ekklesiaandClaude Opus 5.5
9debe4e891
CI / verify (pull_request) Successful in 1m2s
CI / infrastructure-smoke (pull_request) Successful in 35s
CI / migration-smoke (pull_request) Successful in 1m52s
CI / package-release (pull_request) Failing after 16s
CI / image-build (pull_request) Successful in 29s
CI / deploy-smoke (same-origin) (pull_request) Successful in 44s
CI / deploy-smoke (split) (pull_request) Successful in 1m29s
Produces the exact public package tarballs of a platform release, validates them, and proves a standalone module consumes those artifacts end to end. Nothing is published and no credential is configured. - scripts/package-release.ts (pnpm packages:release) is the canonical release builder: from a clean commit it rebuilds the nine public packages from clean output, packs each, inspects every tarball, checks the release set and coordinated versions, and only then writes ekklesia-packages-<version>/ with the tarballs, SHA256SUMS, and a provider-neutral manifest (ekklesia-package-train.json: version, revision, and each package's file, size, SHA-256, npm integrity). - Packing uses a pack-only pnpm beforePacking hook (passed with --config.pnpmfile, never the workspace's install settings). pnpm inserts rewritten workspace: dependencies in async completion order, so two checkouts of one commit packed module-pack's package.json with keys in a different order; the hook restores the source key order (and the inspection enforces it). It also drops devDependencies, which named private packages outside the train. - scripts/test-package-release.sh (pnpm test:package-release, the CI package-release gate) builds the train twice, the second time from a separate worktree, requires byte-identical release directories, then runs the standalone consumer proof on the release: manifest checked, offline install from the tarballs only, lockfile integrity equal to the manifest's, frozen-lockfile reinstall, no Drizzle, one React, contracts only transitive, every @ekklesia package and module-pack at the release version, skipLibCheck: false, UI build, pack, and Core verification. - docs/development/releases.md documents the release order, the train, the artifacts, and the reproducibility findings; registry publication remains unimplemented. - ADR 0053 is Accepted: everything it decides that does not need a registry is now proven, and registry provisioning is on its own Deferred list. Co-Authored-By: Claude Opus 5.5 <[email protected]>
60 lines
2.5 KiB
Bash
Executable File
60 lines
2.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# The package release gate (ADR 0053): what must pass before a future step may publish a package
|
|
# train. It publishes nothing.
|
|
#
|
|
# bash scripts/test-package-release.sh [--allow-modified]
|
|
#
|
|
# 1. Builds the public package train from this checkout (`scripts/package-release.ts`): clean build
|
|
# output, pack, inspect, release manifest.
|
|
# 2. Builds it again from a separate worktree of the same commit, at another absolute path, and
|
|
# requires the two release directories to be byte-identical: every tarball, SHA256SUMS, and the
|
|
# manifest.
|
|
# 3. Installs the release into the standalone fixture and proves it builds, packages, and verifies
|
|
# (`scripts/test-standalone-module.sh`).
|
|
#
|
|
# `--allow-modified` is for local development on a modified source tree. The second build is then
|
|
# made in this checkout again, because a worktree of the commit would not hold the modifications.
|
|
set -euo pipefail
|
|
|
|
repository_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
allow_modified=()
|
|
if [[ "${1:-}" == "--allow-modified" ]]; then
|
|
allow_modified=(--allow-modified)
|
|
elif (($#)); then
|
|
echo "usage: test-package-release.sh [--allow-modified]" >&2
|
|
exit 64
|
|
fi
|
|
|
|
work="$(mktemp -d "${TMPDIR:-/tmp}/ekklesia-package-release-XXXXXX")"
|
|
worktree="$work/second-checkout"
|
|
cleanup() {
|
|
if [[ -d "$worktree" ]]; then
|
|
git -C "$repository_root" worktree remove --force "$worktree" >/dev/null 2>&1 || true
|
|
fi
|
|
rm -rf "$work"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
echo "==> Building the package train"
|
|
node "$repository_root/scripts/package-release.ts" --out "$work/first" "${allow_modified[@]}"
|
|
release="$(find "$work/first" -mindepth 1 -maxdepth 1 -type d)"
|
|
|
|
echo "==> Building it again, to prove the artifacts are reproducible"
|
|
if ((${#allow_modified[@]})); then
|
|
node "$repository_root/scripts/package-release.ts" --out "$work/second" "${allow_modified[@]}" >/dev/null
|
|
else
|
|
git -C "$repository_root" worktree add --detach --quiet "$worktree" HEAD
|
|
(cd "$worktree" && pnpm install --offline --frozen-lockfile --reporter=silent)
|
|
node "$worktree/scripts/package-release.ts" --out "$work/second" >/dev/null
|
|
fi
|
|
if ! diff -r "$release" "$(find "$work/second" -mindepth 1 -maxdepth 1 -type d)"; then
|
|
echo "package release gate failed: two builds of the same commit produced different artifacts" >&2
|
|
exit 1
|
|
fi
|
|
echo " byte-identical: $(ls "$release" | wc -l) files"
|
|
|
|
echo "==> Consuming the release from a standalone module"
|
|
bash "$repository_root/scripts/test-standalone-module.sh" --release "$release" "${allow_modified[@]}"
|
|
|
|
echo "Package release gate passed."
|