From 3771be8c05ed0b08e25ab564983bb424af08659f Mon Sep 17 00:00:00 2001 From: Maxerns Date: Thu, 30 Jul 2026 22:15:48 +0100 Subject: [PATCH 1/2] add install outputs --- .github/workflows/test.yml | 28 ++++++++++++++++++++++++---- README.md | 30 +++++++++++++++++++++++++----- action.yml | 13 +++++++++++++ scripts/install.ps1 | 3 +++ scripts/install.sh | 5 +++++ 5 files changed, 70 insertions(+), 9 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index f28f3f5..0e04efe 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -37,15 +37,32 @@ jobs: strategy: fail-fast: false matrix: - os: [ubuntu-latest, macos-latest, windows-latest] - runs-on: ${{ matrix.os }} + include: + - runner: ubuntu-latest + target: x86_64-unknown-linux-gnu + - runner: ubuntu-24.04-arm + target: aarch64-unknown-linux-gnu + - runner: macos-latest + target: aarch64-apple-darwin + - runner: macos-15-intel + target: x86_64-apple-darwin + - runner: windows-latest + target: x86_64-pc-windows-msvc + runs-on: ${{ matrix.runner }} steps: - uses: actions/checkout@v4 - - uses: ./ + - id: sotto + name: Install sotto + uses: ./ with: sotto-version: ${{ env.SOTTO_TEST_VERSION }} - - name: sotto --version actually reports the pinned version + - name: Check the installed version and outputs shell: bash + env: + OUTPUT_VERSION: ${{ steps.sotto.outputs.version }} + OUTPUT_TARGET: ${{ steps.sotto.outputs.target }} + OUTPUT_BINARY_PATH: ${{ steps.sotto.outputs.binary-path }} + EXPECTED_TARGET: ${{ matrix.target }} run: | set -euo pipefail actual="$(sotto --version)" @@ -55,3 +72,6 @@ jobs: echo "expected '$actual' to equal '$expected'" >&2 exit 1 fi + test "$OUTPUT_VERSION" = "$SOTTO_TEST_VERSION" + test "$OUTPUT_TARGET" = "$EXPECTED_TARGET" + test -f "$OUTPUT_BINARY_PATH" diff --git a/README.md b/README.md index 8cac626..fb4cd5c 100644 --- a/README.md +++ b/README.md @@ -23,13 +23,33 @@ values - that stays entirely under your workflow's control via `sotto run --` / `sotto-version` is **required** - there is no implicit "latest", so a new Sotto release can never silently change your CI's behaviour. Pin it the same way you'd pin any other tool version. -Works across `ubuntu-latest`, `macos-latest`, and `windows-latest` runners: internally this -downloads the archive for the selected release, verifies its checksum and Sigstore signature, and -checks that the installed binary reports the requested version. Signature verification is -mandatory: a missing or invalid bundle fails the job rather than falling back to a checksum-only -install. The verification identity is pinned to the selected tag of Sotto's release workflow; see +The action supports x86_64 and ARM64 Linux, x86_64 and Apple Silicon macOS, and x86_64 Windows. +Internally it downloads the archive for the selected release, verifies its checksum and Sigstore +signature, and checks that the installed binary reports the requested version. Signature +verification is mandatory: a missing or invalid bundle fails the job rather than falling back to +a checksum-only install. The verification identity is pinned to the selected tag of Sotto's +release workflow; see [SECURITY.md](https://github.com/getsotto/sotto/blob/main/SECURITY.md) for the release model. +## Outputs + +Give the step an `id` to use the resolved installation details in later steps: + +```yaml +- uses: getsotto/sotto-action@v1 + id: sotto + with: + sotto-version: v0.4.0 + +- run: echo "installed ${{ steps.sotto.outputs.version }} for ${{ steps.sotto.outputs.target }}" +``` + +| Output | Example | +| --- | --- | +| `version` | `v0.4.0` | +| `target` | `aarch64-apple-darwin` | +| `binary-path` | `/path/to/sotto-bin/sotto` | + ## Versioning This action is tagged independently of the `sotto` CLI's own version (`v0.1.0`, `v0.2.0`, ...) - diff --git a/action.yml b/action.yml index ff1c448..d347534 100644 --- a/action.yml +++ b/action.yml @@ -12,6 +12,17 @@ inputs: new Sotto release can never silently change your CI's behaviour. required: true +outputs: + version: + description: "The installed Sotto release tag" + value: ${{ steps.install-unix.outputs.version || steps.install-windows.outputs.version }} + target: + description: "The installed Sotto release target" + value: ${{ steps.install-unix.outputs.target || steps.install-windows.outputs.target }} + binary-path: + description: "The absolute path to the installed Sotto binary" + value: ${{ steps.install-unix.outputs.binary-path || steps.install-windows.outputs.binary-path }} + runs: using: "composite" steps: @@ -44,6 +55,7 @@ runs: install-dir: ${{ runner.temp }}/cosign - name: Install sotto (Linux/macOS) + id: install-unix if: runner.os != 'Windows' shell: bash env: @@ -52,6 +64,7 @@ runs: run: '"${{ github.action_path }}/scripts/install.sh"' - name: Install sotto (Windows) + id: install-windows if: runner.os == 'Windows' shell: pwsh env: diff --git a/scripts/install.ps1 b/scripts/install.ps1 index 24ee257..47096cf 100644 --- a/scripts/install.ps1 +++ b/scripts/install.ps1 @@ -117,6 +117,9 @@ try { } $InstallDir | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append + "version=$Version" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append + "target=$Target" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append + "binary-path=$BinaryPath" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append Write-Host "installed $BinaryPath" } finally { diff --git a/scripts/install.sh b/scripts/install.sh index 5cf5ce2..06d56f4 100755 --- a/scripts/install.sh +++ b/scripts/install.sh @@ -110,5 +110,10 @@ expected="sotto ${version#v}" fail "installed binary reported '$actual', expected '$expected'" printf '%s\n' "$install_dir" >>"$GITHUB_PATH" +{ + printf 'version=%s\n' "$version" + printf 'target=%s\n' "$target" + printf 'binary-path=%s\n' "$install_dir/sotto" +} >>"$GITHUB_OUTPUT" say "installed $install_dir/sotto" From 3dd7f80c1e2106b5c982674156972a64076eb8ff Mon Sep 17 00:00:00 2001 From: Maxerns Date: Thu, 30 Jul 2026 22:29:09 +0100 Subject: [PATCH 2/2] clarify platform outputs --- .github/workflows/test.yml | 8 +++++--- README.md | 12 ++++++------ action.yml | 1 + 3 files changed, 12 insertions(+), 9 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 0e04efe..164ea24 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -1,7 +1,9 @@ -# Exercises the action itself (this repo's whole reason to exist) across every runner OS it -# claims to support. Pinned to a real getsotto/sotto tag rather than "latest" - matches the -# action's own no-implicit-latest posture. +# Exercises the action itself (this repo's whole reason to exist) across every release target it +# supports. macos-latest is ARM64, so macos-15-intel covers the separate x86_64 release; likewise, +# ubuntu-24.04-arm covers Linux ARM64 alongside the default x86_64 Ubuntu runner. # +# The test is pinned to a real getsotto/sotto tag rather than "latest", matching the action's own +# no-implicit-latest posture. # v0.4.0 is the first getsotto/sotto release with Windows and Linux ARM64 artifacts (v0.3.0 and # earlier predate that work), so this is also the first version this test can actually pass # against on windows-latest. diff --git a/README.md b/README.md index fb4cd5c..05b60a5 100644 --- a/README.md +++ b/README.md @@ -23,7 +23,7 @@ values - that stays entirely under your workflow's control via `sotto run --` / `sotto-version` is **required** - there is no implicit "latest", so a new Sotto release can never silently change your CI's behaviour. Pin it the same way you'd pin any other tool version. -The action supports x86_64 and ARM64 Linux, x86_64 and Apple Silicon macOS, and x86_64 Windows. +The action supports x86_64 and ARM64 Linux, x86_64 and ARM64 macOS, and x86_64 Windows. Internally it downloads the archive for the selected release, verifies its checksum and Sigstore signature, and checks that the installed binary reports the requested version. Signature verification is mandatory: a missing or invalid bundle fails the job rather than falling back to @@ -44,11 +44,11 @@ Give the step an `id` to use the resolved installation details in later steps: - run: echo "installed ${{ steps.sotto.outputs.version }} for ${{ steps.sotto.outputs.target }}" ``` -| Output | Example | -| --- | --- | -| `version` | `v0.4.0` | -| `target` | `aarch64-apple-darwin` | -| `binary-path` | `/path/to/sotto-bin/sotto` | +| Output | Description | macOS example | Windows example | +| --- | --- | --- | --- | +| `version` | Selected release tag | `v0.4.0` | `v0.4.0` | +| `target` | Resolved release target | `aarch64-apple-darwin` | `x86_64-pc-windows-msvc` | +| `binary-path` | Absolute installed binary path | `/Users/runner/work/_temp/sotto-bin/sotto` | `D:\a\_temp\sotto-bin\sotto.exe` | ## Versioning diff --git a/action.yml b/action.yml index d347534..c81501d 100644 --- a/action.yml +++ b/action.yml @@ -13,6 +13,7 @@ inputs: required: true outputs: + # Exactly one platform install step runs. Select the output from whichever step was not skipped. version: description: "The installed Sotto release tag" value: ${{ steps.install-unix.outputs.version || steps.install-windows.outputs.version }}