diff --git a/.github/workflows/refresh-runtime-feed.yml b/.github/workflows/refresh-runtime-feed.yml index 9ca7999..1bb85f2 100644 --- a/.github/workflows/refresh-runtime-feed.yml +++ b/.github/workflows/refresh-runtime-feed.yml @@ -69,39 +69,6 @@ jobs: node scripts/runtime-feed-verify.mjs "$output" "$channel" done - - name: Check out the Nexus consumer verifier - if: ${{ hashFiles('.runtime-feed/*.candidate.json') != '' }} - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - repository: cloudstack-llc/msty-nexus - ref: rel/0.5.0 - path: .runtime-feed/nexus-contract - - - name: Set up Go for consumer verification - if: ${{ hashFiles('.runtime-feed/*.candidate.json') != '' }} - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 - with: - go-version-file: .runtime-feed/nexus-contract/go.mod - cache: true - - - name: Verify changed feeds with Nexus - if: ${{ hashFiles('.runtime-feed/*.candidate.json') != '' }} - env: - TRUSTED_KEYS: msty-runtime-feed-1=5rZcCrp9d0WhHcuQk+rk9GDJtKizYK0LufQ551FltdA= - run: | - for channel in stable dev; do - feed="$GITHUB_WORKSPACE/v2/runtime/${channel}/runtime-release-feed.signed.json" - if [[ ! -f ".runtime-feed/${channel}.candidate.json" ]]; then - continue - fi - ( - cd .runtime-feed/nexus-contract - go run ./cmd/msty-nexusctl -- runtime-release-feeds verify \ - --trusted-keys "$TRUSTED_KEYS" \ - --file "$feed" - ) - done - - name: Commit changed feeds run: | if [[ -z "$(git status --porcelain -- v2/runtime)" ]]; then diff --git a/README.md b/README.md index 4778d01..f244031 100644 --- a/README.md +++ b/README.md @@ -103,10 +103,6 @@ never receive it. `REFRESH_TOKEN` remains the repository-scoped token used by the other scheduled catalogs; the default Actions token is a functional fallback. -Whenever a feed changes, the workflow also checks out the current Nexus release -branch and runs its real feed verifier against the signed bytes. Publisher-side -validation therefore cannot silently drift from the consumer contract. - ```bash node --test scripts/runtime-feed.test.mjs python3 -m unittest discover -s scripts -p '*_test.py'