kingwl
0a486f09c9
Bring the node-addon-landlock-run tree (tag v0.0.1, commit 614f7fd) into native/landlock-run as its source of record: launcher development happens here, next to the harness consumers, and the standalone repository becomes the release mirror the tree is exported to for packing and publishing (procedure in native/README.md). The subtree keeps its own pnpm workspace and lockfile and is NOT added to the harness workspace: harness installs, gates, and CI never touch it. The mirror's .github/ stays out of the subtree; a separate manually-dispatched workflow (.github/workflows/landlock-run.yml) runs the subtree's CI legs — the per-architecture native builds, real-kernel launcher proofs, and pack rehearsal — adapted with working-directory/cache paths. eslint ignores the subtree like vendor/; AGENTS.md gains the native/ layout line (+5 words on its budget ceiling).
53 lines
1.7 KiB
JavaScript
53 lines
1.7 KiB
JavaScript
#!/usr/bin/env node
|
|
/**
|
|
* Release verification. Always: every published package carries one shared
|
|
* version, and — when running from a tag or publishing — the `vX.Y.Z` tag
|
|
* matches it. With `--prebuilds`: every platform package's declared
|
|
* binaries exist with the right ELF architecture (run after
|
|
* `assemble-prebuilds.mjs` or a local `build:native`).
|
|
*/
|
|
|
|
import path from 'node:path';
|
|
import { packageDirs, platformDirs, readJson, root, verifyPlatformBinaries } from './repo.mjs';
|
|
|
|
function verifyVersions() {
|
|
const packages = packageDirs().map((dir) => ({
|
|
dir,
|
|
manifest: readJson(path.join(root, dir, 'package.json')),
|
|
}));
|
|
const versions = new Set(packages.map((pkg) => pkg.manifest.version));
|
|
if (versions.size !== 1) {
|
|
throw new Error([
|
|
'published package versions must match:',
|
|
...packages.map((pkg) => `${pkg.dir}: ${pkg.manifest.version}`),
|
|
].join('\n'));
|
|
}
|
|
|
|
const version = packages[0].manifest.version;
|
|
const ref = process.env.GITHUB_REF || '';
|
|
const publish = process.env.RELEASE_PUBLISH === 'true';
|
|
if (publish && !ref.startsWith('refs/tags/v')) {
|
|
throw new Error('publishing requires running the workflow from a v* tag');
|
|
}
|
|
if (ref.startsWith('refs/tags/v')) {
|
|
const tagVersion = ref.slice('refs/tags/v'.length);
|
|
if (tagVersion !== version) {
|
|
throw new Error(`tag/version mismatch: tag v${tagVersion}, packages ${version}`);
|
|
}
|
|
}
|
|
|
|
console.log(`Verified release version ${version}`);
|
|
}
|
|
|
|
function verifyPrebuilds() {
|
|
for (const dir of platformDirs()) {
|
|
const { name, count } = verifyPlatformBinaries(path.join(root, dir));
|
|
console.log(`Verified ${name}: ${count} binaries`);
|
|
}
|
|
}
|
|
|
|
verifyVersions();
|
|
if (process.argv.includes('--prebuilds')) {
|
|
verifyPrebuilds();
|
|
}
|