fix(release): validate updater signing from workflow revision (#1726)

.github/scripts/release-workflow-contract_test.py

@@ -81,6 +81,26 @@ class ReleaseWorkflowContractTest(unittest.TestCase):
             self.assertIn("if: ${{ !inputs.dry_run", block)
             self.assertNotIn("inputs.backfill_tag == ''", block)
 
+    def test_updater_signing_validation_uses_workflow_control_revision(self) -> None:
+        build_desktop = job_block("build-desktop")
+        self.assertIn("ref: ${{ needs.prepare.outputs.ref }}", build_desktop)
+
+        detect = step_block("Detect Tauri updater signing input")
+        self.assertIn("GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}", detect)
+        self.assertIn("gh api", detect)
+        self.assertIn("$RUNNER_TEMP/updater-signing-ready.sh", detect)
+        self.assertIn(
+            "scripts/release/updater-signing-ready.sh?ref=${{ github.workflow_sha }}",
+            detect,
+        )
+        self.assertIn('if [ -z "$TAURI_SIGNING_PRIVATE_KEY" ]', detect)
+        self.assertLess(
+            detect.index('if [ -z "$TAURI_SIGNING_PRIVATE_KEY" ]'),
+            detect.index("gh api"),
+        )
+        self.assertIn('bash "$helper"', detect)
+        self.assertNotIn("bash scripts/release/updater-signing-ready.sh", detect)
+
     def test_macos_dmg_build_has_retry_timeout_and_diagnostics(self) -> None:
         build = step_block("Build Tauri desktop app")
         self.assertIn("timeout-minutes: 70", build)

.github/workflows/release.yml

@@ -772,6 +772,7 @@ jobs:
 
       - name: Detect Tauri updater signing input
         env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
         run: |
           set -euo pipefail
@@ -780,7 +781,12 @@ jobs:
             echo "::notice::Tauri updater signing key is absent; signed updater artifacts and latest.json will be skipped."
             exit 0
           fi
-          if ! bash scripts/release/updater-signing-ready.sh "${{ matrix.platform }}"; then
+          helper="$RUNNER_TEMP/updater-signing-ready.sh"
+          gh api \
+            --header "Accept: application/vnd.github.raw+json" \
+            "repos/${{ github.repository }}/contents/scripts/release/updater-signing-ready.sh?ref=${{ github.workflow_sha }}" \
+            > "$helper"
+          if ! bash "$helper" "${{ matrix.platform }}"; then
             echo "::error::Updater signing prerequisites failed for ${{ matrix.platform }}." >&2
             exit 1
           fi