From 073b9f710ea9044623464b81df0efa551d5a23cd Mon Sep 17 00:00:00 2001 From: "Joshua J. Bouw" Date: Mon, 13 Jul 2026 03:38:58 +0400 Subject: [PATCH 1/3] chore: point setup action at Astrid Runtime --- README.md | 15 ++++++++++----- action.yml | 4 ++-- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index 11cb744..b7d6e9a 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # setup-astrid -A GitHub Action that installs the [Astrid](https://github.com/unicity-astrid/astrid) CLI +A GitHub Action that installs the [Astrid](https://github.com/astrid-runtime/astrid) CLI (`astrid`, `astrid-daemon`, `astrid-build`, `astrid-emit`) onto a CI runner and puts it on `PATH` — so a later step can run `astrid capsule check`, build a capsule, or anything else, in one line. @@ -13,14 +13,14 @@ release workflow's identity), and the downloaded archive is checked against thos ## Usage ```yaml -- uses: unicity-astrid/setup-astrid@v1 +- uses: astrid-runtime/setup-astrid@v2 - run: astrid capsule check ``` Pin a version and run a full capsule build: ```yaml -- uses: unicity-astrid/setup-astrid@v1 +- uses: astrid-runtime/setup-astrid@v2 with: version: "0.9.2" - run: astrid build @@ -36,7 +36,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - - uses: unicity-astrid/setup-astrid@v1 + - uses: astrid-runtime/setup-astrid@v2 - run: astrid capsule check # non-zero exit fails the job ``` @@ -45,9 +45,14 @@ jobs: | Input | Default | Description | |-------|---------|-------------| | `version` | `latest` | Astrid version to install (e.g. `0.9.2`), or `latest`. | -| `repository` | `unicity-astrid/astrid` | Owner/repo to install the release from (override for a fork or mirror). | +| `repository` | `astrid-runtime/astrid` | Owner/repo to install the release from (override for a fork, mirror, or historical Astrid release). | | `verify` | `sigstore` | `sigstore` (cosign provenance + integrity), `checksum` (SHA256 integrity only, no extra tooling), or `none` (not recommended). | | `certificate-identity` | *(derived)* | Advanced: override the expected cosign certificate identity. Defaults to the `release.yml` workflow of `repository` at the version tag. | + +Historical Astrid releases published before the organization transfer retain the +`unicity-astrid/astrid` Sigstore workflow identity. To install one with this action, +set `repository: unicity-astrid/astrid`; GitHub resolves the release redirect while +the action verifies the original certificate identity. | `github-token` | `${{ github.token }}` | Token for the release lookup and asset downloads. | ## Outputs diff --git a/action.yml b/action.yml index efdae10..030bb41 100644 --- a/action.yml +++ b/action.yml @@ -1,6 +1,6 @@ name: "Setup Astrid" description: "Install the Astrid CLI (astrid, astrid-daemon, astrid-build, astrid-emit) into a CI runner, with sigstore provenance / SHA256 verification." -author: "Unicity Labs" +author: "Astrid contributors" branding: icon: "box" color: "purple" @@ -13,7 +13,7 @@ inputs: repository: description: "GitHub owner/repo to install the release from (override for a fork or a mirror)." required: false - default: "unicity-astrid/astrid" + default: "astrid-runtime/astrid" verify: description: >- Artifact verification mode: 'sigstore' (cosign — verifies the release's From 6d3dd1cde7e8ce2da5ae04d453e76d30595d2d28 Mon Sep 17 00:00:00 2001 From: "Joshua J. Bouw" Date: Mon, 13 Jul 2026 03:57:38 +0400 Subject: [PATCH 2/3] fix: verify historical Astrid release identities --- README.md | 6 +++--- action.yml | 28 ++++++++++++++++++++++------ 2 files changed, 25 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index b7d6e9a..d7d26d3 100644 --- a/README.md +++ b/README.md @@ -50,9 +50,9 @@ jobs: | `certificate-identity` | *(derived)* | Advanced: override the expected cosign certificate identity. Defaults to the `release.yml` workflow of `repository` at the version tag. | Historical Astrid releases published before the organization transfer retain the -`unicity-astrid/astrid` Sigstore workflow identity. To install one with this action, -set `repository: unicity-astrid/astrid`; GitHub resolves the release redirect while -the action verifies the original certificate identity. +`unicity-astrid/astrid` Sigstore workflow identity. The default Astrid Runtime +repository automatically retries that historical identity when needed. Forks and an +explicit `certificate-identity` override still require an exact identity match. | `github-token` | `${{ github.token }}` | Token for the release lookup and asset downloads. | ## Outputs diff --git a/action.yml b/action.yml index 030bb41..944a743 100644 --- a/action.yml +++ b/action.yml @@ -148,15 +148,31 @@ runs: if [ -z "${identity}" ]; then identity="https://github.com/${REPO}/.github/workflows/release.yml@refs/tags/${TAG}" fi - echo "setup-astrid: verifying SHA256SUMS.txt provenance via cosign (identity: ${identity})" # Authenticity: the checksums file carries a keyless signature bound # to the release workflow's GitHub OIDC identity. Verify that, then # check the archive against the now-trusted checksums. - cosign verify-blob \ - --bundle "SHA256SUMS.txt.sigstore.json" \ - --certificate-identity "${identity}" \ - --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ - "SHA256SUMS.txt" + verify_identity() { + local expected="$1" + echo "setup-astrid: verifying SHA256SUMS.txt provenance via cosign (identity: ${expected})" + cosign verify-blob \ + --bundle "SHA256SUMS.txt.sigstore.json" \ + --certificate-identity "${expected}" \ + --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ + "SHA256SUMS.txt" + } + + if ! verify_identity "${identity}"; then + # Releases made before the organization transfer retain their + # original GitHub OIDC workflow identity. Only the new canonical + # repository gets this narrow fallback; forks and explicit + # overrides must match exactly as requested. + if [ -n "${CERT_ID_OVERRIDE}" ] || [ "${REPO}" != "astrid-runtime/astrid" ]; then + exit 1 + fi + legacy_identity="https://github.com/unicity-astrid/astrid/.github/workflows/release.yml@refs/tags/${TAG}" + echo "setup-astrid: retrying historical Astrid release identity" + verify_identity "${legacy_identity}" + fi verify_checksum ;; checksum) From 374ea3a275663c0c6206d0a9f55083bc2b3e3d04 Mon Sep 17 00:00:00 2001 From: "Joshua J. Bouw" Date: Mon, 13 Jul 2026 05:28:28 +0400 Subject: [PATCH 3/3] ci: replace frozen macOS Intel runner --- .github/workflows/test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index e6f751c..5d5126d 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -16,7 +16,7 @@ jobs: strategy: fail-fast: false matrix: - os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, macos-13] + os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, macos-15-intel] runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@v4