chore: add deployment monitoring scripts for metadata and shasum validation

[robertolopezlopez]

User description

This PR

• extracts script logic out of deployment-monitor.yml to separate scripts
• extracts previous embedded python scripts to separate Go programs

Both changes aim for readability and sustainability.

In detail:

• .github/scripts/deployment-monitor/capture-linux-metadata.sh
  • Captures version and sha256 metadata for Linux-based distribution channels.
  • Logic shared by monitor_npm and monitor_snyk_images jobs.
• .github/scripts/deployment-monitor/capture-homebrew-metadata.sh
  • Captures version and sha256 metadata for the Homebrew distribution channel (macOS).
  • Used by monitor_homebrew job.
• .github/scripts/deployment-monitor/compare-snyk-versions.sh
  • Compares collected Snyk version artifacts for stable/preview consistency.
  • Used by compare_versions job.
• .github/scripts/deployment-monitor/helpers/*
  • Utility scripts extracted from those listed above.
• .github/scripts/deployment-monitor/cmd/*
  • Small Go programs which replace the previous embedded Python code.
• .github/workflows/deployment-monitor.yml
  • Skimmed of previous testing logic.

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages
  are release-note ready, emphasizing
  what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___)
• Includes product update to be announced in the next stable release notes

What does this PR do?

Where should the reviewer start?

How should this be manually tested?

What's the product update that needs to be communicated to CLI users?

---

PR Type

Enhancement

---

Description

• Introduce new scripts for Snyk CLI deployment monitoring.
  • Automate validation of release artifact SHA256 checksums.
  • Ensure version consistency across different distribution channels.
  • Refactor CI workflow to leverage new modular scripts.

---

Diagram Walkthrough

    flowchart LR
      subgraph "New Scripts"
        A[compare-cdn-shasums.go]
        B[extract-release-json-hash.go]
        C[is-elf-binary.go]
        D[capture-homebrew-metadata.sh]
        E[capture-linux-metadata.sh]
        F[compare-snyk-versions.sh]
        G[helpers]
      end
      subgraph "Existing Workflow"
        H[deployment-monitor.yml]
      end
      H -- "Orchestrates and calls" --> A
      H -- "Orchestrates and calls" --> B
      H -- "Orchestrates and calls" --> C
      H -- "Orchestrates and calls" --> D
      H -- "Orchestrates and calls" --> E
      H -- "Orchestrates and calls" --> F
      H -- "Orchestrates and calls" --> G
      D -- "Uses helper" --> G
      E -- "Uses helper" --> G
      F -- "Uses helper" --> G
      A -- "Uses tool" --> C
      E -- "Uses tool" --> C
      D -- "Uses tool" --> B

Loading

File Walkthrough

	Relevant files

---

Deployment Tests > Run workflow > this branch

Successful test

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[robertolopezlopez]

/describe

[github-actions]

	Warnings
⚠️	"chore: add deployment monitoring scripts for metadata and shasum validation" is too long. Keep the first line of your commit message under 72 characters.

Generated by 🚫 dangerJS against 4995920

[snyk-pr-review-bot]

PR Description updated to latest commit (c6c758c)

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Logic Error 🟠 [major] The script explicitly filters metadata to only include static.snyk.io and downloads.snyk.io. However, capture-homebrew-metadata.sh sets BASE_URL="homebrew" and capture-linux-metadata.sh may set descriptive names like npm. These channels are silently ignored during shasum consistency checks, meaning the Homebrew binary's hash is never verified against the CDN versions despite metadata being collected for it. if data.BaseURL != "static.snyk.io" && data.BaseURL != "downloads.snyk.io" { continue } Fragile Globbing 🟡 [minor] The script uses ls *.txt and for file in *.txt to collect version numbers. Since this script runs in the SNYK_VERSION_DIR where artifacts are downloaded, any unrelated text files (e.g., build logs, READMEs) will be treated as version files. This will cause the script to fail with an error or report a false version mismatch if the unrelated file does not contain a valid version string. txt_files=$(ls *.txt 2>/dev/null || true) if [ -z "$txt_files" ]; then echo "❌ No .txt files found in ${SNYK_VERSION_DIR}. Version comparison cannot proceed." exit 2 fi echo "Collected Snyk versions:" stable_versions=() preview_versions=() # First, sort the *.txt files containg versions numbers into a preview and stable array for file in *.txt; do Unsafe JSON Generation 🟡 [minor] The script generates a JSON file using a shell heredoc without any character escaping. If BINARY_NAME or VERSION (which comes from snyk --version) contains a double quote or backslash (common in pre-release or custom build strings), the resulting metadata file will be invalid JSON, causing the compare-cdn-shasums Go utility to exit with an error. cat <<EOF >"${SNYK_VERSION_DIR}/snyk-metadata-${METADATA_SUFFIX}.json" {"channel":"${CHANNEL}","base_url":"${BASE_URL}","binary":"${BINARY_NAME}","version":"${VERSION}","sha256":"${SHA256}"} EOF

📚 Repository Context Analyzed This review considered 29 relevant code sections from 12 files (average relevance: 1.00) release-scripts/upload-artifacts.sh (3 segments, lines 101-200) scripts/build-ts-binary-wrapper-locally.go (lines 1-261) scripts/upgrade-snyk-go-dependencies.go (lines 1-149) release-scripts/hcl-to-json-parser-generator-v2/test-and-release.sh (lines 1-74) release-scripts/release.json (lines 1-42) release-scripts/validate-repository.sh (lines 1-63) cliv2/scripts/prepare_licenses.go (lines 1-189) ... and 5 more file(s)

🤖 Repository instructions applied (from AGENTS.md)