chore(ci): source code tampering protection for release (#2301)

* chore: create download-artifact, upload-artifact

* chore: seals source code, separate quality check & build

Uses new mechanism to seal source code, run quality checks separately,
and always reuses sealed source code in every step to prevent source
code tampering.

It documents every job purpose, and creates a new faster action
to upload and download artifacts.

* chore: ruben's feedback

Co-authored-by: Ruben Fonseca <[email protected]>
Signed-off-by: Heitor Lessa <[email protected]>

* chore: document remaining sections; update release process doc

* chore: include python bytecode in tarball for accurate hash verification

* chore: add hash verification

* chore: cleanup before review

* chore: fix build integrity hash reference

* chore: upgrade download-artifact to v3 due to node deprecation warnings

---------

Signed-off-by: Heitor Lessa <[email protected]>
Co-authored-by: Ruben Fonseca <[email protected]>

Author: heitorlessa

.github/actions/download-artifact/action.yml

@@ -0,0 +1,58 @@
+name: Download artifact
+description: Wrapper around GitHub's official action, with additional extraction before download
+
+# PROCESS
+#
+# 1. Downloads artifact using actions/download-artifact action
+# 2. Extracts and overwrites tarball previously uploaded
+# 3. Remove archive after extraction
+
+# NOTES
+#
+# Upload-artifact and download-artifact takes ~2m40s to upload 8MB
+# so this is custom action cuts down the entire operation to 1s
+# by uploading/extracting a tarball while relying on the official upload-artifact/download-artifact actions
+#
+
+# USAGE
+#
+# NOTE: Meant to be used with ./.github/actions/upload-artifact
+#
+# - name: Restore sealed source code
+# uses: ./.github/actions/download-artifact
+# with:
+#   name: ${{ needs.seal.outputs.INTEGRITY_HASH }}
+#   path: .
+
+# https://github.com/actions/download-artifact/blob/main/action.yml
+inputs:
+  name:
+    description: Artifact name
+    required: true
+  path:
+    description: Destination path. By default, it will download to the current working directory.
+    required: false
+    default: .
+
+runs:
+  using: composite
+  steps:
+    - name: Download artifacts
+      uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+      with:
+        name: ${{ inputs.name }}
+        path: ${{ inputs.path }}
+
+    - name: Extract artifacts
+      run: tar -xvf "${ARCHIVE}"
+      env:
+        ARCHIVE: ${{ inputs.name }}.tar
+      shell: bash
+      working-directory: ${{ inputs.path }}
+
+    - name: Remove archive
+      run: rm -f "${ARCHIVE}"
+      env:
+        ARCHIVE: ${{ inputs.name }}.tar
+      shell: bash
+      working-directory: ${{ inputs.path }}

.github/actions/upload-artifact/action.yml

@@ -0,0 +1,82 @@
+name: Upload artifact
+description: Wrapper around GitHub's official action, with additional archiving before upload
+
+# PROCESS
+#
+# 1. Creates tarball excluding .git files
+# 2. Uploads tarball using actions/upload-artifact action, fail CI job if no file is found
+# 3. Remove archive after uploading it.
+
+# NOTES
+#
+# Upload-artifact and download-artifact takes ~2m40s to upload 8MB
+# so this is custom action cuts down the entire operation to 1s
+# by uploading/extracting a tarball while relying on the official upload-artifact/download-artifact actions
+#
+
+# USAGE
+#
+# NOTE: Meant to be used with ./.github/actions/download-artifact
+#
+# - name: Upload sealed source code
+#   uses: ./.github/actions/upload-artifact
+#   with:
+#     name: ${{ steps.integrity.outputs.INTEGRITY_HASH }}
+#     path: .
+
+# https://github.com/actions/upload-artifact/blob/main/action.yml
+inputs:
+  name:
+    description: Artifact name
+    required: true
+  path:
+    description: >
+      A file, directory or wildcard pattern that describes what to upload.
+
+      You can pass multiple paths separated by space (e.g., dir1 dir2 file.txt).
+
+      Paths and wildcard patterns must be tar command compatible.
+    required: true
+  retention-days:
+    description: >
+      Artifact retention in days. By default 1 day, max of 90 days, and 0 honours default repo retention.
+
+      You can change max days in the repository settings.
+    required: false
+    default: "1"
+  if-no-files-found:
+    description: >
+      Action to perform if no files are found: warn, error, ignore. By default, it fails fast with 'error'.
+
+      Options:
+        warn: Output a warning but do not fail the action
+        error: Fail the action with an error message
+        ignore: Do not output any warnings or errors, the action does not fail
+    required: false
+    default: error
+
+runs:
+  using: composite
+  steps:
+    - name: Archive artifacts
+      run: |
+        tar --exclude-vcs \
+            -cvf "${ARCHIVE}" "${PATH_TO_ARCHIVE}"
+      env:
+        ARCHIVE: ${{ inputs.name }}.tar
+        PATH_TO_ARCHIVE: ${{ inputs.path }}
+      shell: bash
+
+    - name: Upload artifacts
+      uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+      with:
+        if-no-files-found: ${{ inputs.if-no-files-found }}
+        name: ${{ inputs.name }}
+        path: ${{ inputs.name }}.tar
+        retention-days: ${{ inputs.retention-days }}
+
+    - name: Remove archive
+      run: rm -f "${ARCHIVE}"
+      env:
+        ARCHIVE: ${{ inputs.name }}.tar
+      shell: bash