ci(release): #260 S2 — per-platform compiler binaries + SHA256SUMS (ADR-019) - #284
Merged
Conversation
…DR-019) ADR-019 slice S2. `release.yml` was a single linux job emitting one tar.gz. Reworked into the Releases-canonical artifact contract: - `prepare`: idempotent `gh release create <tag> --generate-notes`. - `build` matrix → `affinescript-<target>` raw executables for linux-x64, macos-x64 (macos-13), macos-arm64 (macos-14); each `gh release upload --clobber`. - `checksums` (needs build): `gh release download` all binaries, `sha256sum … > SHA256SUMS`, upload it. One manifest over all targets — the supply-chain pin the #260 S3 shim embeds per version. Asset contract is now ADR-019-fixed: `affinescript-<target>` + `SHA256SUMS` (don't rename without amending ADR-019 + the shim). Asset handling uses the runner-native `gh` CLI (GITHUB_TOKEN) so no new third-party action needs SHA-pinning — only the already-pinned checkout (de0fac2) + setup-ocaml (e32b06) remain; the unpinned softprops/action-gh-release is dropped. `windows-x64` is a tracked follow-up (native OCaml Windows CI is flaky; S2 bounded to the three POSIX targets, fail-fast:false so one platform can't sink the rest). CI-workflow only — no compiler/source/test change (dune gate unaffected: 295/295 on the base). Triggers only on `v*` tags. Refs #260 #282. Not Closes — S3 (the shim) + S4 (wire INT-10) remain.
🔍 Hypatia Security ScanFindings: 47 issues detected
View findings[
{
"reason": "Stray AI.a2ml in root -- use 0-AI-MANIFEST.a2ml only",
"type": "banned",
"file": "AI.a2ml",
"action": "delete",
"rule_module": "root_hygiene",
"severity": "high"
},
{
"reason": "Superseded by 0-AI-MANIFEST.a2ml",
"type": "banned",
"file": "AI.djot",
"action": "delete",
"rule_module": "root_hygiene",
"severity": "high"
},
{
"reason": "Issue in quality.yml",
"type": "missing_workflow",
"file": "quality.yml",
"action": "create",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in security-policy.yml",
"type": "missing_workflow",
"file": "security-policy.yml",
"action": "create",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
"type": "unpinned_action",
"file": "governance.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Action actions/checkout@v4 needs attention",
"type": "unpinned_action",
"file": "publish-jsr.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action denoland/setup-deno@v2 needs attention",
"type": "unpinned_action",
"file": "publish-jsr.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/example/smoke_driver.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/cli.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ADR-019 slice S2.
release.ymlreworked from a single linux tar.gz into the Releases-canonical contract:prepare(idempotentgh release create) →buildmatrix emittingaffinescript-{linux-x64,macos-x64,macos-arm64}raw binaries →checksumsproducing oneSHA256SUMSover all targets. Asset names are the ADR-019 contract the #260 S3 shim verifies against. Uses runner-nativeghCLI (no new pinned-action burden; drops the unpinned softprops action).windows-x64= tracked follow-up (flaky native OCaml Windows CI;fail-fast:false). CI-workflow only; no code/test change (dune 295/295 on base); fires onv*tags only.\n\nRefs #260 #282. Not Closes — S3 (shim) + S4 (wire INT-10) remain.\n\n🤖 Generated with Claude Code