Prepare Sandwich Hime v1 release candidate source

2026-08-23 16:25:02 -04:00
parent c11552b87a
commit efd5b997ed
64 changed files with 5276 additions and 156 deletions
@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: AGPL-3.0-only
+
+set -euo pipefail
+
+repo_root=$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
+cd "$repo_root"
+
+usage() {
+	printf 'Usage: scripts/native-gate.sh --repository OWNER/REPOSITORY --go-version goX.Y.Z --runner-version VERSION --runner-name NAME --output DIR\n' >&2
+}
+
+repository=''
+expected_go=''
+runner_version=''
+runner_name=''
+output=''
+while (( $# > 0 )); do
+	case "$1" in
+	--repository) repository=$2; shift 2 ;;
+	--go-version) expected_go=$2; shift 2 ;;
+	--runner-version) runner_version=$2; shift 2 ;;
+	--runner-name) runner_name=$2; shift 2 ;;
+	--output) output=$2; shift 2 ;;
+	*) usage; exit 2 ;;
+	esac
+done
+if [[ ! "$repository" =~ ^[a-z0-9][a-z0-9._-]*/[a-z0-9][a-z0-9._-]*$ || -z "$expected_go" || -z "$runner_version" || -z "$runner_name" || -z "$output" ]]; then
+	usage
+	exit 2
+fi
+if [[ "$(go env GOVERSION)" != "$expected_go" ]]; then
+	printf 'error: expected %s, found %s\n' "$expected_go" "$(go env GOVERSION)" >&2
+	exit 1
+fi
+
+mkdir -p -- "$output"
+./scripts/check-licenses.sh
+./scripts/test-public-snapshot.sh
+HIMESAN_RACE=1 ./scripts/verify.sh
+go test ./internal/compiler -run '^$' -fuzz '^FuzzCompileNeverPanics$' -fuzztime=15s
+go test ./internal/compiler -run '^$' -fuzz '^FuzzGoDelimiterNeverPanics$' -fuzztime=15s
+go test ./internal/lsp -run '^$' -fuzz '^FuzzFrameReaderNeverPanics$' -fuzztime=15s
+go test ./internal/lsp -run '^$' -fuzz '^FuzzDocumentPositionNeverPanics$' -fuzztime=15s
+(
+	cd sando
+	go test -run '^$' -fuzz '^FuzzWriteURLPolicy$' -fuzztime=15s
+)
+go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...
+(
+	cd sando
+	go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...
+)
+./scripts/verify-consumer.sh
+
+./scripts/package-native.sh --version v0.0.0-verification.1 --output "$output"
+artifact=$(find "$output" -maxdepth 1 -type f -name '*.tar.gz' -print -quit)
+artifact_sha=$(awk '{print $1}' "$artifact.sha256")
+completed_at=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
+go run ./cmd/himesan-release receipt \
+	--output "$output/TEND-CI-VERIFICATION.json" \
+	--repository "$repository" \
+	--commit "$(git rev-parse HEAD)" \
+	--tree "$(git rev-parse 'HEAD^{tree}')" \
+	--goos "$(go env GOOS)" --goarch "$(go env GOARCH)" \
+	--go-version "$expected_go" --runner-version "$runner_version" \
+	--runner-name "$runner_name" --artifact-sha256 "$artifact_sha" \
+	--completed-at "$completed_at" \
+	--gates test,vet,build,race,generation,contracts,public-snapshot,fuzz,vulnerability,consumer,package \
+	--generated-files internal/compiler/testdata/golden/basic.sando.go
+printf 'Native verification evidence: %s\n' "$output"