Maple/.github/workflows/web-build.yml at master · MaplePrivacyLabs/Maple · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
name: Web App Build

# Release evidence: the attested master web artifact and its independent
# verification (.agents/skills/release-maple/scripts/ci_evidence.py). Pull
# requests build the same artifact in ci.yml's research-web lane. Never cancelled.
permissions:
  contents: read

on:
  push:
    branches: [ master ]
    paths:
      - ".github/workflows/web-build.yml"
      - "apps/maple-research/frontend/**"
      - "!apps/maple-research/frontend/src-tauri/**"
      - "scripts/prepare-frontend-deps.sh"
      - "scripts/prepare-typescript-sdk.sh"
      - "scripts/ci/_common.sh"
      - "scripts/ci/web.sh"
      - "flake.nix"
      - "flake.lock"

jobs:
  build-web-master:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      id-token: write
      attestations: write
      artifact-metadata: write
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
        with:
          persist-credentials: false

      - name: Install Nix
        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
        with:
          source-tag: v3.23.3
          github-token: ""

      - name: Verify pinned Nix runtime
        run: bash scripts/ci/verify-nix-runtime.sh

      - name: Build web artifact
        run: nix develop --no-update-lock-file .#ci -c ./scripts/ci/web.sh
        env:
          MAPLE_WEB_ENVIRONMENT: release

      - name: Collect web checksums
        run: cat apps/maple-research/frontend/src-tauri/target/reproducibility/web-final.sha256

      - name: Attest web artifact
        # Keep uploads/verifiers running if GitHub token policy rejects artifact attestation.
        continue-on-error: true
        uses: actions/attest@281a49d4cbb0a72c9575a50d18f6deb515a11deb # was v4
        with:
          subject-checksums: apps/maple-research/frontend/src-tauri/target/reproducibility/web-final.sha256

      - name: Upload web artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # was v4
        with:
          name: maple-web
          path: |
            apps/maple-research/frontend/src-tauri/target/reproducibility/maple-web-dist.tar.gz
            apps/maple-research/frontend/src-tauri/target/reproducibility/web-final.sha256
          retention-days: 5

  verify-web-master-artifact:
    needs: build-web-master
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
        with:
          persist-credentials: false

      - name: Install Nix
        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
        with:
          source-tag: v3.23.3
          github-token: ""

      - name: Verify pinned Nix runtime
        run: bash scripts/ci/verify-nix-runtime.sh

      - name: Download web artifact
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4
        with:
          name: maple-web
          path: artifacts

      - name: Verify web artifact reproducibility proof
        run: nix develop --no-update-lock-file .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts web