fix: route Mac resume through trusted CI event

Author: gitcommit90

.github/workflows/candidate.yml

@@ -33,7 +33,8 @@ jobs:
        github.event.workflow_run.event == 'push' &&
        github.event.workflow_run.head_branch == 'main' &&
        github.event.workflow_run.head_repository.full_name == github.repository &&
-       github.event.workflow_run.head_sha == vars.HELM_RELEASE_SHA)
+       (github.event.workflow_run.head_sha == vars.HELM_RELEASE_SHA ||
+        github.event.workflow_run.head_sha == vars.HELM_MAC_RESUME_HARNESS_SHA))
     runs-on: ubuntu-latest
     timeout-minutes: 5
     outputs:
@@ -43,14 +44,14 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.commit || github.event.workflow_run.head_sha }}
+          ref: ${{ (github.event_name == 'workflow_dispatch' && inputs.commit) || (github.event.workflow_run.head_sha == vars.HELM_MAC_RESUME_HARNESS_SHA && vars.HELM_MAC_RESUME_SHA) || github.event.workflow_run.head_sha }}
           fetch-depth: 1
           persist-credentials: false
       - name: Create the empty draft
         id: release
         env:
-          GH_TOKEN: ${{ github.event_name == 'workflow_dispatch' && secrets.HELM_RELEASE_TOKEN || github.token }}
-          COMMIT: ${{ github.event_name == 'workflow_dispatch' && inputs.commit || github.event.workflow_run.head_sha }}
+          GH_TOKEN: ${{ (github.event_name == 'workflow_dispatch' || github.event.workflow_run.head_sha == vars.HELM_MAC_RESUME_HARNESS_SHA) && secrets.HELM_RELEASE_TOKEN || github.token }}
+          COMMIT: ${{ (github.event_name == 'workflow_dispatch' && inputs.commit) || (github.event.workflow_run.head_sha == vars.HELM_MAC_RESUME_HARNESS_SHA && vars.HELM_MAC_RESUME_SHA) || github.event.workflow_run.head_sha }}
         run: |
           set -euo pipefail
           test "$(git rev-parse HEAD)" = "$COMMIT"
@@ -81,7 +82,7 @@ jobs:
   linux-build:
     name: Build the Linux release once
     needs: prepare
-    if: github.event_name != 'workflow_dispatch'
+    if: github.event_name != 'workflow_dispatch' && github.event.workflow_run.head_sha != vars.HELM_MAC_RESUME_HARNESS_SHA
     runs-on: ubuntu-latest
     timeout-minutes: 45
     outputs:
@@ -127,7 +128,7 @@ jobs:
   accept-linux:
     name: Fresh install and start — Linux
     needs: [prepare, linux-build]
-    if: github.event_name != 'workflow_dispatch'
+    if: github.event_name != 'workflow_dispatch' && github.event.workflow_run.head_sha != vars.HELM_MAC_RESUME_HARNESS_SHA
     runs-on: [1helm-linux-phase4]
     timeout-minutes: 30
     steps:
@@ -160,7 +161,7 @@ jobs:
   accept-windows:
     name: Fresh install and start — Windows
     needs: [prepare, linux-build]
-    if: github.event_name != 'workflow_dispatch'
+    if: github.event_name != 'workflow_dispatch' && github.event.workflow_run.head_sha != vars.HELM_MAC_RESUME_HARNESS_SHA
     runs-on: [1helm-windows-phase4]
     timeout-minutes: 30
     steps:
@@ -206,9 +207,9 @@ jobs:
           ref: ${{ needs.prepare.outputs.commit }}
           fetch-depth: 1
           persist-credentials: false
-          clean: ${{ github.event_name != 'workflow_dispatch' }}
+          clean: ${{ github.event_name != 'workflow_dispatch' && github.event.workflow_run.head_sha != vars.HELM_MAC_RESUME_HARNESS_SHA }}
       - name: Build, sign and notarize
-        if: github.event_name != 'workflow_dispatch'
+        if: github.event_name != 'workflow_dispatch' && github.event.workflow_run.head_sha != vars.HELM_MAC_RESUME_HARNESS_SHA
         env:
           HELM_CLOUDFLARED_CACHE_DIR: ${{ runner.temp }}/../1helm-release-cache
         run: |
@@ -218,7 +219,7 @@ jobs:
           PUPPETEER_SKIP_DOWNLOAD=1 npm ci
           npm run package:dmg:release
       - name: Resume the exact retained Mac files
-        if: github.event_name == 'workflow_dispatch'
+        if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.head_sha == vars.HELM_MAC_RESUME_HARNESS_SHA
         env:
           VERSION: ${{ needs.prepare.outputs.version }}
           EXPECTED_DMG_SHA256: 38531c1949b24e4c01882ebb18c75df9fea04b97f3deffe57d4e8e2090bc45ab
@@ -246,11 +247,11 @@ jobs:
         env:
           HELM_RELEASE_DIST: ${{ github.workspace }}/dist
           HELM_RELEASE_VERSION: ${{ needs.prepare.outputs.version }}
-          HARNESS_COMMIT: ${{ github.sha }}
+          HARNESS_COMMIT: ${{ github.event_name == 'workflow_dispatch' && github.sha || github.event.workflow_run.head_sha }}
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          if [[ "${{ github.event_name }}" == workflow_dispatch ]]; then
+          if [[ "${{ github.event_name }}" == workflow_dispatch || "${{ github.event.workflow_run.head_sha }}" == "${{ vars.HELM_MAC_RESUME_HARNESS_SHA }}" ]]; then
             curl --fail --location \
               --header "Authorization: Bearer $GH_TOKEN" \
               --header 'Accept: application/vnd.github.raw+json' \
@@ -262,7 +263,7 @@ jobs:
           fi
       - name: Upload the exact tested Mac files
         env:
-          GH_TOKEN: ${{ github.event_name == 'workflow_dispatch' && secrets.HELM_RELEASE_TOKEN || github.token }}
+          GH_TOKEN: ${{ (github.event_name == 'workflow_dispatch' || github.event.workflow_run.head_sha == vars.HELM_MAC_RESUME_HARNESS_SHA) && secrets.HELM_RELEASE_TOKEN || github.token }}
           TAG: ${{ needs.prepare.outputs.tag }}
           VERSION: ${{ needs.prepare.outputs.version }}
         run: |
@@ -280,7 +281,7 @@ jobs:
   publish:
     name: Publish the three tested files
     needs: [prepare, linux-build, accept-linux, accept-windows, accept-macos]
-    if: github.event_name != 'workflow_dispatch'
+    if: github.event_name != 'workflow_dispatch' && github.event.workflow_run.head_sha != vars.HELM_MAC_RESUME_HARNESS_SHA
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps: