Add git-gost CLI, jobs queue & client build #126
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -111,3 +111,108 @@ jobs: | |
| ``` | ||
|
|
||
| El attestation queda registrado en el transparency log de Sigstore (Rekor), auditable por cualquier tercero independiente del operador. | ||
|
|
||
| ## Cliente git-gost | ||
|
|
||
| Descarga el binario de tu plataforma (git-gost-darwin-arm64, git-gost-darwin-amd64, git-gost-linux-amd64, git-gost-linux-arm64 o git-gost-windows-amd64.exe) y su archivo .sha256, verifica el hash y auto-instálalo: | ||
|
|
||
| ```bash | ||
| ./git-gost-darwin-arm64 install | ||
| ``` | ||
|
|
||
| El comando copia el binario como `git-gost` en `~/.local/bin` y añade ese directorio al PATH de tu shell (en Windows indica el directorio a añadir manualmente). | ||
|
|
||
| build-client: | ||
| runs-on: ubuntu-latest | ||
| strategy: | ||
| matrix: | ||
| include: | ||
| - os: darwin | ||
| arch: amd64 | ||
| - os: darwin | ||
| arch: arm64 | ||
| - os: linux | ||
| arch: amd64 | ||
| - os: linux | ||
| arch: arm64 | ||
| - os: windows | ||
| arch: amd64 | ||
|
|
||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | ||
|
|
||
| - name: Set up Go | ||
| uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 | ||
| with: | ||
| go-version-file: go.mod | ||
|
|
||
| - name: Get commit info | ||
| id: info | ||
| run: | | ||
| short=$(git rev-parse --short HEAD) | ||
| echo "short=$short" >> "$GITHUB_OUTPUT" | ||
| echo "built=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT" | ||
| if [[ "${{ github.ref }}" == refs/tags/* ]]; then | ||
| echo "ver=${{ github.ref_name }}" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "ver=$short" >> "$GITHUB_OUTPUT" | ||
| fi | ||
|
|
||
| - name: Build git-gost (${{ matrix.os }}/${{ matrix.arch }}) | ||
| id: build | ||
| env: | ||
| CGO_ENABLED: "0" | ||
| GOOS: ${{ matrix.os }} | ||
| GOARCH: ${{ matrix.arch }} | ||
| run: | | ||
| EXT="" | ||
| if [ "$GOOS" = "windows" ]; then EXT=".exe"; fi | ||
| BIN="git-gost-${{ matrix.os }}-${{ matrix.arch }}$EXT" | ||
| go build \ | ||
| -trimpath \ | ||
| -ldflags="-s -w \ | ||
| -X 'github.com/livrasand/gitGost/internal/cli.version=${{ steps.info.outputs.ver }}'" \ | ||
| -o "$BIN" \ | ||
| ./cmd/gost | ||
| echo "bin=$BIN" >> "$GITHUB_OUTPUT" | ||
|
|
||
| - name: SHA-256 del binario | ||
| id: sha | ||
| run: | | ||
| BIN="${{ steps.build.outputs.bin }}" | ||
| HASH=$(sha256sum "$BIN" | awk '{print $1}') | ||
| echo "hash=$HASH" >> "$GITHUB_OUTPUT" | ||
| echo "### git-gost SHA-256 (${{ matrix.os }}/${{ matrix.arch }})" >> "$GITHUB_STEP_SUMMARY" | ||
| echo '```' >> "$GITHUB_STEP_SUMMARY" | ||
| echo "$BIN $HASH" >> "$GITHUB_STEP_SUMMARY" | ||
| echo '```' >> "$GITHUB_STEP_SUMMARY" | ||
|
|
||
| - name: Attest build provenance (Sigstore) | ||
| uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 | ||
| with: | ||
| subject-path: ${{ steps.build.outputs.bin }} | ||
|
|
||
| - name: Publicar SHA-256 como artefacto | ||
| run: | | ||
| BIN="${{ steps.build.outputs.bin }}" | ||
| echo "${{ steps.sha.outputs.hash }} $BIN" > "$BIN.sha256" | ||
| echo "commit: ${{ steps.info.outputs.short }}" >> "$BIN.sha256" | ||
| echo "built: ${{ steps.info.outputs.built }}" >> "$BIN.sha256" | ||
|
|
||
| - name: Upload artifacts | ||
| uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f | ||
| with: | ||
| name: git-gost-${{ matrix.os }}-${{ matrix.arch }} | ||
| path: | | ||
| ${{ steps.build.outputs.bin }} | ||
| ${{ steps.build.outputs.bin }}.sha256 | ||
| retention-days: 90 | ||
|
|
||
| - name: Create/update release on tags | ||
| if: startsWith(github.ref, 'refs/tags/') | ||
| uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe | ||
| with: | ||
| files: | | ||
| ${{ steps.build.outputs.bin }} | ||
| ${{ steps.build.outputs.bin }}.sha256 | ||
|
Comment on lines
+212
to
+218
Contributor
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
# Inspect the workflow header and any permissions blocks.
sed -n '1,20p' .github/workflows/release.yml
rg -n 'permissions:|id-token|attestations|contents:|concurrency:' .github/workflows/release.ymlRepository: livrasand/gitGost Length of output: 563 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== workflow outline/line count =="
wc -l .github/workflows/release.yml
echo
echo "== jobs and relevant steps =="
awk '
/^jobs:/ { in_jobs=1; next }
in_jobs && /^[^ ]/ { in_jobs=0; print "---", prev_job, "lines:", start_line, "-", NR-1 }
in_jobs && /^[[:space:]]{2}[a-zA-Z0-9_-]+:/{
start_line=NR; prev_job=$0; gsub(/^ [/[:space:]/, "", prev_job); print "---", prev_job
}
in_jobs && /action-gh-release|attest-build-provenance|build-client|matrix|concurrency|permissions:/{
printf "%d: %s\n", NR, $0
}
in_jobs { prev_job=$0 }
' .github/workflows/release.yml
echo
echo "== action releases/attest usages =="
rg -n 'uses: softprops/action-gh-release|uses:.*/attest-build-provenance|build-client|build-and-attest|matrix:|packages|contents:' .github/workflows/release.yml
echo
echo "== lines 180-225 =="
sed -n '180,225p' .github/workflows/release.yml
echo
echo "== lines 70-95 =="
sed -n '70,95p' .github/workflows/release.ymlRepository: livrasand/gitGost Length of output: 542 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== workflow line count =="
wc -l .github/workflows/release.yml
echo
echo "== releases/attests/usages =="
rg -n 'uses: softprops/action-gh-release|attest-build-provenance|build-client|build-and-attest|mach-(?:arm64|x64|amd)64|matrix:|packages|contents:' .github/workflows/release.yml || true
echo
echo "== lines 180-218 =="
sed -n '180,218p' .github/workflows/release.yml
echo
echo "== lines 70-110 =="
sed -n '70,110p' .github/workflows/release.yml >/tmp/release_slice.txt
cat -n /tmp/release_slice.txtRepository: livrasand/gitGost Length of output: 4106 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== lines 110-140 =="
sed -n '110,140p' .github/workflows/release.yml
echo
echo "== full workflow text with line numbers relevant to jobs =="
awk '
NR>=1 && NR<=218 { printf "%d: %s\n", NR, $0 }
' .github/workflows/release.yml >/tmp/release.yml.lined
sed -n '110,135p' /tmp/release.yml.lined
sed -n '1,25p' /tmp/release.yml.linedRepository: livrasand/gitGost Length of output: 2945 🌐 Web query:
💡 Result: To upload multiple files using the softprops/action-gh-release GitHub Action, you use the 'files' input [1][2]. This input accepts a newline-delimited list of paths or glob expressions, allowing you to specify multiple files or patterns to include as release assets [1][3][4]. Configuration Example: To upload multiple files, provide them as a multi-line string in your workflow YAML [1][5]: steps: - name: Release uses: softprops/action-gh-release@v3 with: files: | path/to/file1.txt path/to/file2.exe dist/*.tar.gz Key points regarding asset uploading: - Glob Support: The 'files' input supports glob patterns, which are useful for matching multiple files in a directory [1][6][5]. - Working Directory: If your assets are located in a subdirectory, you can use the 'working_directory' input to set the base directory for resolving your 'files' paths [1][2][6]. - Updating Releases: If a release already exists for the given tag, the action will automatically update the release by adding or overwriting the specified assets [1][3]. - Overwriting: By default, the action overwrites existing files with the same name [7][4]. - Preservation of Order: The 'preserve_order' input is available if you need to upload artifacts sequentially, though this does not affect the final display order in the GitHub UI [4]. Documentation regarding appending: The action provides an 'append_body' input (boolean, default is false), which is used for appending text to an existing release body rather than overwriting it [1][4][8]. This setting is distinct from managing release assets (files), which are handled via the 'files' input [1][4]. Citations:
Run release publishing from a single release job. The workflow has one global 🧰 Tools🪛 zizmor (1.28.0)[info] 214-214: action functionality is already included by the runner (superfluous-actions): use (superfluous-actions) 🤖 Prompt for AI Agents |
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "os" | ||
|
|
||
| "github.com/livrasand/gitGost/internal/cli" | ||
| ) | ||
|
|
||
| func main() { | ||
| os.Exit(cli.Run(os.Args[1:])) | ||
| } |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Pass
github.refandgithub.ref_namethroughenv, not string interpolation.The
runblock expands${{ github.ref }}and${{ github.ref_name }}directly into bash. A ref name that contains shell metacharacters becomes shell code in the runner. The same value then flows into-ldflagsat Line 175. Use environment variables so the shell receives data, not code.🛡️ Proposed fix
- name: Get commit info id: info + env: + GH_REF: ${{ github.ref }} + GH_REF_NAME: ${{ github.ref_name }} run: | short=$(git rev-parse --short HEAD) echo "short=$short" >> "$GITHUB_OUTPUT" echo "built=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT" - if [[ "${{ github.ref }}" == refs/tags/* ]]; then - echo "ver=${{ github.ref_name }}" >> "$GITHUB_OUTPUT" + if [[ "$GH_REF" == refs/tags/* ]]; then + echo "ver=$GH_REF_NAME" >> "$GITHUB_OUTPUT" else echo "ver=$short" >> "$GITHUB_OUTPUT" fiApply the same pattern to the
matrixandsteps.*.outputs.*expansions in the build, sha and checksum steps.📝 Committable suggestion
🧰 Tools
🪛 zizmor (1.28.0)
[error] 156-156: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 157-157: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🤖 Prompt for AI Agents
Source: Linters/SAST tools