Repository navigation
Validate Release Secrets #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Validate Release Secrets | |
| on: | |
| workflow_dispatch: | |
| jobs: | |
| validate-secrets: | |
| name: Test all release tokens | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Validate NPM_TOKEN | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| run: | | |
| npm config set //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN} | |
| NPM_USER=$(npm whoami --registry https://registry.npmjs.org 2>&1) || true | |
| if [[ -n "$NPM_USER" && "$NPM_USER" != *"error"* && "$NPM_USER" != *"ERR"* ]]; then | |
| echo "✅ NPM_TOKEN is valid (user: $NPM_USER)" | |
| else | |
| echo "❌ NPM_TOKEN is invalid or expired" | |
| echo " Response: $NPM_USER" | |
| echo " Fix: regenerate at npmjs.com → Access Tokens, update NPM_TOKEN secret" | |
| echo "NPM_FAILED=true" >> $GITHUB_ENV | |
| fi | |
| - name: Validate Docker Hub credentials | |
| env: | |
| DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }} | |
| DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }} | |
| run: | | |
| if echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin 2>&1; then | |
| echo "✅ Docker Hub credentials are valid" | |
| docker logout > /dev/null 2>&1 | |
| else | |
| echo "❌ Docker Hub credentials are invalid" | |
| echo " Fix: update DOCKER_USERNAME/DOCKER_PASSWORD secrets" | |
| echo "DOCKER_FAILED=true" >> $GITHUB_ENV | |
| fi | |
| - name: Validate PYPI_TOKEN | |
| env: | |
| PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }} | |
| run: | | |
| HTTP_CODE=$(curl -s -o /tmp/pypi_response -w "%{http_code}" \ | |
| -H "Authorization: Bearer $PYPI_TOKEN" \ | |
| "https://upload.pypi.org/legacy/") | |
| if [[ "$HTTP_CODE" == "405" ]]; then | |
| echo "✅ PYPI_TOKEN is valid (HTTP 405 = authenticated, method not allowed)" | |
| elif [[ "$HTTP_CODE" == "401" || "$HTTP_CODE" == "403" ]]; then | |
| echo "❌ PYPI_TOKEN is expired or revoked (HTTP $HTTP_CODE)" | |
| echo " Fix: regenerate at pypi.org → Account Settings → API tokens, update PYPI_TOKEN secret" | |
| echo "PYPI_FAILED=true" >> $GITHUB_ENV | |
| else | |
| echo "⚠️ PYPI_TOKEN validation inconclusive (HTTP $HTTP_CODE)" | |
| cat /tmp/pypi_response || true | |
| fi | |
| - name: Summary | |
| run: | | |
| echo "" | |
| echo "═══════════════════════════════════════════" | |
| if [[ "${NPM_FAILED:-}" == "true" || "${DOCKER_FAILED:-}" == "true" || "${PYPI_FAILED:-}" == "true" ]]; then | |
| echo "❌ Some tokens are invalid. Fix before releasing." | |
| exit 1 | |
| else | |
| echo "✅ All release tokens are valid." | |
| fi | |
| echo "═══════════════════════════════════════════" |