ci: harden release workflows

Author: gildesmarais

.github/workflows/release.yml

@@ -7,8 +7,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 concurrency:
   group: release-${{ github.ref }}
@@ -17,6 +16,9 @@ concurrency:
 jobs:
   release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
@@ -90,7 +92,9 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Get Git commit timestamp
-        run: echo "TIMESTAMP=$(git log -1 --format=%cI)" >> "$GITHUB_ENV"
+        run: |
+          echo "TIMESTAMP_EPOCH=$(git log -1 --format=%ct)" >> "$GITHUB_ENV"
+          echo "TIMESTAMP_ISO=$(git log -1 --format=%cI)" >> "$GITHUB_ENV"
 
       - name: Compute Docker tags
         id: tags
@@ -124,7 +128,7 @@ jobs:
       - name: Build and push Docker image
         uses: docker/build-push-action@v7
         env:
-          SOURCE_DATE_EPOCH: ${{ env.TIMESTAMP }}
+          SOURCE_DATE_EPOCH: ${{ env.TIMESTAMP_EPOCH }}
         with:
           context: .
           push: true
@@ -138,7 +142,7 @@ jobs:
           provenance: true
           sbom: true
           labels: |
-            org.opencontainers.image.created=${{ env.TIMESTAMP }}
+            org.opencontainers.image.created=${{ env.TIMESTAMP_ISO }}
             org.opencontainers.image.description=Generates RSS feeds of any website & serves to the web!
             org.opencontainers.image.ref.name=${{ env.RELEASE_TAG }}
             org.opencontainers.image.revision=${{ github.sha }}

.github/workflows/release_artifacts.yml

@@ -1,25 +1,27 @@
 name: refresh release artifacts
 
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - reopened
       - synchronize
     branches:
       - main
+  push:
+    branches:
+      - release-please--branches--main
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 concurrency:
-  group: release-artifacts-${{ github.event.pull_request.number }}
+  group: release-artifacts-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
-  refresh-generated-artifacts:
-    if: github.event.pull_request.head.repo.full_name == github.repository && startsWith(github.event.pull_request.head.ref, 'release-please--branches--')
+  verify-generated-artifacts:
+    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && startsWith(github.event.pull_request.head.ref, 'release-please--branches--')
     runs-on: ubuntu-latest
 
     steps:
@@ -52,6 +54,45 @@ jobs:
           make openapi
           make openapi-client
 
+      - name: Assert generated artifacts are current
+        run: git diff --exit-code -- public/openapi.yaml frontend/src/api/generated
+
+  refresh-generated-artifacts:
+    if: github.event_name == 'push' && github.repository == 'html2rss/html2rss-web' && github.ref == 'refs/heads/release-please--branches--main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.ref_name }}
+          fetch-depth: 0
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          cache: true
+          cache_dependency_path: frontend/pnpm-lock.yaml
+          package_json_file: frontend/package.json
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: ".tool-versions"
+
+      - name: Install frontend dependencies
+        run: pnpm install --frozen-lockfile
+        working-directory: frontend
+
+      - name: Refresh OpenAPI artifacts
+        run: |
+          make openapi
+          make openapi-client
+
       - name: Commit generated artifacts
         run: |
           if git diff --quiet -- public/openapi.yaml frontend/src/api/generated; then

spec/html2rss/web_spec.rb

@@ -7,7 +7,7 @@
 RSpec.describe Html2rss::Web do
   describe 'VERSION' do
     it 'defines the canonical application release version' do
-      expect(described_class::VERSION).to eq('1.0.0')
+      expect(described_class::VERSION).to match(/\A\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?\z/)
     end
   end
 end