From 6d1baffe161379ad3c5a5bd230a25809a0e17914 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 11 Jul 2025 16:23:40 +0000
Subject: [PATCH] Restrict SHA256 hash generation to source code archives only

Co-authored-by: NikolajBjorner <3085284+NikolajBjorner@users.noreply.github.com>
---
 scripts/nightly.yaml |  8 ++++----
 scripts/release.yml  | 24 +++++++++++++-----------
 2 files changed, 17 insertions(+), 15 deletions(-)

diff --git a/scripts/nightly.yaml b/scripts/nightly.yaml
index a8fae30b2..109f9faf3 100644
--- a/scripts/nightly.yaml
+++ b/scripts/nightly.yaml
@@ -454,13 +454,13 @@ stages:
         targetPath: tmp
     - script: |
         cd tmp
-        for file in *.zip; do
-          if [ -f "$file" ]; then
+        for file in z3-*.zip; do
+          if [ -f "$file" ] && [[ "$file" == *"$(Build.SourceVersion)"* ]]; then
             sha256sum "$file" > "$file.sha256"
-            echo "Generated SHA256 for $file"
+            echo "Generated SHA256 for source code archive: $file"
           fi
         done
-      displayName: 'Generate SHA256 hashes for ZIP files'
+      displayName: 'Generate SHA256 hashes for source code archives'
     - task: GitHubRelease@1
       continueOnError: true 
       inputs:
diff --git a/scripts/release.yml b/scripts/release.yml
index 3a3979782..5f0be0122 100644
--- a/scripts/release.yml
+++ b/scripts/release.yml
@@ -249,7 +249,7 @@ stages:
       displayName: 'Download Ubuntu ARM64 Build'
       inputs:
         artifact: 'UbuntuArm64'
-        path: $(Agent.TempDirectory)\package	
+        path: $(Agent.TempDirectory)\package
     - task: DownloadPipelineArtifact@2
       displayName: 'Download macOS Build'
       inputs:
@@ -359,7 +359,7 @@ stages:
       displayName: 'Download Win64 Build'
       inputs:
         artifact: 'WindowsBuild-x64'
-        path: $(Agent.TempDirectory)	
+        path: $(Agent.TempDirectory)
     - task: DownloadPipelineArtifact@2
       displayName: 'Download ManyLinux Build'
       inputs:
@@ -423,7 +423,7 @@ stages:
       displayName: 'Download macOSArm64 Build'
       inputs:
         artifact: 'MacArm64'
-        path: $(Agent.TempDirectory)	
+        path: $(Agent.TempDirectory)
     - task: DownloadPipelineArtifact@2
       displayName: 'Download Win32 Build'
       inputs:
@@ -438,7 +438,7 @@ stages:
       displayName: 'Download Arm64 Build'
       inputs:
         artifact: 'WindowsBuild-arm64'
-        path: $(Agent.TempDirectory)	
+        path: $(Agent.TempDirectory)
     - task: DownloadPipelineArtifact@2
       displayName: "Download Python"
       inputs:
@@ -455,15 +455,17 @@ stages:
         artifact: 'NuGet32'
         path: $(Agent.TempDirectory)
     - powershell: |
-        $files = Get-ChildItem -Path "$(Agent.TempDirectory)" -Filter "*.zip"
+        $files = Get-ChildItem -Path "$(Agent.TempDirectory)" -Filter "z3-*.zip"
         foreach ($file in $files) {
-          $hash = Get-FileHash -Path $file.FullName -Algorithm SHA256
-          $hashString = $hash.Hash.ToLower() + "  " + $file.Name
-          $hashFile = $file.FullName + ".sha256"
-          Set-Content -Path $hashFile -Value $hashString
-          Write-Host "Generated SHA256 for $($file.Name)"
+          if ($file.Name -like "*$(Build.SourceVersion)*") {
+            $hash = Get-FileHash -Path $file.FullName -Algorithm SHA256
+            $hashString = $hash.Hash.ToLower() + "  " + $file.Name
+            $hashFile = $file.FullName + ".sha256"
+            Set-Content -Path $hashFile -Value $hashString
+            Write-Host "Generated SHA256 for source code archive: $($file.Name)"
+          }
         }
-      displayName: 'Generate SHA256 hashes for ZIP files'
+      displayName: 'Generate SHA256 hashes for source code archives'
     - task: GitHubRelease@1
       inputs:
         gitHubConnection: Z3Prover