Repository: cli/cli
File: pkg/cmd/release/verify/verify.go (Go)

Code before:

	"github.com/cli/cli/v2/pkg/cmdutil"
	"github.com/spf13/cobra"
)

type VerifyOptions struct {
	TagName     string
	BaseRepo    ghrepo.Interface
	Exporter    cmdutil.Exporter
	TrustedRoot string
}

type VerifyConfig struct {
	HttpClient  *http.Client
	IO          *iostreams.IOStreams
	Opts        *VerifyOptions
	AttClient   api.Client
	AttVerifier shared.Verifier
}

func NewCmdVerify(f *cmdutil.Factory, runF func(config *VerifyConfig) error) *cobra.Command {
	opts := &VerifyOptions{}

	cmd := &cobra.Command{
		Use:   "verify [<tag>]",
		Short: "Verify the attestation for a GitHub Release.",
		Args:  cobra.MaximumNArgs(1),
		Long: heredoc.Doc(`
			Verify that a GitHub Release is accompanied by a valid cryptographically signed attestation.

			## Understanding Verification

			An attestation is a claim made by GitHub regarding a release and its assets.

			## What This Command Does

			This command checks that the specified release (or the latest release, if no tag is given) has a valid attestation.
			It fetches the attestation for the release and prints out metadata about all assets referenced in the attestation, including their digests.
		`),
		Example: heredoc.Doc(`
			# Verify the latest release
			gh release verify
			
			# Verify a specific release by tag
			gh release verify v1.2.3

			# Verify a specific release by tag and output the attestation in JSON format
			gh release verify v1.2.3 --format json
		`),
		RunE: func(cmd *cobra.Command, args []string) error {
			if len(args) > 0 {

Review comment (suggestion):
Period at the end is not consistent with other `release` subcommands. The same comment for `verify-asset`.

Code after:

	"github.com/cli/cli/v2/pkg/cmdutil"
	"github.com/spf13/cobra"
)

type VerifyOptions struct {
	TagName     string
	BaseRepo    ghrepo.Interface
	Exporter    cmdutil.Exporter
	TrustedRoot string
}

type VerifyConfig struct {
	HttpClient  *http.Client
	IO          *iostreams.IOStreams
	Opts        *VerifyOptions
	AttClient   api.Client
	AttVerifier shared.Verifier
}

func NewCmdVerify(f *cmdutil.Factory, runF func(config *VerifyConfig) error) *cobra.Command {
	opts := &VerifyOptions{}

	cmd := &cobra.Command{
		Use:   "verify [<tag>]",
		Short: "Verify the attestation for a release",
		Args:  cobra.MaximumNArgs(1),
		Long: heredoc.Doc(`
			Verify that a GitHub Release is accompanied by a valid cryptographically signed attestation.

			An attestation is a claim made by GitHub regarding a release and its assets.

			This command checks that the specified release (or the latest release, if no tag is given) has a valid attestation. 
			It fetches the attestation for the release and prints metadata about all assets referenced in the attestation, including their digests.
		`),
		Example: heredoc.Doc(`
			# Verify the latest release
			gh release verify
			
			# Verify a specific release by tag
			gh release verify v1.2.3

			# Verify a specific release by tag and output the attestation in JSON format
			gh release verify v1.2.3 --format json
		`),
		RunE: func(cmd *cobra.Command, args []string) error {
			if len(args) > 0 {
				opts.TagName = args[0]
			}

			baseRepo, err := f.BaseRepo()