release candidates: draft assets are read by their attachment uuid (the tag URL is 404 for drafts: the record job could not merge SHA256SUMS); the installers are scanned with the private terms in their build jobs, so the record job needs no apt tools (it spent 5 minutes installing them)

.forgejo/workflows/ci.yml

@@ -6,7 +6,7 @@
 #               tarball with real piped stdin, Linux and Windows x Node 20 / Node 22 / Bun.
 #   linux       AppImage + deb (path-free build), self-tests, both started under Xvfb, privacy scan.
 #   windows     NSIS installer, silent per-user install, self-test, uninstall, the Node prompt smoke, privacy scan.
-#   record      when all are green: the draft release rc-<sha> with the installers, the acceptance runs and matrix and
+#   record      when all are green (the installers already scanned with the private terms): the draft release rc-<sha> with the installers, the acceptance runs and matrix and
 #               green.json (tools/release-candidate.ts record). A v* tag on this commit only promotes it (release.yml).
 # gate decides first: a commit that differs from its green parent only in version copies + CHANGELOG (a release's
 # version bump, proven file by file: tools/release-candidate.ts gate) reuses the parent's ci and acceptance results
@@ -200,8 +200,14 @@ jobs:
           }
           smoke AppImage "$GITHUB_WORKSPACE/out/storebound_${V}_amd64.AppImage"
           smoke deb /tmp/deb/usr/bin/storebound-desktop
-      - name: Privacy scan
-        run: bun tools/privacy-scan.ts out/
+      - name: Privacy scan (with the private terms; never printed)
+        env:
+          FORBIDDEN_TERMS: ${{ secrets.FORBIDDEN_TERMS }}
+        run: |
+          [ -n "$FORBIDDEN_TERMS" ] || { echo "secret FORBIDDEN_TERMS is missing" >&2; exit 1; }
+          umask 077; printf '%s\n' "$FORBIDDEN_TERMS" > "$RUNNER_TEMP/terms.txt"
+          rc=0; STOREBOUND_FORBIDDEN_TERMS="$RUNNER_TEMP/terms.txt" bun tools/privacy-scan.ts out/ || rc=$?
+          rm -f "$RUNNER_TEMP/terms.txt"; exit $rc
       - uses: actions/upload-artifact@v3
         with:
           name: storebound-desktop-linux
@@ -254,9 +260,19 @@ jobs:
           & $exe --self-test | Tee-Object -Variable st
           if ($LASTEXITCODE -ne 0) { throw "self-test failed" }
           Start-Process -Wait -FilePath "$env:LOCALAPPDATA\storebound\uninstall.exe" -ArgumentList '/S'
-      - name: Privacy scan (no .pdb, no paths)
+      - name: Privacy scan (no .pdb, no paths; with the private terms, never printed)
         shell: pwsh
-        run: bun tools/privacy-scan.ts out
+        env:
+          FORBIDDEN_TERMS: ${{ secrets.FORBIDDEN_TERMS }}
+        run: |
+          if (-not $env:FORBIDDEN_TERMS) { throw "secret FORBIDDEN_TERMS is missing" }
+          $t = Join-Path $env:RUNNER_TEMP "terms-$([guid]::NewGuid()).txt"
+          Set-Content -Path $t -Value $env:FORBIDDEN_TERMS -NoNewline:$false
+          $env:STOREBOUND_FORBIDDEN_TERMS = $t
+          bun tools/privacy-scan.ts out
+          $rc = $LASTEXITCODE
+          Remove-Item -Force $t
+          if ($rc -ne 0) { throw "privacy scan failed" }
       - uses: actions/upload-artifact@v3
         with:
           name: storebound-desktop-windows
@@ -278,10 +294,9 @@ jobs:
       FROM: ${{ needs.gate.outputs.from }}
     steps:
       - uses: actions/checkout@v4
+      # no apt: the installers were scanned with the private terms in their own jobs; this job only records
       - name: Tools
         run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y -qq --no-install-recommends squashfs-tools p7zip-full xz-utils binutils unzip file >/dev/null
           curl -fsSL https://bun.sh/install | bash -s "bun-v${BUN_VERSION}" >/dev/null
           echo "$HOME/.bun/bin" >> "${FORGEJO_PATH:-$GITHUB_PATH}"
           [ -n "$FORGEJO_TOKEN" ] || { echo "secret RELEASE_TOKEN is missing (repo Settings > Actions > Secrets)" >&2; exit 1; }
@@ -308,15 +323,8 @@ jobs:
           ls cand/acceptance
           V=$(bun tools/desktop-version.ts --print)
           bun tools/acceptance.ts report cand/acceptance --md "cand/storebound_${V}_acceptance.md" --expect 6 --strict
-      - name: Privacy scan (private terms) of the installers
-        env:
-          FORBIDDEN_TERMS: ${{ secrets.FORBIDDEN_TERMS }}
-        run: |
-          [ -n "$FORBIDDEN_TERMS" ] || { echo "secret FORBIDDEN_TERMS is missing" >&2; exit 1; }
-          umask 077; printf '%s\n' "$FORBIDDEN_TERMS" > "$RUNNER_TEMP/terms.txt"
-          rm -f cand/SHA256SUMS
-          STOREBOUND_FORBIDDEN_TERMS="$RUNNER_TEMP/terms.txt" bun tools/privacy-scan.ts cand/*.AppImage cand/*.deb cand/*.exe
-          rm -f "$RUNNER_TEMP/terms.txt"
+      - name: Checksums file of the build jobs is not shipped as is
+        run: rm -f cand/SHA256SUMS
       - name: Record the candidate (draft rc-<sha>, green.json last)
         run: |
           bun tools/release-candidate.ts record --sha "$SHA" --run "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_NUMBER" --dir cand ${FROM:+--reused-from "$FROM"} --yes

.forgejo/workflows/release.yml

@@ -15,7 +15,7 @@
 # Not here: macOS. tools/release.ts on the owner's Mac builds, signs and notarizes the DMG in parallel and adds it to
 # this release, then publishes storebound.dev (docs/desktop-release.md). The updater signing key never reaches a runner.
 # Secrets: RELEASE_TOKEN (scope write:repository), FORGEJO_ORIGIN (the server's IP: uploads over 100 MB bypass
-# Cloudflare). The private terms scan of the installers ran in ci.yml's record job (FORBIDDEN_TERMS).
+# Cloudflare). The private terms scan of the installers ran in ci.yml's build jobs (FORBIDDEN_TERMS).
 name: release
 
 on: