[ci] Validate downloaded build artifact (#31847)
Adds validation to download-build-artifacts to confirm that the downloaded artifact matches what was requested. --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/facebook/react/pull/31847). * #31848 * __->__ #31847 * #31846
lauren committed
Dec 18, 2024 at 20:09 UTC
74e39ce2a1eec803936db8a29349f6fda176cce7
1 file changed
+14
-3
scripts/release/shared-commands/download-build-artifacts.js
+14
-3
@@ -3,7 +3,7 @@
3
const {join} = require('path');
4
const theme = require('../theme');
5
const {exec} = require('child-process-promise');
6
-const {existsSync} = require('fs');
6
+const {existsSync, readFileSync} = require('fs');
7
const {logPromise} = require('../utils');
8
9
if (process.env.GH_TOKEN == null) {
@@ -80,7 +80,7 @@ async function getArtifact(workflowRunId, artifactName) {
80
return artifact;
81
}
82
83
-async function processArtifact(artifact, releaseChannel) {
83
+async function processArtifact(artifact, commit, releaseChannel) {
84
// Download and extract artifact
85
const cwd = join(__dirname, '..', '..', '..');
86
await exec(`rm -rf ./build`, {cwd});
@@ -117,6 +117,17 @@ async function processArtifact(artifact, releaseChannel) {
117
await exec(`cp -r ./build/${sourceDir} ./build/node_modules`, {
118
cwd,
119
});
120
+
121
+ // Validate artifact
122
+ const buildSha = readFileSync('./build/COMMIT_SHA', 'utf8').replace(
123
+ /[\u0000-\u001F\u007F-\u009F]/g,
124
+ ''
125
+ );
126
+ if (buildSha !== commit) {
127
+ throw new Error(
128
+ `Requested commit sha does not match downloaded artifact. Expected: ${commit}, got: ${buildSha}`
129
+ );
130
+ }
131
}
132
133
async function downloadArtifactsFromGitHub(commit, releaseChannel) {
@@ -141,7 +152,7 @@ async function downloadArtifactsFromGitHub(commit, releaseChannel) {
152
workflowRun.id,
153
'artifacts_combined'
154
);
144
- await processArtifact(artifact, releaseChannel);
155
+ await processArtifact(artifact, commit, releaseChannel);
156
return;
157
} else {
158
console.log(