init release verify subcommands #11018
Conversation
|
Hi! Thanks for the pull request. Please ensure that this change is linked to an issue by mentioning an issue number in the description of the pull request. If this pull request would close the issue, please put the word 'Fixes' before the issue number somewhere in the pull request body. If this is a tiny change like fixing a typo, feel free to ignore this message. |
There was a problem hiding this comment.
@ejahnGithub : I will need to devote more time to really grok everything going on here, but I wanted to provide some initial feedback that I think is important to discuss further from a maintenance perspective.
|
Hi! Thanks for the pull request. Please ensure that this change is linked to an issue by mentioning an issue number in the description of the pull request. If this pull request would close the issue, please put the word 'Fixes' before the issue number somewhere in the pull request body. If this is a tiny change like fixing a typo, feel free to ignore this message. |
| @@ -133,6 +133,41 @@ type fetchResult struct { | |||
| error error | |||
| } | |||
|
|
|||
| func FetchRefSHA(ctx context.Context, httpClient *http.Client, repo ghrepo.Interface, tagName string) (string, error) { | |||
| path := fmt.Sprintf("repos/%s/%s/git/refs/tags/%s", repo.RepoOwner(), repo.RepoName(), tagName) | |||
| req, err := http.NewRequestWithContext(ctx, "GET", ghinstance.RESTPrefix(repo.RepoHost())+path, nil) | |||
There was a problem hiding this comment.
I think there are some built in functions in the gh-go library for making HTTP requests we can leverage.
3adea16 to
365fadb
Compare
Signed-off-by: Brian DeHamer <bdehamer@github.com>
365fadb to
53cae59
Compare
|
With @ejahnGithub out for a couple of weeks I'm taking over responsibility for this PR. I've gone through and done a bit of refactoring and attempted to address your feedback in the process. Would appreciate you each taking another look. |
This PR adds two beta gh release subcommands—
verifyandverify-asset—to support release attestations. Both commands are still in the testing phase and not yet exposed in the public CLI.Here’s a clean summary of the expected output for the new gh release verify and gh release verify-asset subcommands:
Expected output:
gh release verify with taggh release verify without taggh release verify-asset with taggh release verify-asset without tag