{"payload":{"feedbackUrl":"https://github.com/orgs/community/discussions/53140","repo":{"id":727171040,"defaultBranch":"main","name":"gha-scala-library-release-workflow","ownerLogin":"guardian","currentUserCanPush":false,"isFork":false,"isEmpty":false,"createdAt":"2023-12-04T10:28:17.000Z","ownerAvatar":"https://avatars.githubusercontent.com/u/164318?v=4","public":true,"private":false,"isOrgOwned":true},"refInfo":{"name":"","listCacheKey":"v0:1716288811.0","currentOid":""},"activityList":{"items":[{"before":"d967417fad478648a63a5b688fa014f48ee36f9c","after":null,"ref":"refs/heads/use-java-version-specified-by-tool-versions-for-project-build","pushedAt":"2024-05-21T10:53:31.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"}},{"before":"8648ce9cb794384e85b654a581ceba77a53efffa","after":"cccaa32d8f1e0db293a256a09ddcd048f0fd6710","ref":"refs/heads/main","pushedAt":"2024-05-21T10:53:27.000Z","pushType":"pr_merge","commitsCount":2,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"Merge pull request #36 from guardian/use-java-version-specified-by-tool-versions-for-project-build\n\nBuild library with Java version specified in `.tool-versions`","shortMessageHtmlLink":"Merge pull request <a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2265864908\" data-permission-text=\"Title is private\" data-url=\"https://github.com/guardian/gha-scala-library-release-workflow/issues/36\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/guardian/gha-scala-library-release-workflow/pull/36/hovercard\" href=\"https://github.com/guardian/gha-scala-library-release-workflow/pull/36\">#36</a> from guardian/use-java-version-specified-by-to…"}},{"before":"a0085347e9e83b380d748594cdb31f58554f93ad","after":"d967417fad478648a63a5b688fa014f48ee36f9c","ref":"refs/heads/use-java-version-specified-by-tool-versions-for-project-build","pushedAt":"2024-04-30T15:24:06.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"Build library with Java version specified in .tool-versions\n\nThis allows projects to specify, with an `asdf` (https://asdf-vm.com/)-formatted\n`.tool-versions` file, the Java version to be used by the workflow for building\nthe project- `gha-scala-library-release-workflow` has always used a recent LTS\nversion Java for the build (eg Java 17), and this has sometimes been _too recent_\n(https://github.com/guardian/atom-maker/pull/94) for some projects at the Guardian.\n\nWe _want_ projects to update to Java 21 (see https://github.com/guardian/support-frontend/pull/5792,\nhttps://github.com/guardian/scala-steward-public-repos/pull/67 etc), but tying\ndozens of projects tightly to what `gha-scala-library-release-workflow` is using\nwill make updating that version pretty hard. If, at some later point, _some_ projects\nwant to experiment with Java 25, we shouldn't have to force all other projects to\nbe compatible with that first.\n\n## How to express the version of Java required...\n\n### Configuration proliferation is a problem...\n\nOne option would have been to simply add a new input parameter to the workflow,\nspecifying the required Java version, but that has a downside: it proliferates the\nnumber of places in a project where the desired Java version is declared - and there\nare many in use at the Guardian, with no well-agreed canonical source-of-truth:\n\n* GHA `ci.yml`, in the [`java-version`](https://github.com/guardian/etag-caching/blob/7ecc04981f5a42a0f2ecb10631f28da571a49836/.github/workflows/ci.yml#L22) field of `actions/setup-java` - this has been my favourite in the past, as whatever CI runs with is usually pretty close to the truth\n* In sbt, the `scalacOptions` of `-target`, `-release`, `-java-output-version` (currently `-release` preferred, tho' once [support](https://github.com/scala/scala/pull/10654) is pervasive, `-java-output-version` is probably best) and the `javacOptions` of `-target` & `-source` - these all effectively set lower-bounds on the version of Java supported, rather than guaranteeing a minimum upper bound of Java version the way CI does.\n* In apps running on Amigo AMI images; the Java version baked into the AMI, usually [referenced](https://github.com/guardian/mobile-apps-api/blob/3231e6bf064163c6d0e72c8dc862678c68eb0b62/mobile-fronts/conf/riff-raff.yaml#L10) by `riff-raff.yaml`\n* In AWS Lambdas; the cloudformation [`Runtime`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-runtime) parameter, often set [by CDK](https://github.com/guardian/mobile-save-for-later/blob/1ac12e4c0100edb976ebae9e2a9975ad2321e26e/cdk/lib/mobile-save-for-later.ts#L44)\n\n### ...`asdf`'s `.tool-versions` flle offers some consolidation\n\nBenefits of using `.tool-versions`:\n\n* Developers will automatically get the right Java version if they have `asdf` installed\n* https://github.com/actions/setup-java/pull/606 has added early support for reading the version of Java used in CI by `setup-java` from the `.tool-versions` flle - unfortunately, it's of limited use to us at the moment because of https://github.com/actions/setup-java/issues/615, but it's a promising start _(`setup-java` also has support for `jEnv` files, but they are not commonly used at the Guardian)_\n* Format of the file is simple enough that it can be easily understood and used, even if `asdf` is not in use - **including the file doesn't _force_ developers to use `asdf`** (I know some devs have been having some problems with it, and maybe there are/will be better alternatives out there), but it clearly documents the Java version to be used.\n\nThis does mean that **all library repos need to add a `.tool-versions` file** before this PR is merged. Helpful error messaging has been added with this PR to handle cases where the file is missing or invalid:\n\n#### Only Java _major_ version is guaranteed\n\nNote that although `asdf` requires a fully-specified Java version (eg `21.0.3.9.1`) in the `.tool-versions` file, currently the workflow will only match the *major* version of Java specified in the file (eg `21`), and will _always_ use the AWS Corretto distribution of Java. This is due to [limitations](https://github.com/actions/setup-java/issues/615) in [`actions/setup-java`](https://github.com/actions/setup-java).","shortMessageHtmlLink":"Build library with Java version specified in .tool-versions"}},{"before":"bbd2ddac4b0e408ea17991d9abf386468228f55a","after":"a0085347e9e83b380d748594cdb31f58554f93ad","ref":"refs/heads/use-java-version-specified-by-tool-versions-for-project-build","pushedAt":"2024-04-30T15:22:46.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"Build library with Java version specified in .tool-versions","shortMessageHtmlLink":"Build library with Java version specified in .tool-versions"}},{"before":"75e43c2e180e398951222334809ac90bdd3da7bc","after":"bbd2ddac4b0e408ea17991d9abf386468228f55a","ref":"refs/heads/use-java-version-specified-by-tool-versions-for-project-build","pushedAt":"2024-04-30T14:15:58.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"Build library with Java version specified in .tool-versions\n\nLog Java version used","shortMessageHtmlLink":"Build library with Java version specified in .tool-versions"}},{"before":"78d83ac5322d4015e4580f1816c65c02608ed3a8","after":"75e43c2e180e398951222334809ac90bdd3da7bc","ref":"refs/heads/use-java-version-specified-by-tool-versions-for-project-build","pushedAt":"2024-04-30T09:27:17.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"Build library with Java version specified in .tool-versions\n\nLog Java version used","shortMessageHtmlLink":"Build library with Java version specified in .tool-versions"}},{"before":"12d46a32d1b5e9f2f542219491cd9f348b36a4b9","after":"78d83ac5322d4015e4580f1816c65c02608ed3a8","ref":"refs/heads/use-java-version-specified-by-tool-versions-for-project-build","pushedAt":"2024-04-30T09:23:46.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"Build library with Java version specified in .tool-versions\n\nLog Java version used","shortMessageHtmlLink":"Build library with Java version specified in .tool-versions"}},{"before":"6d695c14b35fd028bb17fd8762e339467ae11abe","after":"12d46a32d1b5e9f2f542219491cd9f348b36a4b9","ref":"refs/heads/use-java-version-specified-by-tool-versions-for-project-build","pushedAt":"2024-04-26T17:17:36.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"Build library with Java version specified in .tool-versions\n\nLog Java version used","shortMessageHtmlLink":"Build library with Java version specified in .tool-versions"}},{"before":"6f7023eb1c4c4a641bd3c29dc0c4ca4b632b7e6c","after":"6d695c14b35fd028bb17fd8762e339467ae11abe","ref":"refs/heads/use-java-version-specified-by-tool-versions-for-project-build","pushedAt":"2024-04-26T17:16:24.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"Build library with Java version specified in .tool-versions\n\nLog Java version used","shortMessageHtmlLink":"Build library with Java version specified in .tool-versions"}},{"before":"2cbc98a32c677db6d85146d95c16a94ce944b6d4","after":"6f7023eb1c4c4a641bd3c29dc0c4ca4b632b7e6c","ref":"refs/heads/use-java-version-specified-by-tool-versions-for-project-build","pushedAt":"2024-04-26T16:53:13.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"WIP\n\nLog Java version used","shortMessageHtmlLink":"WIP"}},{"before":"79d54c1027d2692beffee98daa7e9aed234f7783","after":"2cbc98a32c677db6d85146d95c16a94ce944b6d4","ref":"refs/heads/use-java-version-specified-by-tool-versions-for-project-build","pushedAt":"2024-04-26T16:48:56.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"Log Java version used","shortMessageHtmlLink":"Log Java version used"}},{"before":"0320df02f62064a4848d87ac96e62e471f365115","after":"79d54c1027d2692beffee98daa7e9aed234f7783","ref":"refs/heads/use-java-version-specified-by-tool-versions-for-project-build","pushedAt":"2024-04-26T16:45:44.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"Log Java version used","shortMessageHtmlLink":"Log Java version used"}},{"before":"49a062eb26c71cb3385c628d02438fdc8593cb8a","after":"0320df02f62064a4848d87ac96e62e471f365115","ref":"refs/heads/use-java-version-specified-by-tool-versions-for-project-build","pushedAt":"2024-04-26T16:29:22.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"WIP","shortMessageHtmlLink":"WIP"}},{"before":"1e1c900bc25728731a5ae6aadda82303f074c177","after":"49a062eb26c71cb3385c628d02438fdc8593cb8a","ref":"refs/heads/use-java-version-specified-by-tool-versions-for-project-build","pushedAt":"2024-04-26T16:13:42.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"WIP","shortMessageHtmlLink":"WIP"}},{"before":"6225e8d5042e509ea2e47e69cf087fd571ca47d7","after":"1e1c900bc25728731a5ae6aadda82303f074c177","ref":"refs/heads/use-java-version-specified-by-tool-versions-for-project-build","pushedAt":"2024-04-26T16:13:31.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"WIP","shortMessageHtmlLink":"WIP"}},{"before":"5c529d35a9b5032c63a1af89a55b98e510e50d6a","after":"8648ce9cb794384e85b654a581ceba77a53efffa","ref":"refs/heads/main","pushedAt":"2024-04-26T15:58:12.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"Tweak docs","shortMessageHtmlLink":"Tweak docs"}},{"before":"e53d3f45b29a3f3cee5e004a395f42ee6bcfb5ee","after":"6225e8d5042e509ea2e47e69cf087fd571ca47d7","ref":"refs/heads/use-java-version-specified-by-tool-versions-for-project-build","pushedAt":"2024-04-26T15:26:26.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"WIP","shortMessageHtmlLink":"WIP"}},{"before":"4ccf19bb2dd032130243da959edad27f322fbbe2","after":"e53d3f45b29a3f3cee5e004a395f42ee6bcfb5ee","ref":"refs/heads/use-java-version-specified-by-tool-versions-for-project-build","pushedAt":"2024-04-26T14:08:34.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"WIP","shortMessageHtmlLink":"WIP"}},{"before":null,"after":"4ccf19bb2dd032130243da959edad27f322fbbe2","ref":"refs/heads/use-java-version-specified-by-tool-versions-for-project-build","pushedAt":"2024-04-26T14:04:06.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"WIP","shortMessageHtmlLink":"WIP"}},{"before":"674ce71ab913364cae7077beeea699d4d7a56c20","after":null,"ref":"refs/heads/verify-artifact-hashes","pushedAt":"2024-04-26T11:16:01.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"}},{"before":"cc53a31fdc6d856940def18ddab4d1ab4d36848e","after":"5c529d35a9b5032c63a1af89a55b98e510e50d6a","ref":"refs/heads/main","pushedAt":"2024-04-26T11:15:56.000Z","pushType":"pr_merge","commitsCount":2,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"Merge pull request #34 from guardian/verify-artifact-hashes\n\nVerify artifact hashes before signing","shortMessageHtmlLink":"Merge pull request <a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2263260858\" data-permission-text=\"Title is private\" data-url=\"https://github.com/guardian/gha-scala-library-release-workflow/issues/34\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/guardian/gha-scala-library-release-workflow/pull/34/hovercard\" href=\"https://github.com/guardian/gha-scala-library-release-workflow/pull/34\">#34</a> from guardian/verify-artifact-hashes"}},{"before":"5c9fab7bee1c160e3df8381939bdf2a50721997a","after":"674ce71ab913364cae7077beeea699d4d7a56c20","ref":"refs/heads/verify-artifact-hashes","pushedAt":"2024-04-26T10:42:37.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"Verify artifact hashes before signing\n\nIn `gha-scala-library-release-workflow`, artifacts are created in one GitHub Job\n(`🎊 Create artifacts`), and then _signed_ in another (`🔒 Sign`) - the artifacts\nare transmitted between Jobs by using GitHub's cache infrastructure\n(https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows),\nas there are many megabytes of artifact data to transfer, more than the 1 MB\n`$GITHUB_OUTPUT` string (https://docs.github.com/en/actions/using-jobs/defining-outputs-for-jobs)\nsupported by GitHub Jobs could necessarily handle.\n\n`$GITHUB_OUTPUT` has the advantage that it's scoped to a single workflow run, whereas\nthe cache infrastructure is shared between all workflows in the repository - making it\nmore vulnerable to tampering.\n\nIn principle, an attack could exist where another GitHub workflow in the same repo could\ngenerate an identical cache key, replacing the genuine artifacts with malicious ones,\nwhich would then be signed by the `🔒 Sign` Job.\n\nAdding artifact hash verification\n---------------------------------\n\nWe've already been recording artifact SHA256 hashes in `🎊 Create artifacts`, and later\nstoring them in the annotated git tag associated with the release:\n\nhttps://github.com/guardian/gha-scala-library-release-workflow/blob/cc53a31fdc6d856940def18ddab4d1ab4d36848e/.github/workflows/reusable-release.yml#L268-L273\n\n...but we haven't been _verifying_ those SHA256 hashes when coming into the `🔒 Sign` phase,\n when the generated artifacts are loaded out of cached storage. This commit adds that\n additional security check.","shortMessageHtmlLink":"Verify artifact hashes before signing"}},{"before":"a7ea22b75a3c0a3c6c94ec6902d97c37bde7ba00","after":"5c9fab7bee1c160e3df8381939bdf2a50721997a","ref":"refs/heads/verify-artifact-hashes","pushedAt":"2024-04-26T10:10:06.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"Verify artifact hashes\n\nApparently sha256deep does not change its exit code if it encounters a non-matching file","shortMessageHtmlLink":"Verify artifact hashes"}},{"before":"5c9fab7bee1c160e3df8381939bdf2a50721997a","after":"a7ea22b75a3c0a3c6c94ec6902d97c37bde7ba00","ref":"refs/heads/verify-artifact-hashes","pushedAt":"2024-04-25T16:54:22.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"Simulate a bad file being added for signing","shortMessageHtmlLink":"Simulate a bad file being added for signing"}},{"before":null,"after":"a7ea22b75a3c0a3c6c94ec6902d97c37bde7ba00","ref":"refs/heads/simulate-a-bad-file-being-added-for-signing","pushedAt":"2024-04-25T16:51:40.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"Simulate a bad file being added for signing","shortMessageHtmlLink":"Simulate a bad file being added for signing"}},{"before":"60d56f0da25c54f9b27bcea1d29fd4530c207755","after":"5c9fab7bee1c160e3df8381939bdf2a50721997a","ref":"refs/heads/verify-artifact-hashes","pushedAt":"2024-04-25T16:50:06.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"Verify artifact hashes\n\nApparently sha256deep does not change its exit code if it encounters a non-matching file","shortMessageHtmlLink":"Verify artifact hashes"}},{"before":"75dc46aa7a36bf50a32cb99bb42030516a54eebb","after":"60d56f0da25c54f9b27bcea1d29fd4530c207755","ref":"refs/heads/verify-artifact-hashes","pushedAt":"2024-04-25T16:46:35.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"Verify artifact hashes\n\nApparently sha256deep does not change its exit code if it encounters a non-matching file","shortMessageHtmlLink":"Verify artifact hashes"}},{"before":"18d9be76b06193a50c86b0a2843e35d4b3c817b4","after":"75dc46aa7a36bf50a32cb99bb42030516a54eebb","ref":"refs/heads/verify-artifact-hashes","pushedAt":"2024-04-25T16:41:06.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"Remove file deliberately added to fail the check","shortMessageHtmlLink":"Remove file deliberately added to fail the check"}},{"before":"7284e268c83aa5dae24416dd50110214c61c636f","after":"18d9be76b06193a50c86b0a2843e35d4b3c817b4","ref":"refs/heads/verify-artifact-hashes","pushedAt":"2024-04-25T16:36:57.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"Apparently sha256deep does not change its exit code if it encounters a non-matching file","shortMessageHtmlLink":"Apparently sha256deep does not change its exit code if it encounters …"}},{"before":"e09a6049ae1930a7025969502e9f045929bf1fe5","after":"7284e268c83aa5dae24416dd50110214c61c636f","ref":"refs/heads/verify-artifact-hashes","pushedAt":"2024-04-25T14:25:55.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"rtyley","name":"Roberto Tyley","path":"/rtyley","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/52038?s=80&v=4"},"commit":{"message":"I can not understand why the if statement is not firing...","shortMessageHtmlLink":"I can not understand why the if statement is not firing..."}}],"hasNextPage":true,"hasPreviousPage":false,"activityType":"all","actor":null,"timePeriod":"all","sort":"DESC","perPage":30,"cursor":"djE6ks8AAAAET713AwA","startCursor":null,"endCursor":null}},"title":"Activity · guardian/gha-scala-library-release-workflow"}