lnd/.github/workflows/verify-release.yaml

name: Verify release

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version tag (e.g. v0.20.1-beta)'
        required: true

permissions:
  contents: write

jobs:
  verify-release:
    name: Verify release signatures and binaries
    runs-on: ubuntu-latest
    steps:
      - name: git checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.version || github.sha }}

      - name: Check final release OpenTimestamps asset
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ inputs.version || github.event.release.tag_name }}
        run: |
          set -euo pipefail

          if [[ "${VERSION}" =~ \.rc[0-9]+$ ]]; then
            echo "Release candidate ${VERSION}; skipping OpenTimestamps asset check."
            exit 0
          fi

          REQUIRED_MANIFEST_OTS="manifest-${VERSION}.txt.ots"
          REQUIRED_SIG="manifest-roasbeef-${VERSION}.sig"
          REQUIRED_SIG_OTS="${REQUIRED_SIG}.ots"

          ASSETS="$(gh release view "${VERSION}" \
            --repo "${{ github.repository }}" \
            --json assets \
            --jq '.assets[].name')"

          for asset in "${REQUIRED_MANIFEST_OTS}" "${REQUIRED_SIG}" "${REQUIRED_SIG_OTS}"; do
            if ! grep -Fxq "${asset}" <<< "${ASSETS}"; then
              echo "ERROR: Final release ${VERSION} is missing ${asset}."
              exit 1
            fi
          done

          echo "Found required release timestamp artifacts:"
          echo "  ${REQUIRED_MANIFEST_OTS}"
          echo "  ${REQUIRED_SIG}"
          echo "  ${REQUIRED_SIG_OTS}"

      - name: Verify release
        env:
          VERSION: ${{ inputs.version || github.event.release.tag_name }}
        run: |
          docker run --rm --entrypoint="" \
            lightninglabs/lnd:${VERSION} \
            /verify-install.sh ${VERSION}

      - name: Set release back to draft on failure
        if: failure()
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ inputs.version || github.event.release.tag_name }}
        run: |
          gh release edit ${VERSION} \
            --repo ${{ github.repository }} \
            --draft