[PR #277] [MERGED] Generate version pinned install.sh script on release, including checksums. #376

New issue

Closed

opened 2026-03-02 04:13:27 +03:00 by kerem · 0 comments

kerem commented

2026-03-02 04:13:27 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/git-ai-project/git-ai/pull/277
Author: @mm-zacharydavison
Created: 12/9/2025
Status: ✅ Merged
Merged: 12/10/2025
Merged by: @svarlamov

Base: main ← Head: feature/provenance

📝 Commits (8)

e3a0eea Generate version pinned install.sh script on release, including checksum checking on install.
ad3cbd7 Fix sed delimeter issue.
902f3db Only replace exact instances we intend to replace in install.sh script.
e7ee2ac Use awk to avoid sed escaping issue.
11bb45e Update install.sh
25234fd Update .github/workflows/release.yml
83fd335 Update .github/workflows/release.yml
dbd6faa Update install.sh

📊 Changes

2 files changed (+114 additions, -10 deletions)

View changed files

📝 .github/workflows/release.yml (+46 -6)
📝 install.sh (+68 -4)

📄 Description

This adds some security quality-of-life provenance features:

On release, install.sh now generates a version of the script that is hardcoded to install a specific version.
On running install.sh, if checksum data was embedded (e.g. this is a release install.sh, not the generic one), the checksums are verified on download.
GitHub attestations are now included.

This allows people to install a specific version of git-ai and have the provenance of the release be verified.

The original install script still works as it did previously.

You can see an example release on my fork.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/git-ai-project/git-ai/pull/277 **Author:** [@mm-zacharydavison](https://github.com/mm-zacharydavison) **Created:** 12/9/2025 **Status:** ✅ Merged **Merged:** 12/10/2025 **Merged by:** [@svarlamov](https://github.com/svarlamov) **Base:** `main` ← **Head:** `feature/provenance` --- ### 📝 Commits (8) - [`e3a0eea`](https://github.com/git-ai-project/git-ai/commit/e3a0eeac207c72a5a491bcef020f7ac9520c7e95) Generate version pinned install.sh script on release, including checksum checking on install. - [`ad3cbd7`](https://github.com/git-ai-project/git-ai/commit/ad3cbd7cc7c9da32618af53323d431582b380f38) Fix sed delimeter issue. - [`902f3db`](https://github.com/git-ai-project/git-ai/commit/902f3db809b2bc0a5ebcbeb581023c11632dc08d) Only replace exact instances we intend to replace in install.sh script. - [`e7ee2ac`](https://github.com/git-ai-project/git-ai/commit/e7ee2ac54e7450b75ec0b325957bd6c4eefb7cff) Use awk to avoid sed escaping issue. - [`11bb45e`](https://github.com/git-ai-project/git-ai/commit/11bb45e46b5f121ccd170c739f7a3c9a050d99c9) Update install.sh - [`25234fd`](https://github.com/git-ai-project/git-ai/commit/25234fdc0dc890dcfe5483a1475b979b12421f48) Update .github/workflows/release.yml - [`83fd335`](https://github.com/git-ai-project/git-ai/commit/83fd335e2c2f3c717b43db00a2b2c594a57a67ef) Update .github/workflows/release.yml - [`dbd6faa`](https://github.com/git-ai-project/git-ai/commit/dbd6faa6c5fcfbf10465ee5efc33579d44292a19) Update install.sh ### 📊 Changes **2 files changed** (+114 additions, -10 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/release.yml` (+46 -6) 📝 `install.sh` (+68 -4) </details> ### 📄 Description This adds some security quality-of-life provenance features: 1. On release, `install.sh` now generates a version of the script that is hardcoded to install a specific version. 2. On running `install.sh`, if checksum data was embedded (e.g. this is a release `install.sh`, not the generic one), the checksums are verified on download. 3. GitHub attestations are now included. This allows people to install a specific version of `git-ai` and have the provenance of the release be verified. The original install script still works as it did previously. You can see [an example release on my fork](https://github.com/mm-zacharydavison/git-ai/releases/tag/v1.0.23-next-e7ee2ac). --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>