The request
Hi again!
Would you be open to adding a release mechanism that would add "build artifacts" (i.e., bash-minifier.sh) to releases so that they can be downloaded without pulling the tarball? (yes, one could just pull the raw content of the one file and accomplish the same thing; they could also pin to specific commit hashes. Understood.) Additionally, would you be open to including in those releases SHA-256 hashes of the build artifact and adding attestation?
Here's an example where I do it now:
https://github.com/wesley-dean/bootstrap/blob/63f7298f8df052ed2f5ca406e07782d7ba4a6c52/.github/workflows/semver.yml#L60-L87
I'm happy to put together a PR with a GitHub Action does what needs to be done. We can even set it up to automatically generate releases when commits to the default branch are merged in so that it's zero extra effort for you.
Background information
I'm working on a couple of Bash development projects and I'm thinking of including in the build process a step to run bash-minifier on the artifact and including it in the releases.
The "build process" for these Bash scripts is to concatenate a common header along with modularized source code (i.e., cat a bunch of files together and put them into one file). Here's an example:
https://github.com/wesley-dean/bootstrap/blob/63f7298f8df052ed2f5ca406e07782d7ba4a6c52/Makefile#L49-L70
One of the lines in that process strips full-line comments:
https://github.com/wesley-dean/bootstrap/blob/63f7298f8df052ed2f5ca406e07782d7ba4a6c52/Makefile#L49-L67
I would like to refactor this so that the build target does pretty much what it does now; this will be the package.dev.bash artifact. After that, it'll run the comment stripper to produce the package.bash artifact. After that, it'll run bash-minifier.sh to produce package.min.bash.
If you're interested in the reasoning, here are the relevant ADRs:
The relevance of this background is that I would like to automate the pulling of bash-minifier.sh at "build time" into my release processes and to do that as safely as possible, I would like to be able to compare the hash of what's downloaded with what's expected and, in the even of mismatches, fail the builds.
Alternative I considered
My dependency downloader can store in advance the SHA-256 hash of the expected download and then compare that stored version with whatever is downloaded. The "problem" is that I then have to either update the hash when a changes to bash-minifier come out or pin to specific commits and manually update the download URL and hash when new changes come out.
The request
Hi again!
Would you be open to adding a release mechanism that would add "build artifacts" (i.e.,
bash-minifier.sh) to releases so that they can be downloaded without pulling the tarball? (yes, one could just pull the raw content of the one file and accomplish the same thing; they could also pin to specific commit hashes. Understood.) Additionally, would you be open to including in those releases SHA-256 hashes of the build artifact and adding attestation?Here's an example where I do it now:
https://github.com/wesley-dean/bootstrap/blob/63f7298f8df052ed2f5ca406e07782d7ba4a6c52/.github/workflows/semver.yml#L60-L87
I'm happy to put together a PR with a GitHub Action does what needs to be done. We can even set it up to automatically generate releases when commits to the default branch are merged in so that it's zero extra effort for you.
Background information
I'm working on a couple of Bash development projects and I'm thinking of including in the build process a step to run bash-minifier on the artifact and including it in the releases.
The "build process" for these Bash scripts is to concatenate a common header along with modularized source code (i.e.,
cata bunch of files together and put them into one file). Here's an example:https://github.com/wesley-dean/bootstrap/blob/63f7298f8df052ed2f5ca406e07782d7ba4a6c52/Makefile#L49-L70
One of the lines in that process strips full-line comments:
https://github.com/wesley-dean/bootstrap/blob/63f7298f8df052ed2f5ca406e07782d7ba4a6c52/Makefile#L49-L67
I would like to refactor this so that the
buildtarget does pretty much what it does now; this will be thepackage.dev.bashartifact. After that, it'll run the comment stripper to produce thepackage.bashartifact. After that, it'll runbash-minifier.shto producepackage.min.bash.If you're interested in the reasoning, here are the relevant ADRs:
The relevance of this background is that I would like to automate the pulling of
bash-minifier.shat "build time" into my release processes and to do that as safely as possible, I would like to be able to compare the hash of what's downloaded with what's expected and, in the even of mismatches, fail the builds.Alternative I considered
My dependency downloader can store in advance the SHA-256 hash of the expected download and then compare that stored version with whatever is downloaded. The "problem" is that I then have to either update the hash when a changes to bash-minifier come out or pin to specific commits and manually update the download URL and hash when new changes come out.