h/fish-shell
1
Fork 0
mirror of https://github.com/fish-shell/fish-shell.git synced 2026-05-28 01:01:12 -03:00
Code Issues Packages Projects Releases Wiki Activity

Sign releases again

Browse Source 
The new automation workflow doesn't sign the Git tag or the tarball as
we used to.  Since the tag is still created locally, sign it directly.

For signing the tarball; build it locally and compare the extracted
tarball with the one produced by GitHub.

Closes #11996
This commit is contained in:
Johannes Altmanninger
2025-10-26 08:49:28 +01:00
parent ca8b18cad5
commit cb320e17ed
5 changed files with 40 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.github/workflows/release.yml vendored
View File

@@ -52,7 +52,10 @@ jobs:
# Need history since the last release (i.e. tag) for stats.
git fetch --tags
git fetch --unshallow
sh -x ./build_tools/release-notes.sh >"$relnotes"
gpg_public_key_url=https://github.com/${{ github.actor }}.gpg
curl -sS "$gpg_public_key_url" | grep 'PGP PUBLIC KEY BLOCK' -A5
FISH_GPG_PUBLIC_KEY_URL=$gpg_public_key_url \
sh -x ./build_tools/release-notes.sh >"$relnotes"
# Delete title
sed -n 1p "$relnotes" | grep -q "^## fish .*"
sed -n 2p "$relnotes" | grep -q '^$'