What the developer wrote
Authored by ziggie
ci: add verify-release workflow
Add a workflow that triggers when a release is published. It runs
verify-install.sh inside the official Docker image to validate
signatures and binary hashes. If verification fails, the release
is automatically set back to draft.
What changed, and why it matters
This commit adds a new GitHub Actions workflow that automatically checks a newly published LND software release for valid digital signatures and matching binary hashes. If the check fails, the release is reverted to draft status so users are not exposed to a potentially bad release. It is a defensive hardening change, not a vulnerability fix or malicious change.
No security action required. Review the workflow's permissions and failure-handling behavior as part of normal CI governance. Ensure verify-install.sh itself is maintained and audited, since this workflow delegates trust to it.
Security signals we found
Adds release-integrity verification automation
Uses official Docker image and existing verify-install.sh script
Grants contents:write only to the GitHub Actions workflow token for the draft-revert step
No vulnerability patch, bug fix, or functional code change present
Evidence from the diff
The commit introduces .github/workflows/verify-release.yaml. It triggers on release:published and workflow_dispatch. It runs the existing /verify-install.sh script inside the official lightninglabs/lnd:${VERSION} Docker image to validate release signatures and binary hashes. On failure, it uses the built-in GITHUB_TOKEN with contents: write permission to mark the release as draft. No code logic, cryptographic routines, or network endpoints are modified; this is purely CI/release-process automation.
Changed components
.github/workflows/verify-release.yamlGitHub release processInspect captured patch +36 / −0
diff --git a/.github/workflows/verify-release.yaml b/.github/workflows/verify-release.yaml
new file mode 100644
index 0000000..a9aaa26
--- /dev/null
+++ b/.github/workflows/verify-release.yaml
@@ -0,0 +1,36 @@
+name: Verify release
+
+on:
+ release:
+ types: [published]
+ workflow_dispatch:
+ inputs:
+ version:
+ description: 'Release version tag (e.g. v0.20.1-beta)'
+ required: true
+
+permissions:
+ contents: write
+
+jobs:
+ verify-release:
+ name: Verify release signatures and binaries
+ runs-on: ubuntu-latest
+ steps:
+ - name: Verify release
+ env:
+ VERSION: ${{ inputs.version || github.event.release.tag_name }}
+ run: |
+ docker run --rm --entrypoint="" \
+ lightninglabs/lnd:${VERSION} \
+ /verify-install.sh ${VERSION}
+
+ - name: Set release back to draft on failure
+ if: failure()
+ env:
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ VERSION: ${{ inputs.version || github.event.release.tag_name }}
+ run: |
+ gh release edit ${VERSION} \
+ --repo ${{ github.repository }} \
+ --draft
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.