release: prepare Sandwich Hime v1 beta
Publish the sanitized Beta 1 source candidate with version-stable generated provenance, classroom/evaluation support boundaries, provisional macOS support, signed-source release policy, and an exact candidate preflight. Material implementation, drafting, and review were assisted by OpenAI Codex. Cole Speelman reviewed the public snapshot and accepts human responsibility for the contribution. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
This commit is contained in:
+107
-14
@@ -15,8 +15,9 @@ artifacts in the repository, pushes, or deploys.
|
||||
|
||||
--version Candidate compiler version. The corresponding runtime tag is
|
||||
sando/vX.Y.Z.
|
||||
--public Additionally require the human-reviewed launch evidence bundle
|
||||
named by HIMESAN_RELEASE_EVIDENCE_DIR.
|
||||
--public Require the human-reviewed RC/final launch evidence bundle named
|
||||
by HIMESAN_RELEASE_EVIDENCE_DIR. Canonical beta prereleases may
|
||||
run their narrower publication preflight without this flag.
|
||||
EOF
|
||||
}
|
||||
|
||||
@@ -45,8 +46,31 @@ while (( $# > 0 )); do
|
||||
esac
|
||||
done
|
||||
|
||||
if [[ ! "$version" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z]+([.-][0-9A-Za-z]+)*)?(\+[0-9A-Za-z]+([.-][0-9A-Za-z]+)*)?$ ]]; then
|
||||
printf 'error: --version must be a semantic version beginning with v\n' >&2
|
||||
if [[ ! "$version" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-([0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*))?$ ]]; then
|
||||
printf 'error: --version must be a canonical semantic version beginning with v (build metadata is not allowed)\n' >&2
|
||||
exit 2
|
||||
fi
|
||||
prerelease=${BASH_REMATCH[5]:-}
|
||||
if [[ "$prerelease" =~ (^|[.-])(0\.)?[0-9]{14}-[0-9a-f]{12,}$ ]]; then
|
||||
printf 'error: --version must be a signed release tag, not a Go pseudo-version\n' >&2
|
||||
exit 2
|
||||
fi
|
||||
if [[ -n "$prerelease" ]]; then
|
||||
IFS=. read -r -a prerelease_identifiers <<<"$prerelease"
|
||||
for identifier in "${prerelease_identifiers[@]}"; do
|
||||
if [[ "$identifier" =~ ^[0-9]+$ && "$identifier" =~ ^0[0-9]+$ ]]; then
|
||||
printf 'error: numeric prerelease identifiers must not contain leading zeroes: %s\n' "$identifier" >&2
|
||||
exit 2
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
beta_release=0
|
||||
if [[ "$prerelease" == beta || "$prerelease" == beta.* ]]; then
|
||||
beta_release=1
|
||||
fi
|
||||
if (( public_release == 0 && beta_release == 0 )); then
|
||||
printf 'error: RC and final release preflights require --public and the human-reviewed evidence bundle\n' >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
@@ -90,6 +114,73 @@ for tag in "$version" "$runtime_tag"; do
|
||||
fi
|
||||
done
|
||||
|
||||
artifact_dir=$(mktemp -d "${TMPDIR:-/tmp}/himesan-release-check.XXXXXXXX")
|
||||
cleanup() {
|
||||
if [[ -n "${artifact_dir:-}" && -d "$artifact_dir" ]]; then
|
||||
rm -rf -- "$artifact_dir"
|
||||
fi
|
||||
}
|
||||
trap cleanup EXIT HUP INT TERM
|
||||
|
||||
compiler_linker_flags="-X gamertan.com/sandwich-hime/internal/version.Compiler=$version"
|
||||
candidate_binary="$artifact_dir/himesan-candidate"
|
||||
|
||||
printf '\n==> exact release candidate identity\n'
|
||||
go build -trimpath -ldflags "$compiler_linker_flags" -o "$candidate_binary" ./cmd/himesan
|
||||
candidate_go_version=$(go env GOVERSION)
|
||||
expected_human_version="himesan $version (runtime ABI sando.v1, $candidate_go_version)"
|
||||
actual_human_version=$("$candidate_binary" version)
|
||||
if [[ "$actual_human_version" != "$expected_human_version" ]]; then
|
||||
printf 'error: candidate human version mismatch\nexpected: %s\nactual: %s\n' \
|
||||
"$expected_human_version" "$actual_human_version" >&2
|
||||
exit 1
|
||||
fi
|
||||
expected_json_version=$(printf '{"compiler":"%s","runtime_abi":"sando.v1","go":"%s"}' "$version" "$candidate_go_version")
|
||||
actual_json_version=$("$candidate_binary" version --json)
|
||||
if [[ "$actual_json_version" != "$expected_json_version" ]]; then
|
||||
printf 'error: candidate JSON version mismatch\nexpected: %s\nactual: %s\n' \
|
||||
"$expected_json_version" "$actual_json_version" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
file_mtime() {
|
||||
if stat --printf='%y' "$1" >/dev/null 2>&1; then
|
||||
stat --printf='%y' "$1"
|
||||
else
|
||||
stat -f '%m' "$1"
|
||||
fi
|
||||
}
|
||||
|
||||
printf '\n==> candidate generated-output provenance compatibility\n'
|
||||
golden_source=internal/compiler/testdata/golden/basic.sando
|
||||
golden_output="$golden_source.go"
|
||||
if ! grep -Fqx '// himesan:compiler 0.1.0-dev' "$golden_output"; then
|
||||
printf 'error: golden fixture no longer provides development-to-release provenance coverage: %s\n' "$golden_output" >&2
|
||||
exit 1
|
||||
fi
|
||||
golden_hash_before=$(git hash-object "$golden_output")
|
||||
golden_mtime_before=$(file_mtime "$golden_output")
|
||||
check_summary=$("$candidate_binary" check "$golden_source")
|
||||
if [[ "$check_summary" != 'checked 1 .sando files: 1 current' ]]; then
|
||||
printf 'error: candidate did not consider the development-produced golden current: %s\n' "$check_summary" >&2
|
||||
exit 1
|
||||
fi
|
||||
for pass in 1 2; do
|
||||
generate_summary=$("$candidate_binary" generate "$golden_source")
|
||||
if [[ "$generate_summary" != 'generated 0, unchanged 1 (1 .sando files)' ]]; then
|
||||
printf 'error: candidate generation pass %d reported unexpected changes: %s\n' "$pass" "$generate_summary" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [[ "$(git hash-object "$golden_output")" != "$golden_hash_before" ]]; then
|
||||
printf 'error: candidate generation pass %d changed golden bytes\n' "$pass" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [[ "$(file_mtime "$golden_output")" != "$golden_mtime_before" ]]; then
|
||||
printf 'error: candidate generation pass %d changed the golden mtime\n' "$pass" >&2
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
./scripts/check-licenses.sh
|
||||
HIMESAN_RACE=1 ./scripts/verify.sh
|
||||
|
||||
@@ -104,14 +195,6 @@ go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...
|
||||
go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...
|
||||
)
|
||||
|
||||
artifact_dir=$(mktemp -d "${TMPDIR:-/tmp}/himesan-release-check.XXXXXXXX")
|
||||
cleanup() {
|
||||
if [[ -n "${artifact_dir:-}" && -d "$artifact_dir" ]]; then
|
||||
rm -rf -- "$artifact_dir"
|
||||
fi
|
||||
}
|
||||
trap cleanup EXIT HUP INT TERM
|
||||
|
||||
printf '\n==> cross-compiling release binary smoke set\n'
|
||||
for target in \
|
||||
linux/amd64 \
|
||||
@@ -127,7 +210,8 @@ for target in \
|
||||
extension='.exe'
|
||||
fi
|
||||
CGO_ENABLED=0 GOOS="$target_os" GOARCH="$target_arch" \
|
||||
go build -trimpath -o "$artifact_dir/himesan-$target_os-$target_arch$extension" ./cmd/himesan
|
||||
go build -trimpath -ldflags "$compiler_linker_flags" \
|
||||
-o "$artifact_dir/himesan-$target_os-$target_arch$extension" ./cmd/himesan
|
||||
done
|
||||
|
||||
for required in \
|
||||
@@ -158,9 +242,18 @@ if (( public_release == 1 )); then
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ -n "$(git status --porcelain=v1 --untracked-files=all)" ]]; then
|
||||
printf 'error: release preflight left tracked changes or untracked artifacts in the canonical checkout\n' >&2
|
||||
git status --short >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if (( public_release == 1 )); then
|
||||
printf '\nHuman review is still required; evidence presence is not automatic approval.\n'
|
||||
else
|
||||
printf '\nTechnical preflight passed. Public launch remains blocked until --public evidence review passes.\n'
|
||||
printf '\nBeta technical publication preflight passed. This does not establish RC/final launch evidence or production stability.\n'
|
||||
fi
|
||||
|
||||
printf 'No tag, push, publication, or deployment was performed for %s / %s.\n' "$version" "$runtime_tag"
|
||||
|
||||
Reference in New Issue
Block a user