30 lines
1.3 KiB
Bash
30 lines
1.3 KiB
Bash
#!/usr/bin/env bash
|
|
# Append the Security Verification section to the release notes: per-binary
|
|
# sha256 + VirusTotal links. This step only runs after check-virustotal.sh
|
|
# passed, and that gate is ZERO tolerance — any detection blocks the release —
|
|
# so "0 detections" here is a verified statement, never an assumption.
|
|
# Expects: GH_TOKEN, VERSION; run from the verify job workspace (binaries/).
|
|
set -euo pipefail
|
|
|
|
TABLE="\n\n## Security Verification\n\n"
|
|
TABLE+="All release binaries scanned with 70+ antivirus engines — **0 detections**.\n\n"
|
|
TABLE+="| Binary | SHA-256 | VirusTotal |\n"
|
|
TABLE+="|--------|---------|------------|\n"
|
|
|
|
for bin in binaries/codebase-memory-mcp-*; do
|
|
[ -f "$bin" ] || continue
|
|
name=$(basename "$bin")
|
|
sha256=$(sha256sum "$bin" 2>/dev/null | awk '{print $1}' \
|
|
|| shasum -a 256 "$bin" | awk '{print $1}')
|
|
label=$(echo "$name" | sed 's/^codebase-memory-mcp-//' | sed 's/\.exe$//')
|
|
short="${sha256:0:20}..."
|
|
vt_url="https://www.virustotal.com/gui/file/${sha256}/detection"
|
|
TABLE+="| \`${label}\` | \`${short}\` | [0 detections ✅](${vt_url}) |\n"
|
|
done
|
|
|
|
CURRENT=$(gh release view "$VERSION" \
|
|
--json body --jq '.body // ""' --repo "$GITHUB_REPOSITORY")
|
|
printf '%s%b' "$CURRENT" "$TABLE" > /tmp/release_notes.md
|
|
gh release edit "$VERSION" \
|
|
--notes-file /tmp/release_notes.md --repo "$GITHUB_REPOSITORY"
|