feat: prepare maintained SDK source releases

.github/workflows/release.ymlmodified+61-19

Changes to .github/workflows/release.yml

		@@ -1,38 +1,80 @@
1		-name: Release
	1	+name: SDK source release
2	2
3	3	on:
4	4	push:
5		- branches:
6		- - main
	5	+ tags: ['sdk-v*']
7	6
8	7	permissions:
9	8	contents: read
10	9
11	10	jobs:
12	11	release:
13		- name: Release packages
	12	+ name: Qualify and publish maintained client archive
14	13	runs-on: ubuntu-latest
15	14	permissions:
16	15	contents: write
17		- pull-requests: write
18		- id-token: write
19	16	steps:
20		- - name: Checkout source
21		- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v3
	17	+ - name: Checkout exact release source
	18	+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
	19	+ with:
	20	+ fetch-depth: 0
22	21
23		- - name: Setup node
24		- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v3
	22	+ - name: Setup Node
	23	+ uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
25	24	with:
26		- node-version: 24.x
27		- registry-url: 'https://registry.npmjs.org'
	25	+ node-version: 22
28	26	cache: npm
29	27
30		- - name: Install dependencies
31		- run: npm ci
	28	+ - name: Install frozen dependencies
	29	+ run: npm ci --ignore-scripts
32	30
33		- - name: Create Release Pull Request
34		- uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1.8.0
35		- with:
36		- publish: npm run release
	31	+ - name: Build and pack maintained client
	32	+ run: npm run release
	33	+
	34	+ - name: Test exact source
	35	+ run: npm run test:ci
	36	+
	37	+ - name: Lint source
	38	+ run: npm run lint:check
	39	+
	40	+ - name: Check formatting
	41	+ run: npm run prettier:check
	42	+
	43	+ - name: Verify release identity and record archive integrity
	44	+ env:
	45	+ RELEASE_TAG: ${{ github.ref_name }}
	46	+ run: |
	47	+ node --input-type=module <<'NODE'
	48	+ import assert from 'node:assert/strict';
	49	+ import { createHash } from 'node:crypto';
	50	+ import { readFileSync, writeFileSync, readdirSync } from 'node:fs';
	51	+ import { execFileSync } from 'node:child_process';
	52	+ const pkg = JSON.parse(readFileSync('packages/client/package.json', 'utf8'));
	53	+ assert.equal(pkg.name, '@stacksjs/tuf-js');
	54	+ assert.equal(process.env.RELEASE_TAG, `sdk-v${pkg.version}`);
	55	+ execFileSync('git', ['diff', '--exit-code']);
	56	+ execFileSync('git', ['diff', '--cached', '--exit-code']);
	57	+ const commit = execFileSync('git', ['rev-parse', 'HEAD'], { encoding: 'utf8' }).trim();
	58	+ execFileSync('git', ['merge-base', '--is-ancestor', commit, 'origin/main']);
	59	+ const archive = `stacksjs-tuf-js-${pkg.version}.tgz`;
	60	+ assert.deepEqual(readdirSync('.release').filter(name => name.endsWith('.tgz')), [archive]);
	61	+ const bytes = readFileSync(`.release/${archive}`);
	62	+ const sha512 = createHash('sha512').update(bytes).digest('hex');
	63	+ const sha256 = createHash('sha256').update(bytes).digest('hex');
	64	+ writeFileSync('.release/SHA512SUMS', `${sha512} ${archive}\n`);
	65	+ writeFileSync('.release/source.json', JSON.stringify({
	66	+ package: pkg.name, version: pkg.version,
	67	+ repository: 'https://github.com/stacksjs/tuf-js',
	68	+ commit, tag: process.env.RELEASE_TAG, archive, sha512, sha256,
	69	+ distribution: 'GitHub release archive; not an upstream npm publication',
	70	+ }, null, 2) + '\n');
	71	+ writeFileSync('.release/notes.md', `Maintained source client ${pkg.name}@${pkg.version}.\n\nSource commit: ${commit}.\n\nThe archive includes the upstream MIT license. Verify SHA512SUMS and retain the frozen application lockfile. This is a maintained fork, not an upstream npm release.\n`);
	72	+ NODE
	73	+
	74	+ - name: Publish source release assets
37	75	env:
38		- GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	76	+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	77	+ RELEASE_TAG: ${{ github.ref_name }}
	78	+ run: |
	79	+ gh release create "$RELEASE_TAG" .release/*.tgz .release/SHA512SUMS .release/source.json \
	80	+ --verify-tag --title "@stacksjs/tuf-js $RELEASE_TAG" --notes-file .release/notes.md