From 175ca71fc2bef8f8834d62494a670e2fc2444043 Mon Sep 17 00:00:00 2001
From: Guillaume Lagrange <guillaume@glagrange.eu>
Date: Mon, 12 Oct 2026 23:04:41 +0200
Subject: [PATCH] ci: publish executable hashes and refresh the eBPF allowlist
 on release

The allowlist is built from the published hashes, so new releases are
allowed without updating the macro runner agent.

Refs COD-3826
---
 .github/workflows/post-announce.yml | 43 +++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/.github/workflows/post-announce.yml b/.github/workflows/post-announce.yml
index 5482b9d2a..ace40e966 100644
--- a/.github/workflows/post-announce.yml
+++ b/.github/workflows/post-announce.yml
@@ -40,6 +40,49 @@ jobs:
             echo "Runner version ${NEW_VERSION} was released"
           fi
 
+      # The archives and the final dist-manifest.json built earlier in this run.
+      - name: Download release artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          pattern: artifacts-*
+          path: artifacts
+          merge-multiple: true
+
+      # Publish the SHA-256 of every released executable, as extracted from its
+      # archive, as `<executable>-<target>.sha256.sum` holding one
+      # `<hex> *<executable>` line. The CodSpeed eBPF allowlist is built from them.
+      - name: Publish executable hashes
+        shell: bash
+        working-directory: artifacts
+        env:
+          RELEASE_TAG: ${{ steps.check_runner.outputs.release_tag }}
+        run: |
+          jq -r '.artifacts | to_entries[]
+            | select(.value.kind == "executable-zip")
+            | .key as $archive
+            | .value.target_triples[0] as $target
+            | .value.assets[]
+            | select(.kind == "executable")
+            | [$archive, $target, .path] | @tsv' dist-manifest.json |
+          while IFS=$'\t' read -r archive target path; do
+            executable=$(basename "$path")
+            hash=$(tar -xzOf "$archive" "${archive%.tar.gz}/$path" | sha256sum | cut -d' ' -f1)
+            echo "$hash *$executable" > "$executable-$target.sha256.sum"
+            echo "$executable ($target): $hash"
+          done
+          gh release upload "$RELEASE_TAG" -R "$GITHUB_REPOSITORY" --clobber ./*.sha256.sum
+
+      - name: Refresh the CodSpeed eBPF allowlist
+        env:
+          REVALIDATE_TOKEN: ${{ secrets.EBPF_ALLOWLIST_REVALIDATE_TOKEN }}
+        run: |
+          curl -fsS --retry 3 -X POST \
+            -H "Authorization: Bearer ${REVALIDATE_TOKEN}" \
+            https://app.codspeed.io/api/ebpf-allowlist/revalidate
+          # Rebuild it now rather than on the first runner's request.
+          curl -fsS --retry 3 -o /dev/null \
+            https://app.codspeed.io/api/ebpf-allowlist
+
       - name: Mark release as latest
         if: steps.check_runner.outputs.runner_released == 'true'
         run: |