feat(ci): hash publication becomes a dispatch; flux CI loses write access to fluxhashes

.github/workflows/nodejs.yml

@@ -3,6 +3,36 @@ name: Node CI
 on: [push]
 
 jobs:
+  # Publication is a request, not a write: the fluxhashes signer fetches this commit itself,
+  # derives the tree hash from the bytes it fetched, and publishes list, signed document and
+  # provenance in one commit. The token can trigger that workflow and nothing else. NEW_HASH rides
+  # along as a tripwire the signer checks against its own computation -- a mismatch is a red
+  # signing run, never a listed value. Forks publish nothing.
+  #
+  # Its own job, deliberately: the hash describes a checkout nothing else has touched, and a
+  # publication failure (fluxhashes unavailable, token expired) stays a red publish job instead of
+  # blocking the test suite.
+  publish:
+    runs-on: ubuntu-22.04
+    if: github.repository == 'RunOnFlux/flux'
+    steps:
+      - uses: actions/checkout@v7
+      - name: Check Hash
+        run: |
+          newhash=$(find ./ZelBack -type f -exec md5sum {} + | awk '{print $1}' | LC_ALL=C sort | md5sum | awk '{printf $1}')
+          echo $newhash
+          echo NEW_HASH=$newhash >> $GITHUB_ENV
+      - name: Request hash publication
+        env:
+          GH_TOKEN: ${{ secrets.FLUXHASHES_DISPATCH_TOKEN }}
+        run: |
+          gh api -X POST repos/RunOnFlux/fluxhashes/actions/workflows/sign-hashlist.yml/dispatches \
+            -f ref=master \
+            -f "inputs[commit]=${GITHUB_SHA}" \
+            -f "inputs[ref]=${GITHUB_REF_NAME}" \
+            -f "inputs[ref_type]=${GITHUB_REF_TYPE}" \
+            -f "inputs[claimed_hash]=${NEW_HASH}"
+
   build:
     runs-on: ${{ matrix.os }}
 
@@ -24,39 +54,6 @@ jobs:
         uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
-      - name: Check Hash
-        run: |
-          newhash=$(find ./ZelBack -type f -exec md5sum {} + | awk '{print $1}' | LC_ALL=C sort | md5sum | awk '{printf $1}')
-          echo $newhash
-          echo NEW_HASH=$newhash >> $GITHUB_ENV
-      - name: Get current hashes
-        run: |
-          mkdir hashes
-          wget 'https://raw.githubusercontent.com/RunOnFlux/fluxhashes/master/src/hashes/hashes.js' -P hashes
-          hashfile=`cat hashes/hashes.js | sed "s/return/_/gi" | sed "s/\n/_/gi"`
-          echo HASH_FILE=$hashfile >> $GITHUB_ENV
-      - name: Show hashes
-        run: |
-          echo $HASH_FILE
-          echo $NEW_HASH
-      - name: Patch hashes
-        if: ${{ !contains(env.HASH_FILE, env.NEW_HASH) }}
-        run: |
-          newhash=$(find ./ZelBack -type f -exec md5sum {} + | awk '{print $1}' | LC_ALL=C sort | md5sum | awk '{printf $1}')
-          sed -i "s/  ];/    '$newhash',\n  ];/gi" hashes/hashes.js
-          tail -n 200 hashes/hashes.js
-      - name: Push hashes to fluxhashes
-        if: ${{ !contains(env.HASH_FILE, env.NEW_HASH) }}
-        uses: cpina/github-action-push-to-another-repository@main
-        env:
-          API_TOKEN_GITHUB: ${{ secrets.API_TOKEN_GITHUB }}
-        with:
-          source-directory: "hashes"
-          destination-github-username: "RunOnFlux"
-          destination-repository-name: "fluxhashes"
-          user-email: runonfluxbot@gmail.com
-          target-branch: master
-          target-directory: src/hashes/
       - name: install flux and flux benchmark daemons
         run: |
           echo 'deb https://apt.runonflux.io/ '$(lsb_release -cs)' main' | sudo tee /etc/apt/sources.list.d/flux.list