fix: make runtime release six-platform safe

Use an allowed local file URL for the browser smoke test, centralize keyless archive signing after native builds so Windows ARM64 does not require an unavailable Cosign binary, and advance the immutable bootstrap channel to RC2.
This commit is contained in:
Sinabina
2026-07-20 16:58:31 -07:00
parent b0047cc525
commit dbf94804ad
10 changed files with 35 additions and 21 deletions
@@ -57,10 +57,18 @@ describe("GStack runtime release channel", () => {
test("release workflow publishes both RC and stable tags through the same signed manifest path", async () => {
const workflow = await fs.readFile(WORKFLOW, "utf8");
const buildSection = workflow.slice(workflow.indexOf(" build:"), workflow.indexOf("\n manifest:"));
const manifestSection = workflow.slice(workflow.indexOf("\n manifest:"));
expect(workflow).toContain("v2.0.0-rc.*");
expect(workflow).toContain('2.0.0 "$GITHUB_REF_NAME"');
expect(workflow).toContain("PRERELEASE_FLAG:");
expect(workflow).toContain("--prerelease");
expect(workflow).toContain('gh release create "$GITHUB_REF_NAME"');
expect(workflow).toContain("pathToFileURL(p).href");
expect(workflow).not.toContain("goto about:blank");
expect(buildSection).not.toContain("sigstore/cosign-installer");
expect(manifestSection).toContain("sigstore/cosign-installer");
expect(manifestSection.indexOf("Keyless-sign component archives"))
.toBeLessThan(manifestSection.indexOf("Create strict six-target manifest"));
});
});