fix(ci): harden publishing and validate examples

.github/workflows/ci.yaml

@@ -7,48 +7,105 @@ on:
   pull_request:
   workflow_dispatch:
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   build:
-    name: Build
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - name: Check project rules
-        run: python3 check_project_rules.py
-      - name: Check release metadata
-        run: npm test
-      - name: Install Chromium and CJK fonts
-        uses: browser-actions/setup-chrome@v2
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Install locked Node dependencies
+        env:
+          PUPPETEER_SKIP_DOWNLOAD: "true"
+        run: npm ci
+
+      - name: Install canonical-example validators
+        env:
+          KUBECONFORM_VERSION: "0.8.0"
+          KUBECONFORM_SHA256: "9bc2bffbf71f261128533edaf912153948b7ff238f9a531ae6d34466ec287883"
+          ACTIONLINT_VERSION: "1.7.12"
+          ACTIONLINT_SHA256: "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8"
+        run: |
+          mkdir -p "$RUNNER_TEMP/bin"
+          kube_archive="$RUNNER_TEMP/kubeconform.tar.gz"
+          curl -fsSL --retry 3 \
+            "https://github.com/yannh/kubeconform/releases/download/v${KUBECONFORM_VERSION}/kubeconform-linux-amd64.tar.gz" \
+            -o "$kube_archive"
+          echo "${KUBECONFORM_SHA256}  $kube_archive" | sha256sum -c -
+          tar xzf "$kube_archive" -C "$RUNNER_TEMP/bin" kubeconform
+
+          actionlint_archive="$RUNNER_TEMP/actionlint.tar.gz"
+          curl -fsSL --retry 3 \
+            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" \
+            -o "$actionlint_archive"
+          echo "${ACTIONLINT_SHA256}  $actionlint_archive" | sha256sum -c -
+          tar xzf "$actionlint_archive" -C "$RUNNER_TEMP/bin" actionlint
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+
+      - name: Check project rules, metadata, and canonical examples
+        run: |
+          python3 check_project_rules.py
+          npm test
+          python3 tools/test_examples.py --require-tools
+
+      - name: Install Chromium
+        uses: browser-actions/setup-chrome@2e1d749697dd1612b833dba4a722266286fbefcd # v2.1.2
         with:
           chrome-version: stable
-      - name: Install CJK fonts
+
+      - name: Install CJK fonts and PDF inspection tools
         run: |
           sudo apt-get update
-          sudo apt-get install -y fonts-noto-cjk fonts-noto-cjk-extra
-      - name: Install mdpress 0.7.10
+          sudo apt-get install -y fonts-noto-cjk fonts-noto-cjk-extra poppler-utils
+
+      - name: Install mdPress 0.7.10
         env:
           MDPRESS_VERSION: "0.7.10"
           MDPRESS_SHA256: "17e53e455996940bbbce64c69c43b3fb543f1501e03b74cf0434074efebd2db4"
         run: |
-          archive="/tmp/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz"
-          echo "Installing mdpress ${MDPRESS_VERSION}"
-          curl -fsSL "https://github.com/yeasy/mdPress/releases/download/v${MDPRESS_VERSION}/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" -o "$archive"
+          archive="$RUNNER_TEMP/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz"
+          curl -fsSL --retry 3 \
+            "https://github.com/yeasy/mdPress/releases/download/v${MDPRESS_VERSION}/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" \
+            -o "$archive"
           echo "${MDPRESS_SHA256}  $archive" | sha256sum -c -
-          tar xzf "$archive"
-          sudo mv mdpress /usr/local/bin/
-          mdpress --version
+          tar xzf "$archive" -C "$RUNNER_TEMP" mdpress
+          mkdir -p "$RUNNER_TEMP/bin"
+          install -m 0755 "$RUNNER_TEMP/mdpress" "$RUNNER_TEMP/bin/mdpress"
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+
       - name: Prepare PDF sources
         run: python3 tools/prepare_pdf_sources.py --book-dir . --out "$RUNNER_TEMP/docker_practice-pdf-src"
+
       - name: Build PDF
         working-directory: ${{ runner.temp }}/docker_practice-pdf-src
-        run: mdpress build --format pdf --output "$GITHUB_WORKSPACE/docker_practice.pdf"
+        run: |
+          mkdir -p "$GITHUB_WORKSPACE/dist"
+          mdpress build --format pdf --output "$GITHUB_WORKSPACE/dist/docker_practice.pdf"
+
       - name: Build site
         run: npm run build
-      - name: Upload PDF as artifact
-        uses: actions/upload-artifact@v7
+
+      - name: Verify build artifacts
+        run: |
+          title=$(python3 -c 'import json; print(json.load(open("book.json", encoding="utf-8"))["title"])')
+          python3 tools/verify_artifacts.py \
+            --title "$title" \
+            --pdf dist/docker_practice.pdf \
+            --site _site \
+            --checksums dist/SHA256SUMS
+          (cd dist && sha256sum -c SHA256SUMS)
+
+      - name: Upload verified PDF
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: docker_practice-pdf
-          path: docker_practice.pdf
+          path: |
+            dist/docker_practice.pdf
+            dist/SHA256SUMS
+          if-no-files-found: error