Redo CI Pipeline security to prevent duplicate checks

This commit is contained in:
Jordan Dominion
2024-08-16 12:58:26 -04:00
parent e8a402ecbc
commit 8470e682b4
3 changed files with 100 additions and 165 deletions
@@ -60,7 +60,6 @@ namespace Tgstation.Server.ReleaseNotes
var shaCheck = versionString.Equals("--winget-template-check", StringComparison.OrdinalIgnoreCase);
var fullNotes = versionString.Equals("--generate-full-notes", StringComparison.OrdinalIgnoreCase);
var nuget = versionString.Equals("--nuget", StringComparison.OrdinalIgnoreCase);
var ciCompletionCheck = versionString.Equals("--ci-completion-check", StringComparison.OrdinalIgnoreCase);
var genToken = versionString.Equals("--token-output-file", StringComparison.OrdinalIgnoreCase);
if ((!Version.TryParse(versionString, out var version) || version.Revision != -1)
@@ -69,7 +68,6 @@ namespace Tgstation.Server.ReleaseNotes
&& !shaCheck
&& !fullNotes
&& !nuget
&& !ciCompletionCheck
&& !genToken)
{
Console.WriteLine("Invalid version: " + versionString);
@@ -151,17 +149,6 @@ namespace Tgstation.Server.ReleaseNotes
return await Winget(client, actionsUrl, null);
}
if (ciCompletionCheck)
{
if (args.Length < 3)
{
Console.WriteLine("Missing SHA or PEM Base64 for creating check run!");
return 4543;
}
return await CICompletionCheck(client, args[1], args[2]);
}
if (genToken)
{
@@ -1676,21 +1663,6 @@ package (version) distribution(s); urgency=urgency
gitHubClient.Credentials = new Credentials(installToken.Token);
}
static async ValueTask<int> CICompletionCheck(GitHubClient gitHubClient, string currentSha, string pemBase64)
{
await GenerateAppCredentials(gitHubClient, pemBase64, false);
await gitHubClient.Check.Run.Create(RepoOwner, RepoName, new NewCheckRun("CI Completion", currentSha)
{
CompletedAt = DateTime.UtcNow,
Conclusion = CheckConclusion.Success,
Output = new NewCheckRunOutput("CI Completion", "The CI Pipeline completed successfully"),
Status = CheckStatus.Completed,
});
return 0;
}
static void DebugAssert(bool condition, string message = null)
{
// This exists because one of the fucking asserts evaluates an enumerable or something and it was getting optimized out in release