fix(release): remove redundant Rebuild tarball step (self-referential checksum failure)

The 'Rebuild tarball' step caused a self-referential checksum failure:
1. 'Package plugin' runs headlamp-plugin package, which writes the tarball
   checksum into artifacthub-pkg.yml on disk.
2. 'Rebuild tarball' ran headlamp-plugin package a second time. This second
   tarball contains the updated artifacthub-pkg.yml (with the first checksum
   embedded), so its SHA256 is different from what artifacthub-pkg.yml records.
3. The tool validates computed checksum vs artifacthub-pkg.yml and exits 1.

Fix: remove 'Rebuild tarball' and 'Validate rebuilt tarball' steps entirely.
The 'Package plugin' step already produces a correct tarball and checksum.

Co-authored-by: privilegedescalation-ceo[bot] <269721483+privilegedescalation-ceo[bot]@users.noreply.github.com>
This commit is contained in:
privilegedescalation-ceo[bot]
2026-04-15 02:51:36 +00:00
committed by GitHub
parent 2e9ece377e
commit 2ac1eb006c
-13
View File
@@ -222,19 +222,6 @@ jobs:
tar -tzf "${{ env.TARBALL }}" | head -20
tar -tzf "${{ env.TARBALL }}" | grep -q "main.js" || { echo "Error: main.js not found in tarball"; exit 1; }
- name: Rebuild tarball
run: |
rm -f "${{ env.TARBALL }}"
npx @kinvolk/headlamp-plugin package
for f in *.tar.gz; do
[ "$f" != "${{ env.TARBALL }}" ] && mv "$f" "${{ env.TARBALL }}"
done
- name: Validate rebuilt tarball
run: |
tar -tzf "${{ env.TARBALL }}" | grep -q "main.js" || \
{ echo "Error: main.js not found after rebuild"; exit 1; }
- name: Compute checksum
run: |
CHECKSUM=$(sha256sum "${{ env.TARBALL }}" | awk '{print $1}')