chore(ci): source code tampering protection for release

.github/actions/download-artifact/action.yml

@@ -0,0 +1,58 @@
+name: Download artifact
+description: Wrapper around GitHub's official action, with additional extraction before download
+
+# PROCESS
+#
+# 1. Downloads artifact using actions/download-artifact action
+# 2. Extracts and overwrites tarball previously uploaded
+# 3. Remove archive after extraction
+
+# NOTES
+#
+# Upload-artifact and download-artifact takes ~2m40s to upload 8MB
+# so this is custom action cuts down the entire operation to 1s
+# by uploading/extracting a tarball while relying on the official upload-artifact/download-artifact actions
+#
+
+# USAGE
+#
+# NOTE: Meant to be used with ./.github/actions/upload-artifact
+#
+# - name: Restore sealed source code
+# uses: ./.github/actions/download-artifact
+# with:
+#   name: ${{ needs.seal.outputs.INTEGRITY_HASH }}
+#   path: .
+
+# https://github.com/actions/download-artifact/blob/main/action.yml
+inputs:
+  name:
+    description: Artifact name
+    required: true
+  path:
+    description: Destination path. By default, it will download to the current working directory.
+    required: false
+    default: .
+
+runs:
+  using: composite
+  steps:
+    - name: Download artifacts
+      uses: actions/download-artifact@cbed621e49e4c01b044d60f6c80ea4ed6328b281 # v2.1.1
+      with:
+        name: ${{ inputs.name }}
+        path: ${{ inputs.path }}
+
+    - name: Extract artifacts
+      run: tar -xvf "${ARCHIVE}"
+      env:
+        ARCHIVE: ${{ inputs.name }}.tar
+      shell: bash
+      working-directory: ${{ inputs.path }}
+
+    - name: Remove archive
+      run: rm -f "${ARCHIVE}"
+      env:
+        ARCHIVE: ${{ inputs.name }}.tar
+      shell: bash
+      working-directory: ${{ inputs.path }}

.github/actions/upload-artifact/action.yml

@@ -0,0 +1,83 @@
+name: Upload artifact
+description: Wrapper around GitHub's official action, with additional archiving before upload
+
+# PROCESS
+#
+# 1. Creates tarball excluding .git and *.pyc files
+# 2. Uploads tarball using actions/upload-artifact action, fail CI job if no file is found
+# 3. Remove archive after uploading it.
+
+# NOTES
+#
+# Upload-artifact and download-artifact takes ~2m40s to upload 8MB
+# so this is custom action cuts down the entire operation to 1s
+# by uploading/extracting a tarball while relying on the official upload-artifact/download-artifact actions
+#
+
+# USAGE
+#
+# NOTE: Meant to be used with ./.github/actions/download-artifact
+#
+# - name: Upload sealed source code
+#   uses: ./.github/actions/upload-artifact
+#   with:
+#     name: ${{ steps.integrity.outputs.INTEGRITY_HASH }}
+#     path: .
+
+# https://github.com/actions/upload-artifact/blob/main/action.yml
+inputs:
+  name:
+    description: Artifact name
+    required: true
+  path:
+    description: >
+      A file, directory or wildcard pattern that describes what to upload.
+
+      You can pass multiple paths separated by space (e.g., dir1 dir2 file.txt).
+
+      Paths and wildcard patterns must be tar command compatible.
+    required: true
+  retention-days:
+    description: >
+      Artifact retention in days. By default 1 day, max of 90 days, and 0 honours default repo retention.
+
+      You can change max days in the repository settings.
+    required: false
+    default: "1"
+  if-no-files-found:
+    description: >
+      Action to perform if no files are found: warn, error, ignore. By default, it fails fast with 'error'.
+
+      Options:
+        warn: Output a warning but do not fail the action
+        error: Fail the action with an error message
+        ignore: Do not output any warnings or errors, the action does not fail
+    required: false
+    default: error
+
+runs:
+  using: composite
+  steps:
+    - name: Archive artifacts
+      run: |
+        tar --exclude-vcs \
+            --exclude "*.pyc" \
+            -cvf "${ARCHIVE}" "${PATH_TO_ARCHIVE}"
+      env:
+        ARCHIVE: ${{ inputs.name }}.tar
+        PATH_TO_ARCHIVE: ${{ inputs.path }}
+      shell: bash
+
+    - name: Upload artifacts
+      uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+      with:
+        if-no-files-found: ${{ inputs.if-no-files-found }}
+        name: ${{ inputs.name }}
+        path: ${{ inputs.name }}.tar
+        retention-days: ${{ inputs.retention-days }}
+
+    - name: Remove archive
+      run: rm -f "${ARCHIVE}"
+      env:
+        ARCHIVE: ${{ inputs.name }}.tar
+      shell: bash