Gate releases on shipped artifact findings

Review threads live on the whole diff, not on one commit, so none are shown here - a thread's line means something in the branch's final form, and painting it into an intermediate step would put it on code it is not about.

.github/workflows/release.ymlmodified+0-1

Changes to .github/workflows/release.yml

		⋯313 linesShow the 313 lines above this hunk@@ -314,7 +314,6 @@ jobs:
314	314	env:
315	315	CRAFT_PLATFORM: ${{ runner.os == 'macOS' && 'macos' || 'linux' }}
316	316	run: bun scripts/scan-release-artifacts.ts "$CRAFT_PLATFORM" packages/zig/zig-out "$RUNNER_TEMP/native-release-scan"
317		- done
318	317
319	318	# ── Publish & Release ──────────────────────────────
320	319	# Pantry action handles everything:

scripts/release-workflow.test.tsmodified+2-0

Changes to scripts/release-workflow.test.ts

		⋯44 linesShow the 44 lines above this hunk@@ -45,6 +45,8 @@ test('npm publication follows artifact validation, and macOS downloads run on bo
45	45	const native = release.jobs.pantry.steps!
46	46	expect(native.findIndex(step => step.name === 'Scan binaries prepared for publication')).toBeGreaterThan(native.findIndex(step => step.name === 'Notarize macOS binaries'))
47	47	expect(native.findIndex(step => step.name === 'Publish & Release')).toBeGreaterThan(native.findIndex(step => step.name === 'Scan binaries prepared for publication'))
	48	+ expect(native.find(step => step.name === 'Scan binaries prepared for publication')?.run)
	49	+ .toBe('bun scripts/scan-release-artifacts.ts "$CRAFT_PLATFORM" packages/zig/zig-out "$RUNNER_TEMP/native-release-scan"')
48	50	expect(native.filter(step => step.uses === './.github/actions/setup-release-scanners')).toHaveLength(1)
49	51	expect(release.jobs.npm.steps!.filter(step => step.uses === './.github/actions/setup-release-scanners')).toHaveLength(1)
50	52	expect(release.jobs['verify-macos-downloads'].strategy?.matrix.platform).toEqual([

scripts/scan-release-artifacts.test.tsmodified+10-0

Changes to scripts/scan-release-artifacts.test.ts

		⋯47 linesShow the 47 lines above this hunk@@ -48,6 +48,16 @@ test('Bun audit parser fails closed and only High or Critical blocks', () => {
48	48	expect(() => summarizeBunAudit(invalid)).toThrow()
49	49	})
50	50
	51	+test('release scanner rejects extra arguments before scanning', () => {
	52	+ const result = Bun.spawnSync([
	53	+ process.execPath,
	54	+ join(import.meta.dir, 'scan-release-artifacts.ts'),
	55	+ 'linux', '/missing', '/missing', 'done',
	56	+ ], { stdout: 'pipe', stderr: 'pipe' })
	57	+ expect(result.exitCode).not.toBe(0)
	58	+ expect(result.stderr.toString()).toContain('Usage: scan-release-artifacts.ts')
	59	+})
	60	+
51	61	function binary(root: string, path: string, magic: string) {
52	62	const absolute = join(root, path)
53	63	mkdirSync(join(absolute, '..'), { recursive: true })

scripts/scan-release-artifacts.tsmodified+4-2

Changes to scripts/scan-release-artifacts.ts

		⋯159 linesShow the 159 lines above this hunk@@ -160,8 +160,10 @@ function scanNative(binaryRoot: string, platform: 'macos' | 'linux', output: str
160	160	}
161	161
162	162	if (import.meta.main) {
163		- const [mode, input, output] = Bun.argv.slice(2)
164		- if (!mode || !input || !output) throw new Error('Usage: scan-release-artifacts.ts <npm|macos|linux> <input> <output>')
	163	+ const args = Bun.argv.slice(2)
	164	+ if (args.length !== 3 || args.some(arg => !arg))
	165	+ throw new Error('Usage: scan-release-artifacts.ts <npm|macos|linux> <input> <output>')
	166	+ const [mode, input, output] = args as [string, string, string]
165	167	const syft = process.env.CRAFT_SYFT ?? 'syft'
166	168	const grype = process.env.CRAFT_GRYPE ?? 'grype'
167	169	if (mode === 'npm') scanNpm(resolve(input), resolve(output), syft, grype)