From 5e3d608761015b1df74e6b2e0a4907f834ee3367 Mon Sep 17 00:00:00 2001
From: ziggie <ziggie1984@protonmail.com>
Date: Thu, 12 Feb 2026 18:34:05 +0100
Subject: [PATCH] ci: add verify-release workflow

Add a workflow that triggers when a release is published. It runs
verify-install.sh inside the official Docker image to validate
signatures and binary hashes. If verification fails, the release
is automatically set back to draft.
---
 .github/workflows/verify-release.yaml | 36 +++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 .github/workflows/verify-release.yaml

diff --git a/.github/workflows/verify-release.yaml b/.github/workflows/verify-release.yaml
new file mode 100644
index 000000000..a9aaa267d
--- /dev/null
+++ b/.github/workflows/verify-release.yaml
@@ -0,0 +1,36 @@
+name: Verify release
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Release version tag (e.g. v0.20.1-beta)'
+        required: true
+
+permissions:
+  contents: write
+
+jobs:
+  verify-release:
+    name: Verify release signatures and binaries
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify release
+        env:
+          VERSION: ${{ inputs.version || github.event.release.tag_name }}
+        run: |
+          docker run --rm --entrypoint="" \
+            lightninglabs/lnd:${VERSION} \
+            /verify-install.sh ${VERSION}
+
+      - name: Set release back to draft on failure
+        if: failure()
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ inputs.version || github.event.release.tag_name }}
+        run: |
+          gh release edit ${VERSION} \
+            --repo ${{ github.repository }} \
+            --draft