mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-10 02:25:56 +00:00
pulse-triage[bot]
43 lines
1.7 KiB
Bash
Executable File
43 lines
1.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# Refuse to make release decisions with GitHub CLI versions whose attestation
|
|
# identity matching is known to be unsafe. GitHub CLI 2.97.0 escaped repository
|
|
# and workflow names before constructing the certificate matcher; older
|
|
# versions can accept a lookalike signer for a literal --signer-workflow policy.
|
|
|
|
set -euo pipefail
|
|
|
|
readonly MINIMUM_GH_VERSION="2.97.0"
|
|
|
|
if ! version_output="$(gh version 2>/dev/null | head -n 1)"; then
|
|
echo "Unable to run the GitHub CLI required for safe attestation verification." >&2
|
|
exit 1
|
|
fi
|
|
if ! [[ "$version_output" =~ ^gh\ version\ ([0-9]+\.[0-9]+\.[0-9]+) ]]; then
|
|
echo "Unable to determine the GitHub CLI version required for safe attestation verification." >&2
|
|
exit 1
|
|
fi
|
|
actual_version="${BASH_REMATCH[1]}"
|
|
|
|
version_at_least() {
|
|
local actual="$1"
|
|
local required="$2"
|
|
local actual_major actual_minor actual_patch
|
|
local required_major required_minor required_patch
|
|
|
|
IFS=. read -r actual_major actual_minor actual_patch <<<"$actual"
|
|
IFS=. read -r required_major required_minor required_patch <<<"$required"
|
|
|
|
(( actual_major > required_major )) ||
|
|
{ (( actual_major == required_major )) && (( actual_minor > required_minor )); } ||
|
|
{ (( actual_major == required_major )) && (( actual_minor == required_minor )) &&
|
|
(( actual_patch >= required_patch )); }
|
|
}
|
|
|
|
if ! version_at_least "$actual_version" "$MINIMUM_GH_VERSION"; then
|
|
echo "GitHub CLI ${actual_version} is too old for release attestation policy enforcement; ${MINIMUM_GH_VERSION} or newer is required." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "[OK] GitHub CLI ${actual_version} satisfies the safe attestation verifier floor (${MINIMUM_GH_VERSION})." >&2
|