1# forge.releaserequireci true: a release lands only if its tag's tree has a2# verified passing CI attestation, in the repo or in the same push (forge3# release publish pushes refs/notes/ci with it). A failing one won't do.4. "$(dirname "$0")/../lib.sh"5user dami6repo dami/greet7g=$FORGE_ROOT/dami/greet.git8git --git-dir="$g" config forge.releaserequireci true9clone dami dami/greet "$T/w/d"10mkdir -p "$T/w/d/.forge"11printf '#!/bin/sh\ntest -f ok\n' >"$T/w/d/.forge/ci"12chmod +x "$T/w/d/.forge/ci"13at "$T/w/d" commit "ci script, no ok file yet"14at "$T/w/d" git tag v115ok push_as dami "$T/w/d" origin main16mkdir "$T/f"17printf 'greet\n' >"$T/f/greet"18export FORGE_USER=dami19fails_with 'release v1: [0-9a-f]+ has no verified passing CI attestation \(run: forge attest v1' at "$T/w/d" "$FORGE" release publish v1 "$T/f/greet"20fails at "$T/w/d" "$FORGE" attest v121fails_with 'has no verified passing CI attestation' at "$T/w/d" "$FORGE" release publish v1 "$T/f/greet"22missing "$FORGE_WWW/dami/greet/releases"23# The refused push took nothing with it: not the tag, not the notes.24fails git --git-dir="$g" rev-parse -q --verify refs/tags/v125fails git --git-dir="$g" rev-parse -q --verify refs/notes/ci2627at "$T/w/d" commit "add ok" ok28at "$T/w/d" git tag v229ok at "$T/w/d" "$FORGE" attest v230ok at "$T/w/d" "$FORGE" release publish v2 "$T/f/greet"31exists "$FORGE_WWW/dami/greet/releases/download/v2/greet"32git --git-dir="$g" rev-parse -q --verify refs/notes/ci >/dev/null || fail "the notes came with the release"