[libcloud] 01/03: Add new job which verifies release checksums on a daily basis.

[to...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

tomaz pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/libcloud.git

commit c25b2b5c16fcd7016bd6587cfa0b8b5127abc712
Author: Tomaz Muraus <to...@tomaz.me>
AuthorDate: Fri Nov 12 22:10:05 2021 +0100

    Add new job which verifies release checksums on a daily basis.
---
 .github/workflows/install_test.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/.github/workflows/install_test.yml b/.github/workflows/install_test.yml
index da7e460..1b9bb1b 100644
--- a/.github/workflows/install_test.yml
+++ b/.github/workflows/install_test.yml
@@ -40,3 +40,21 @@ jobs:
           pip show apache-libcloud && exit 1
           pip install apache-libcloud
           pip show apache-libcloud
+
+  # Job which verifies that the checksum for release artifacts for the latest
+  # stable version are the same for official ASF mirror and PyPi
+  verify_checksums:
+    name: Verify Artifacts Checksum
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+
+    steps:
+      - uses: actions/checkout@master
+        with:
+          fetch-depth: 1
+
+      - name: Verify Checksums
+        run: |
+          LAST_STABLE_VERSION=$(curl -s --fail https://pypi.org/pypi/apache-libcloud/json | jq ".releases | to_entries | last | .key" -r)
+          echo "Checking checksums for version ${LAST_STABLE_VERSION}"
+          ./dist/verify_checksums.sh "apache-libcloud-${LAST_STABLE_VERSION}"