Re-add CI releases

[strazto]

Originally posted by @9p4 in #39 (comment)

First of all, why aren't we using https://github.com/Kevinjil/jellyfin-plugin-repo-action over your fork?

When I opened the PR, kevin hadn't merged my changes into his upstream, they should be at parity now though

Second, can we trust these actions with a token? I'd prefer to avoid supply chain attacks.

it's valid to be paranoid of supply chain attacks, but I don't know how to fully answer this -

Short answer is - I think so
I'm in direct correspondence with the authors + contribute to the actions directly concerned with building

Re. The actions concerned with GitHub API that use tokens, the version is pinned to a specific tag, which should be sufficient to ensure we can at least rely on the version were running.

Mostly they seem to have minimal dependencies, too

I'll have to check that in more depth, but I can vouch for the current state of Kevin's action at the very least

Your review is as good as mine for the rest

[strazto]

#46 (comment) @9p4 👀

Pls whitelist these actions

[9p4]

Sorry for the delay. Whitelisted the hash a7832ecc44c6b1a45d531970f6647b8682b005b8

[strazto]

Sorry for the delay. Whitelisted the hash a7832ecc44c6b1a45d531970f6647b8682b005b8

Thank you! I think there might be a few actions that need to be whitelisted, but I'm unsure

[strazto]

Error: .github#L1
fjogeleit/yaml-update-action@v0.10.0, oddstr13/jellyfin-plugin-repository-manager@master, softprops/action-gh-release@50195ba7f6f93d1ac97ba8332a178e008ad176aa, and kevinjil/jellyfin-plugin-repo-action@v0.4.0 are not allowed to be used in 9p4/jellyfin-plugin-sso. Actions in this workflow must be: within a repository owned by 9p4, created by GitHub, verified in the GitHub Marketplace, or matching the following: creyd/prettier_action@v4.2, Kevinjil/jellyfin-plugin-repo-action@a7832ecc44c6b1a45d531970f6647b8682b005b8

Yep, that's a good start but the workflow uses a couple more actions that need whitelist:

# Doesn't touch github_token
- fjogeleit/yaml-update-action@v0.10.0, 
- oddstr13/jellyfin-plugin-repository-manager@master, 
# Uses token but I've reviewed the pinned version
- softprops/action-gh-release@50195ba7f6f93d1ac97ba8332a178e008ad176aa, 
- kevinjil/jellyfin-plugin-repo-action@v0.4.0

• Looks like I do need to pin the version for oddstr13/jellyfin-plugin-repository-manager@master
  • oddstr13/jellyfin-plugin-repository-manager@b9e92867a6aa279d611a5ea80cf61f6358838c39 is a good ref (the maintainer hasnt posted a release for a long time so we have to use a ref)

I checked the format for the actions whitelist, here's the specification needs to be added to whitelist the actions used in the workflow:

fjogeleit/yaml-update-action@v0.10.0,oddstr13/jellyfin-plugin-repository-manager@b9e92867a6aa279d611a5ea80cf61f6358838c39,softprops/action-gh-release@50195ba7f6f93d1ac97ba8332a178e008ad176aa,kevinjil/jellyfin-plugin-repo-action@v0.4.0

[strazto]

Closed by #46 #50 #48