feat: add release checksum generation and verification documentation (#1469)#1478
Merged
Merged
Conversation
github-actions
Bot
added
github_actions
Contributor
📝 WalkthroughWalkthroughThis PR adds comprehensive release verification infrastructure by introducing a checksum generation script, automating checksum and provenance attestation creation in the release workflow, and providing user-facing documentation in English and Japanese explaining how to verify download authenticity. ChangesRelease Verification Infrastructure
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related issues
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Comment |
Contributor
Coverage Report
File CoverageNo changed files found. |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds release download verification guidance and implements automated generation of a SHA256SUMS.txt asset plus GitHub build provenance attestations as part of the release publish workflow, improving end-user trust in downloaded installers.
Changes:
- Link to a new download verification guide from the main README and the Japanese docs README.
- Add English/Japanese “download verification” docs covering SHA-256 checksum verification and
gh attestation verify. - Extend the release workflow to download draft release assets, generate/upload
SHA256SUMS.txt, and emit build provenance attestations; introduce a helper script to generate and validate checksums.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| README.md | Adds a pointer to the download verification documentation. |
| docs/README.ja.md | Adds a pointer (Japanese) to the verification documentation. |
| docs/download-verification.md | New English guide describing checksum + provenance verification steps. |
| docs/download-verification.ja.md | New Japanese guide describing checksum + provenance verification steps. |
| .github/workflows/publish.yml | Adds a post-build job to generate/upload SHA256SUMS.txt and create provenance attestations for release assets. |
| .github/scripts/generate-release-checksums.sh | New script to generate and self-verify SHA-256 checksums for release assets. |
Contributor
Rust Tauri Coverage ReportCoverage Details |
…://github.com/shm11C3/HardwareVisualizer into security/#1469-release-checksums-attestations
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
19 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Related Issues
#1469
Type of Change
fix/branch)feat/branch)refactor/branch)docs/branch)chore/branch)Screenshots / Videos
Test Plan
Checklist
npm run lint && npm run format/cargo tauri-lint && cargo tauri-fmt)npm test/cargo tauri-test)