ci: publish tested module release assets

ci/integration.sh

@@ -1,40 +1,47 @@
 #!/usr/bin/env bash
-# Builds Signage as the canonical linux-x64-glibc Module Package, then gives that exact release pair
-# to the pinned platform's generic deployment smoke. The platform image contains no Signage source:
+# Gives the canonical linux-x64-glibc Module Package pair from the package job to the pinned
+# platform's generic deployment smoke. The platform image contains no Signage source:
 # its verifier extracts the package into installation-owned module storage before migrations,
 # discovery, browser UI/display checks, restart, container recreation, disable/re-enable, removal,
 # and reinstall are exercised against disposable PostgreSQL and object-storage services.
 #
+#   bash ci/package.sh
 #   bash ci/fetch-platform.sh
 #   bash ci/integration.sh
 set -Eeuo pipefail
 
 root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
 platform="$root/build/platform"
-release="$root/build/module-package"
+release="${1:-$root/build/module-package}"
 [[ -f "$platform/scripts/smoke-deploy.sh" ]] || {
   echo "integration: run bash ci/fetch-platform.sh first." >&2
   exit 1
 }
 
-source_revision="${GITHUB_SHA:-$(git -C "$root" rev-parse HEAD 2>/dev/null || true)}"
-[[ "$source_revision" =~ ^[0-9a-f]{40}$ ]] || {
-  echo "integration: no full source revision is available for the package." >&2
+mapfile -t archives < <(find "$release" -maxdepth 1 -type f -name 'signage-*-linux-x64-glibc.tar.gz' -print)
+[[ "${#archives[@]}" -eq 1 ]] || {
+  echo "integration: expected exactly one prebuilt Module Package archive." >&2
   exit 1
 }
-
-rm -rf "$release"
-mkdir -p "$release"
-pnpm --dir "$root" build
-pnpm --dir "$root" exec ekklesia-pack-module --module "$root" --target linux-x64-glibc \
-  --out "$release" --license-file "$root/LICENSE" --source-revision "$source_revision"
+archive="${archives[0]}"
+checksum="$archive.sha256"
+[[ -f "$checksum" ]] || {
+  echo "integration: missing $(basename "$checksum")." >&2
+  exit 1
+}
+(cd "$release" && sha256sum --check --strict "$(basename "$checksum")")
+digest="$(sha256sum "$archive" | cut -d' ' -f1)"
+if [[ -n "${EXPECTED_PACKAGE_SHA256:-}" && "$digest" != "$EXPECTED_PACKAGE_SHA256" ]]; then
+  echo "integration: prebuilt package sha256 $digest differs from the package job's $EXPECTED_PACKAGE_SHA256." >&2
+  exit 1
+fi
 
 scenarios="$(sed -e 's/#.*//' -e '/^[[:space:]]*$/d' "$root/ci/display-scenarios" | tr '\n' ' ')"
 [[ -n "${scenarios// /}" ]] || {
   echo "integration: ci/display-scenarios lists no scenario." >&2
   exit 1
 }
-echo "integration: external Signage package built; scenarios: ${scenarios}"
+echo "integration: consuming prebuilt $(basename "$archive"); scenarios: ${scenarios}"
 
 cd "$platform"
 EKKLESIA_SMOKE_TOPOLOGY=split \