Harden plugin catalog validation and release signing

.github/workflows/CI_build.yml

@@ -1,85 +1,150 @@
 name: CI_build
 
-on: [push, pull_request]
+on:
+  push:
+  pull_request:
 
-jobs:
-  build:
+permissions:
+  contents: read
 
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
     runs-on: windows-2022
+    timeout-minutes: 15
 
-    permissions:
-      # Give the default GITHUB_TOKEN write permission to commit and push the changed files back to the repository.
-      contents: write
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: requirements.lock
+
+      - name: Install locked Python modules
+        run: "python -m pip install --disable-pip-version-check --require-hashes --only-binary=:all: -r requirements.lock"
+
+      - name: Run regression tests
+        run: python -m unittest discover -s tests -v
+
+      - name: Run offline catalog and documentation checks
+        run: python validator.py all --offline
+
+  build:
+    needs: quality
+    runs-on: windows-2022
+    timeout-minutes: 90
 
     strategy:
       fail-fast: false
       matrix:
-        build_configuration: [Release]
-        build_platform: [x64, Win32, arm64]
+        include:
+          - build_configuration: Release
+            build_platform: x64
+            validator_arch: x64
+            artifact_name: plugin_dll_and_list_x64
+            dll_path: bin64\nppPluginList.dll
+            doc_path: doc\plugin_list_x64.md
+          - build_configuration: Release
+            build_platform: Win32
+            validator_arch: x86
+            artifact_name: plugin_dll_and_list_x86
+            dll_path: bin\nppPluginList.dll
+            doc_path: doc\plugin_list_x86.md
+          - build_configuration: Release
+            build_platform: ARM64
+            validator_arch: arm64
+            artifact_name: plugin_dll_and_list_arm64
+            dll_path: binarm64\nppPluginList.dll
+            doc_path: doc\plugin_list_arm64.md
 
     steps:
-    - name: Checkout repo
-      uses: actions/checkout@v7
-
-    - name: Install python modules
-      working-directory: .
-      run: pip3 install -r requirements.txt
-
-    - name: check used package versions
-      working-directory: .
-      run: pip3 freeze
-
-    - name: Validate json
-      working-directory: .
-      run: python validator.py ${{ matrix.build_platform }}
+      - name: Checkout repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: requirements.lock
+
+      - name: Install locked Python modules
+        run: "python -m pip install --disable-pip-version-check --require-hashes --only-binary=:all: -r requirements.lock"
+
+      - name: Validate package hashes, archives and DLL versions
+        shell: pwsh
+        run: |
+          for ($attempt = 1; $attempt -le 3; $attempt++) {
+            python validator.py ${{ matrix.validator_arch }}
+            if ($LASTEXITCODE -eq 0) {
+              exit 0
+            }
+            if ($attempt -lt 3) {
+              Start-Sleep -Seconds (15 * $attempt)
+            }
+          }
+          exit 1
+
+      - name: Add msbuild to PATH
+        uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3
+
+      - name: Build plugin list DLL
+        working-directory: vcxproj
+        run: msbuild nppPluginList.vcxproj /m /p:configuration="${{ matrix.build_configuration }}" /p:platform="${{ matrix.build_platform }}" /p:PlatformToolset="v143"
+
+      - name: Archive build artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ matrix.artifact_name }}
+          path: |
+            ${{ matrix.dll_path }}
+            ${{ matrix.doc_path }}
+          if-no-files-found: error
+          retention-days: 14
 
-    - name: Add msbuild to PATH
-      uses: microsoft/setup-msbuild@v3
+  update-plugin-lists:
+    needs: build
+    runs-on: windows-2022
+    timeout-minutes: 15
+    if: github.repository_owner == 'notepad-plus-plus' && github.ref_type == 'tag'
 
-    - name: MSBuild of plugin dll
-      working-directory: vcxproj
-      run: msbuild nppPluginList.vcxproj /m /p:configuration="${{ matrix.build_configuration }}" /p:platform="${{ matrix.build_platform }}" /p:PlatformToolset="v143"
+    permissions:
+      contents: write
 
-    - name: Archive artifacts for x64
-      if: matrix.build_platform == 'x64' && matrix.build_configuration == 'Release'
-      uses: actions/upload-artifact@v7
-      with:
-          name: plugin_dll_and_list_x64
-          path: |
-                bin64\nppPluginList.dll
-                doc\plugin_list_x64.md
-
-    - name: Archive artifacts for Win32
-      if: matrix.build_platform == 'Win32' && matrix.build_configuration == 'Release'
-      uses: actions/upload-artifact@v7
-      with:
-          name: plugin_dll_and_list_x86
-          path: |
-                bin\nppPluginList.dll
-                doc\plugin_list_x86.md
-
-    - name: Archive artifacts for ARM64
-      if: matrix.build_platform == 'ARM64' && matrix.build_configuration == 'Release'
-      uses: actions/upload-artifact@v7
-      with:
-          name: plugin_dll_and_list_arm64
-          path: |
-                binarm64\nppPluginList.dll
-                doc\plugin_list_arm64.md
-
-    - name: Checkout main branch if push trigger is a tag
-      if: github.repository_owner == 'notepad-plus-plus' && github.ref_type == 'tag' && matrix.build_platform == 'ARM64' && matrix.build_configuration == 'Release'
-      run: |
-           git fetch --all
-           git checkout master
-
-    - name: Generate all plugin lists markdown from json on tagging
-      if: startsWith(github.ref, 'refs/tags/') && matrix.build_platform == 'ARM64' && matrix.build_configuration == 'Release'
-      working-directory: .
-      run: python validator.py all_md
-
-    - name: Push markdown changes on tagging
-      if: startsWith(github.ref, 'refs/tags/') && matrix.build_platform == 'ARM64' && matrix.build_configuration == 'Release'
-      uses: stefanzweifel/git-auto-commit-action@v7
-      with:
-        file_pattern: 'doc/*.md'
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: requirements.lock
+
+      - name: Install locked Python modules
+        run: "python -m pip install --disable-pip-version-check --require-hashes --only-binary=:all: -r requirements.lock"
+
+      - name: Checkout main branch
+        run: git checkout master
+
+      - name: Generate all plugin list documentation
+        run: python validator.py all_md
+
+      - name: Push generated documentation
+        uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7
+        with:
+          file_pattern: doc/*.md