chain-modules/text-translate
1
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

fix(ci): finish the fai->chain rename in the sign workflow
Some checks failed
CI / Linux x86_64 (Forgejo) (push) Failing after 2s
Details
sign-bundle / sign (push) Failing after 1m48s
Details

Browse source 
The vendored sign.yml predated the product rename: it installed
and invoked the old CLI name, packed a .fai bundle, and verified
against the renamed fai/platform repo URL — every tag build died
on the missing binary. Align with the platform's current
sign-bundle template: chain CLI, .chain bundle extension,
fai/chain-private raw URL for official.pub.

Signed-off-by: flemming-it <sf@flemming.it>
This commit is contained in:
flemming-it 2026-08-20 16:35:42 +02:00
parent c54c14b28a
commit 6efdb8a4f7
1 changed files with 12 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

24
.forgejo/workflows/sign.yml
View file

@ -2,7 +2,7 @@
# #
# Drop-in template for any module repo under chain-modules/. # Drop-in template for any module repo under chain-modules/.
# Triggers on tag push (vX.Y.Z) — builds the module, packs the # Triggers on tag push (vX.Y.Z) — builds the module, packs the
# .fai bundle, signs the bundle bytes with the Flemming.AI # .chain bundle, signs the bundle bytes with the Flemming.AI
# signing key (ECDSA P-256), and attaches bundle + .sig sidecar # signing key (ECDSA P-256), and attaches bundle + .sig sidecar
# to the matching Forgejo Release. # to the matching Forgejo Release.
# #
@ -42,7 +42,7 @@ jobs:
MODULE_NAME: text-translate MODULE_NAME: text-translate
steps: steps:
# See fai/platform CI for background on the manual external # See fai/chain-private CI for background on the manual external
# checkout: the DinD runner cannot resolve forgejo:3000, so # checkout: the DinD runner cannot resolve forgejo:3000, so
# we clone via the external URL with $GITHUB_TOKEN. # we clone via the external URL with $GITHUB_TOKEN.
- name: Checkout via external URL - name: Checkout via external URL
@ -58,7 +58,7 @@ jobs:
# The chain-module-sdk dependency lives in another Forgejo org # The chain-module-sdk dependency lives in another Forgejo org
# behind REQUIRE_SIGNIN_VIEW. MODULE_SDK_PAT (org-level # behind REQUIRE_SIGNIN_VIEW. MODULE_SDK_PAT (org-level
# secret, read-only on fai/module-sdk) authenticates cargo's # secret, read-only on fai/chain-module-sdk-rust) authenticates cargo's
# git fetch via insteadOf. # git fetch via insteadOf.
- name: Configure git URL rewrite for SDK fetch - name: Configure git URL rewrite for SDK fetch
env: env:
@ -93,16 +93,16 @@ jobs:
- name: Build module (wasm32-wasip2) - name: Build module (wasm32-wasip2)
run: cargo build --release --target wasm32-wasip2 run: cargo build --release --target wasm32-wasip2
- name: Install fai CLI - name: Install chain CLI
# Pinned to the production channel; signing requires the # Pinned to the production channel; signing requires the
# `fai pack` command. Override FAI_VERSION when bundle # `chain pack` command. Override CHAIN_VERSION when bundle
# format compatibility matters. # format compatibility matters.
run: | run: |
curl -fsSL https://get.chain.flemming.ai | sh -s -- --no-bootstrap curl -fsSL https://get.chain.flemming.ai | sh -s -- --no-bootstrap
# The installer drops fai at $HOME/.local/bin # The installer drops chain at $HOME/.local/bin
echo "$HOME/.local/bin" >> "$GITHUB_PATH" echo "$HOME/.local/bin" >> "$GITHUB_PATH"
export PATH="$HOME/.local/bin:$PATH" export PATH="$HOME/.local/bin:$PATH"
fai --version chain --version
- name: Stage bundle inputs - name: Stage bundle inputs
# The wasm artefact is named after the Cargo package # The wasm artefact is named after the Cargo package
@ -125,8 +125,8 @@ jobs:
id: pack id: pack
run: | run: |
export PATH="$HOME/.local/bin:$PATH" export PATH="$HOME/.local/bin:$PATH"
BUNDLE="${{ env.MODULE_NAME }}-${{ github.ref_name }}.fai" BUNDLE="${{ env.MODULE_NAME }}-${{ github.ref_name }}.chain"
fai pack staging --output "$BUNDLE" chain pack staging --output "$BUNDLE"
echo "bundle=$BUNDLE" >> "$GITHUB_OUTPUT" echo "bundle=$BUNDLE" >> "$GITHUB_OUTPUT"
ls -la "$BUNDLE" ls -la "$BUNDLE"
@ -141,7 +141,7 @@ jobs:
This workflow signs module bundles with the Flemming.AI This workflow signs module bundles with the Flemming.AI
module-signing key (ECDSA P-256, PKCS#8 PEM, unencrypted). module-signing key (ECDSA P-256, PKCS#8 PEM, unencrypted).
The matching public key is pinned in the fai-hub binary at The matching public key is pinned in the chain binary at
infra/cosign/official.pub — hubs that require_signatures infra/cosign/official.pub — hubs that require_signatures
will reject anything not signed with this key. will reject anything not signed with this key.
@ -153,7 +153,7 @@ jobs:
~/.fai-secrets/flemming-ai-signing.key (passphrase in ~/.fai-secrets/flemming-ai-signing.key (passphrase in
mSecure under "Ch∆In — Module Signing Key (Private)"). mSecure under "Ch∆In — Module Signing Key (Private)").
See fai/platform infra/cosign/OPERATOR-HANDOFF.md for the See fai/chain-private infra/cosign/OPERATOR-HANDOFF.md for the
full setup runbook and rotation process. full setup runbook and rotation process.
EOF EOF
exit 1 exit 1
@ -174,7 +174,7 @@ jobs:
# Sanity-check: the freshly-signed bundle must verify # Sanity-check: the freshly-signed bundle must verify
# against the well-known public key before we publish it. # against the well-known public key before we publish it.
run: | run: |
curl -fsSL https://git.flemming.ai/fai/platform/raw/branch/main/infra/cosign/official.pub \ curl -fsSL https://git.flemming.ai/fai/chain-private/raw/branch/main/infra/cosign/official.pub \
-o /tmp/official.pub -o /tmp/official.pub
openssl dgst -sha256 \ openssl dgst -sha256 \
-verify /tmp/official.pub \ -verify /tmp/official.pub \