27 lines
1.0 KiB
YAML
27 lines
1.0 KiB
YAML
name: Prepare qualified release inputs
|
|
description: Restore and validate the exact qualified tarball and its verifier runtime
|
|
outputs:
|
|
version:
|
|
description: Package version validated against the source and qualified manifest
|
|
value: ${{ steps.package.outputs.version }}
|
|
tarball:
|
|
description: Absolute path to the validated qualified npm tarball
|
|
value: ${{ steps.package.outputs.tarball }}
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Download the exact qualified package
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
|
with:
|
|
name: verified-release-package
|
|
path: .cache/verified-package/
|
|
- name: Verify qualified package provenance and digest
|
|
id: package
|
|
shell: bash
|
|
run: node scripts/ci/verified-package.mjs validate .cache/verified-package
|
|
- name: Restore qualified verifier runtime
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
|
with:
|
|
name: rea-test-runtime
|
|
path: .
|