest-json.sh artifacts latest.json" "release latest.json generator" -require_contains ".github/workflows/release.yml" "latest-json-final.sha256" "release latest.json proof" -require_contains ".github/workflows/release.yml" "subject-checksums: latest-json-artifacts.sha256" "release latest.json attestation" -require_contains ".github/workflows/release.yml" "- verify-android-release-artifacts" "release final verifier waits for Android verifier" -require_contains ".github/workflows/release.yml" "- build-ios" "release final verifier waits for iOS build" -require_contains ".github/workflows/release.yml" "- build-web" "release final verifier waits for web build" -require_contains ".github/workflows/release.yml" "- update-latest-json" "release final verifier waits for latest.json" - -echo "release workflow parity invariants verified"