Skip to content

Harden cask validation checkout #23

Harden cask validation checkout

Harden cask validation checkout #23

Workflow file for this run

name: Validate cask
on:
pull_request:
branches:
- main
push:
branches:
- main
permissions:
contents: read
jobs:
validate-cask:
name: validate-cask
runs-on: macos-latest
steps:
- name: Checkout
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
persist-credentials: false
- name: Check Ruby syntax
run: ruby -c Casks/openai.rb
- name: Tap local repository
run: brew tap openai/tools "$GITHUB_WORKSPACE"
- name: Check Homebrew can load the tap
run: brew readall openai/tools
- name: Validate generated cask structure
run: |
ruby <<'RUBY'
cask = File.read("Casks/openai.rb")
checks = {
"generated header" => cask.start_with?("# This file was generated by GoReleaser. DO NOT EDIT.\n"),
"openai cask token" => cask.match?(/^cask "openai" do$/),
"semantic version" => cask.match?(/^ version "\d+\.\d+\.\d+"$/),
"homepage" => cask.include?(' homepage "https://developers.openai.com/api/docs"'),
"binary" => cask.include?(' binary "openai"'),
"manpage" => cask.include?(' manpage "man/man1/openai.1.gz"'),
}
expected_artifacts = {
"macos amd64 zip" => /openai_#\{version\}_macos_amd64\.zip/,
"macos arm64 zip" => /openai_#\{version\}_macos_arm64\.zip/,
"linux amd64 tarball" => /openai_#\{version\}_linux_amd64\.tar\.gz/,
"linux arm64 tarball" => /openai_#\{version\}_linux_arm64\.tar\.gz/,
}
expected_artifacts.each do |name, pattern|
checks[name] = cask.match?(pattern)
end
checks["release host"] = cask.scan(%r{https://github\.com/openai/openai-cli/releases/download/v#\{version\}/}).length == 4
checks["sha256 count"] = cask.scan(/^\s+sha256 "[a-f0-9]{64}"$/).length == 4
failed = checks.select { |_name, passed| !passed }.keys
abort("Cask validation failed: #{failed.join(', ')}") if failed.any?
RUBY