fix(ci): pin sfw download tag, swap SOCKET_API_TOKEN secret#1252
Merged
John-David Dalton (jdalton) merged 2 commits intov1.xfrom Apr 22, 2026
Merged
fix(ci): pin sfw download tag, swap SOCKET_API_TOKEN secret#1252John-David Dalton (jdalton) merged 2 commits intov1.xfrom
John-David Dalton (jdalton) merged 2 commits intov1.xfrom
Conversation
The sfw / sfw-free downloads fetched releases/latest at runtime but
verified against hardcoded SHA256s in the same file. Any upstream
release immediately broke every consumer because the downloaded bytes
no longer matched the pinned checksum. Backporting the socket-registry
fix (1ab0cfbf) to v1.x.
Fix:
- Introduce SFW_FREE_VERSION / SFW_ENTERPRISE_VERSION env vars at the
top of each download step. Same value today (1.7.2) but the two
tracks can diverge independently. Bumping a tool requires updating
the matching version AND every platform's SHA256 in the same commit.
- Switch from gh api repos/.../releases/latest to
gh api repos/.../releases/tags/v${SFW_VERSION} so the download path
is pinned to the same tag the checksums reference. A new upstream
release can no longer break CI.
- Guard against an empty DOWNLOAD_URL (asset missing from the pinned
tag) with a clear error instead of silently piping curl nothing.
- Refresh all SHA256s (5 platforms x 2 tracks: sfw-free and
firewall-release enterprise) to the v1.7.2 bytes.
Applied to all three workflows on v1.x (inlined, not shared):
- .github/workflows/ci.yml (3 identical blocks)
- .github/workflows/provenance.yml (1 block)
- .github/workflows/e2e-tests.yml (1 block, free-only)
The duplication is intentional on v1.x to avoid coupling to reusable
workflow changes.
Martin Torp (mtorp)
approved these changes
Apr 22, 2026
Repo-level secret renamed to SOCKET_API_TOKEN. Only the secrets.* reference changes — the env var name the CLI reads (SOCKET_CLI_API_TOKEN) stays the same.
John-David Dalton (jdalton)
changed the title
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two small CI fixes for
v1.x:sfw/sfw-freedownloads to a version tag so upstream releases stop breaking our hardcoded checksums.SOCKET_CLI_API_TOKENsecret reference toSOCKET_API_TOKENto match the renamed repo secret.1. Pin sfw download to a tag
sfw/sfw-freefrom thereleases/latestendpoint, then checks it against a SHA256 we hardcoded. When a newsfwrelease ships upstream,lateststarts returning new bytes but our hardcoded SHA256 still points at the old bytes, so every job fails with a checksum mismatch.v1.7.2) so the bytes we download always match the SHA256 we're checking.v1.7.2values so we're on the latest release.What changed
SFW_FREE_VERSIONandSFW_ENTERPRISE_VERSIONvariables at the top of each download step (both set to1.7.2right now).gh apicall fromrepos/.../releases/latesttorepos/.../releases/tags/v${SFW_VERSION}.curlan empty URL).v1.7.2values.Where
Three workflows on
v1.x:.github/workflows/ci.yml— 3 copies of the same download block (matrix jobs).github/workflows/provenance.yml— 1 block.github/workflows/e2e-tests.yml— 1 block (free-only, no enterprise branch)The duplication is on purpose on
v1.x— we inlined everything to avoid pulling in shared/reusable workflow changes.Why this is safe
Next time someone bumps sfw, they have to update
SFW_FREE_VERSION/SFW_ENTERPRISE_VERSIONAND all the SHA256s in the same commit. If they forget one, CI fails on that commit instead of mysteriously breaking a week later when upstream ships.2. Swap
SOCKET_CLI_API_TOKENsecret ref toSOCKET_API_TOKENRepo-level secret was renamed to
SOCKET_API_TOKEN. Only thesecrets.*reference in.github/workflows/e2e-tests.ymlchanges — the env var name the CLI reads (SOCKET_CLI_API_TOKEN) stays the same.Test plan