ci: publish v0.1.0 artifacts through GitLab and OSS

.github/workflows/ci.yml

@@ -77,7 +77,7 @@ jobs:
       - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
         with:
           version: v2.17.0
-          args: release --snapshot --clean --skip=sign
+          args: release --snapshot --clean
       - run: ./tools/check_release_artifacts.sh
 
   security:

.gitignore

@@ -2,6 +2,7 @@
 /midtrans
 /.superpowers/
 /docs/superpowers/
+/.worktrees/
 **/__pycache__/
 **/*.pyc
 /evaluations/fixtures/*/.state/

.gitlab-ci.yml

@@ -0,0 +1,205 @@
+workflow:
+  rules:
+    - if: $CI_COMMIT_TAG
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "main"'
+    - when: never
+
+stages:
+  - validate
+  - verify
+  - package
+  - publish
+
+variables:
+  GIT_DEPTH: "0"
+  BUCKET_PUBLIC_DIR: al-mp-id-p-midtrans-cli
+  GORELEASER_VERSION: v2.17.0
+  SYFT_VERSION: v1.42.3
+
+validate:release-ref:
+  stage: validate
+  image: golang:1.26.5
+  script:
+    - |
+      set -eu
+      if [ -n "${CI_COMMIT_TAG:-}" ]; then
+        echo "$CI_COMMIT_TAG" | grep -Eq '^v[0-9]+[.][0-9]+[.][0-9]+$'
+        test "$(git cat-file -t "$CI_COMMIT_TAG")" = "tag"
+        git fetch origin main:refs/remotes/origin/main --tags --force
+        git merge-base --is-ancestor "$CI_COMMIT_SHA" origin/main
+      else
+        test "$CI_PIPELINE_SOURCE" = "push"
+        test "$CI_COMMIT_BRANCH" = "main"
+      fi
+
+verify:release:
+  stage: verify
+  image: golang:1.26.5
+  needs:
+    - validate:release-ref
+  before_script:
+    - apt-get update -qq
+    - >-
+      DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends
+      ca-certificates curl git jq nodejs npm python3 ripgrep ruby
+    - rm -rf /var/lib/apt/lists/*
+  script:
+    - ./tools/check_release.sh
+
+package:release:
+  stage: package
+  image: golang:1.26.5
+  needs:
+    - validate:release-ref
+    - verify:release
+  before_script:
+    - apt-get update -qq
+    - >-
+      DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends
+      ca-certificates git jq
+    - rm -rf /var/lib/apt/lists/*
+  script:
+    - |
+      set -eu
+      export PATH="$(go env GOPATH)/bin:$PATH"
+      go install "github.com/anchore/syft/cmd/syft@${SYFT_VERSION}"
+
+      if [ -z "${CI_COMMIT_TAG:-}" ]; then
+        go run "github.com/goreleaser/goreleaser/v2@${GORELEASER_VERSION}" \
+          release --snapshot --clean
+        ./tools/check_release_artifacts.sh
+        exit 0
+      fi
+
+      : "${OSS_PUBLIC_BASE_URL:?OSS_PUBLIC_BASE_URL is required for release tags}"
+      go run "github.com/goreleaser/goreleaser/v2@${GORELEASER_VERSION}" \
+        release --clean --skip=publish
+      ./tools/check_release_artifacts.sh
+      go run ./tools/release-manifest \
+        --dist dist \
+        --output dist/release-manifest.json \
+        --version "${CI_COMMIT_TAG#v}" \
+        --tag "$CI_COMMIT_TAG" \
+        --commit "$CI_COMMIT_SHA" \
+        --project-path "$CI_PROJECT_PATH" \
+        --pipeline-id "$CI_PIPELINE_ID" \
+        --pipeline-url "$CI_PIPELINE_URL" \
+        --public-base-url "$OSS_PUBLIC_BASE_URL" \
+        --public-dir "$BUCKET_PUBLIC_DIR" \
+        --built-at "$CI_PIPELINE_CREATED_AT"
+
+      mkdir release-upload
+      jq -r '.artifacts[].name' dist/release-manifest.json |
+        while IFS= read -r artifact; do
+          test "$(basename "$artifact")" = "$artifact"
+          cp "dist/$artifact" "release-upload/$artifact"
+        done
+      cp dist/release-manifest.json release-upload/release-manifest.json
+  artifacts:
+    when: on_success
+    expire_in: 90 days
+    paths:
+      - dist/
+      - release-upload/
+
+publish:oss:
+  stage: publish
+  image:
+    name: asia.gcr.io/gopay-systems/cx-oss:latest
+    entrypoint: [""]
+  tags:
+    - gopaysh
+  needs:
+    - job: package:release
+      artifacts: true
+  id_tokens:
+    ALICLOUD_ID_TOKEN:
+      aud: https://source.golabs.io
+  variables:
+    ALICLOUD_BUCKET: $ALICLOUD_PRD_BUCKET
+    ALICLOUD_ACCOUNT_ID: $ALICLOUD_PRD_ACCOUNT_ID
+    ALICLOUD_ROLE_NAME: $ALICLOUD_PRD_ROLE_NAME
+    ALIBABA_CLOUD_REGION: $ALIBABA_PRD_CLOUD_REGION
+  environment:
+    name: public-release
+  script:
+    - |
+      set -eu
+      : "${CI_COMMIT_TAG:?release tag is required}"
+      : "${ALICLOUD_BUCKET:?ALICLOUD_PRD_BUCKET is required}"
+      : "${ALICLOUD_ACCOUNT_ID:?ALICLOUD_PRD_ACCOUNT_ID is required}"
+      : "${ALICLOUD_ROLE_NAME:?ALICLOUD_PRD_ROLE_NAME is required}"
+      : "${ALIBABA_CLOUD_REGION:?ALIBABA_PRD_CLOUD_REGION is required}"
+      : "${OSS_PUBLIC_BASE_URL:?OSS_PUBLIC_BASE_URL is required}"
+      test -f release-upload/release-manifest.json
+
+      manifest_tmp=$(mktemp)
+      mv release-upload/release-manifest.json "$manifest_tmp"
+      trap 'rm -f .oss-credentials "$manifest_tmp"' EXIT
+
+      oss auth
+      . .oss-credentials
+
+      destination="oss://$ALICLOUD_BUCKET/$BUCKET_PUBLIC_DIR/releases/$CI_COMMIT_TAG/$CI_PIPELINE_ID/"
+      ossutil cp release-upload/ "$destination" \
+        --recursive --region "$ALIBABA_CLOUD_REGION"
+      ossutil cp "$manifest_tmp" "${destination}release-manifest.json" \
+        --region "$ALIBABA_CLOUD_REGION"
+  rules:
+    - if: '$CI_COMMIT_TAG =~ /^v[0-9]+[.][0-9]+[.][0-9]+$/'
+      when: manual
+    - when: never
+
+verify:published:
+  stage: publish
+  image: alpine:3.22
+  needs:
+    - publish:oss
+  before_script:
+    - apk add --no-cache curl jq
+  script:
+    - |
+      set -eu
+      : "${CI_COMMIT_TAG:?release tag is required}"
+      : "${OSS_PUBLIC_BASE_URL:?OSS_PUBLIC_BASE_URL is required}"
+
+      release_base="${OSS_PUBLIC_BASE_URL%/}/$BUCKET_PUBLIC_DIR/releases/$CI_COMMIT_TAG/$CI_PIPELINE_ID"
+      mkdir public-download
+      curl --proto '=https' --tlsv1.2 -fsSLo public-download/release-manifest.json \
+        "$release_base/release-manifest.json"
+      jq -e \
+        --arg tag "$CI_COMMIT_TAG" \
+        --arg commit "$CI_COMMIT_SHA" \
+        --arg pipeline "$CI_PIPELINE_ID" \
+        '.git_tag == $tag and
+         .git_commit == $commit and
+         .gitlab.pipeline_id == $pipeline and
+         .signed == false and
+         (.artifacts | length > 0)' \
+        public-download/release-manifest.json >/dev/null
+
+      jq -r '.artifacts[] | [.name, .sha256, .url] | @tsv' \
+        public-download/release-manifest.json >public-download/artifacts.tsv
+      tab=$(printf '\t')
+      while IFS="$tab" read -r name expected url; do
+        test "$(basename "$name")" = "$name"
+        case "$url" in
+          "$release_base/"*) ;;
+          *)
+            echo "artifact URL is outside the release path: $url" >&2
+            exit 1
+            ;;
+        esac
+        curl --proto '=https' --tlsv1.2 -fsSLo "public-download/$name" "$url"
+        actual=$(sha256sum "public-download/$name" | awk '{print $1}')
+        test "$actual" = "$expected"
+      done <public-download/artifacts.tsv
+
+      (
+        cd public-download
+        sha256sum -c checksums.txt
+      )
+  rules:
+    - if: '$CI_COMMIT_TAG =~ /^v[0-9]+[.][0-9]+[.][0-9]+$/'
+      when: on_success
+    - when: never

.goreleaser.yaml

@@ -45,15 +45,5 @@ sboms:
   - id: source
     artifacts: source
 
-signs:
-  - cmd: cosign
-    signature: "${artifact}.sigstore.json"
-    args:
-      - sign-blob
-      - "--bundle=${signature}"
-      - "${artifact}"
-      - "--yes"
-    artifacts: checksum
-
 changelog:
   use: git

README.md

@@ -48,32 +48,31 @@ midtrans agent check --product snap --json --non-interactive
 
 ## Release artifact verification
 
-After a signed release is published:
+The v0.1.0 release artifacts are checksummed but unsigned. The official GitHub
+Release is the discovery and release-notes page; it links to the immutable
+Alicloud OSS directory populated by the Goto GitLab release pipeline.
 
-1. Download the archive for your operating system and architecture,
-   `checksums.txt`, and `checksums.txt.sigstore.json` from the same GitHub
-   release.
-2. Verify the keyless signing bundle before trusting the checksum file:
+1. Follow only the Alicloud OSS links published in the official GitHub Release.
+2. Download the archive for your operating system and architecture together
+   with `checksums.txt` from the same versioned OSS directory.
+3. Verify the archive against the checksum manifest:
 
    ```sh
-   cosign verify-blob \
-     --bundle checksums.txt.sigstore.json \
-     --certificate-identity-regexp \
-       '^https://github.com/veritrans/midtrans-cli/.github/workflows/release.yml@refs/tags/v' \
-     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-     checksums.txt
+   grep '  <archive-name>$' checksums.txt | sha256sum --check
+   # macOS alternative:
+   grep '  <archive-name>$' checksums.txt | shasum -a 256 -c -
    ```
 
-3. Verify the archive against `checksums.txt` with `sha256sum -c` or
-   `shasum -a 256 -c`, extract it, and place `midtrans` on your `PATH`.
-4. Run `midtrans agent capabilities --json --non-interactive` and confirm the
+4. Extract the archive and place `midtrans` on your `PATH`.
+5. Run `midtrans agent capabilities --json --non-interactive` and confirm the
    expected schema, capabilities, and journeys before an agent uses it.
 
-The future hosted `install.sh` remains unpublished until signed release
-artifacts are available and Midtrans approves the official hosting domain. Do
-not use an unverified `curl | sh` installer. The v0.1 distribution is limited
-to signed, checksummed archives attached directly to the official GitHub
-release. Homebrew and npm launchers are deferred until Midtrans separately
+Checksums detect corruption or accidental modification after publication, but
+they do not authenticate the publisher as a signature would. Artifact signing
+is deferred beyond v0.1.0. The hosted `install.sh` remains unpublished; do not
+use an unverified `curl | sh` installer. Distribution is limited to the
+checksummed but unsigned archives in OSS linked from the official GitHub
+Release. Homebrew and npm launchers are deferred until Midtrans separately
 approves, provisions, and evaluates those channels.
 
 ## Sandbox workflow