Archon/scripts/checksums.sh
Rasmus Widing 68e7db0466
feat: Phase 5 - CLI binary distribution (#325)
* docs: Add Phase 5 CLI binary distribution plan

- Create detailed implementation plan for binary distribution
- Add Phase 5.0: Bundle defaults for binary (depends on #322)
- Add Phase 5.1-5.7: Build scripts, GitHub Actions, curl install,
  Homebrew formula, Windows docs, version command, release guide
- Update research doc with Phase 6 (auto-update command)
- Renumber dashboard to Phase 7, workflow builder to Phase 8
- Mark Phases 1-4 as complete in research doc

* feat: Phase 5 - CLI binary distribution

Implement standalone binary distribution for Archon CLI:

- Bundle default commands and workflows into binaries at compile time
- Add build scripts for cross-platform compilation (macOS/Linux, ARM64/x64)
- Create GitHub Actions release workflow triggered on version tags
- Add curl install script with checksum verification
- Create Homebrew formula for macOS/Linux installation
- Update version command to show platform, build type, and database info
- Add developer release guide documentation
- Update README with CLI installation instructions

Binary compilation uses Bun's --compile flag to create standalone
executables that include the Bun runtime and all dependencies.
Default workflows and commands are imported as text at compile time
and embedded directly into the binary.

* fix: Pin Dockerfile to Bun 1.3.4 to match lockfile version

The Docker build was failing because oven/bun:1-slim resolved to 1.3.6
while the lockfile was created with 1.3.4, causing --frozen-lockfile to fail.

* docs: Clarify binary vs source builds for default commands/workflows

* fix: Address PR review issues for CLI binary distribution

Security fixes:
- install.sh: Require SKIP_CHECKSUM=true to bypass checksum verification
  instead of silently skipping (addresses security vulnerability)
- install.sh: Show actual error output when version check fails instead
  of falsely reporting success

Validation improvements:
- checksums.sh: Validate all 4 expected binaries exist before generating
  checksums to prevent releasing incomplete builds
- build-binaries.sh: Verify binary exists and has reasonable size (>1MB)
  after each build step
- update-homebrew.sh: Validate extracted checksums are non-empty and
  look like valid SHA256 hashes (64 hex chars)
- update-homebrew.sh: Fix sed patterns to use URL context for updating
  checksums on subsequent runs

Bug fixes:
- homebrew/archon.rb: Fix test to expect exit code 0 (success) instead
  of 1 for `archon version`
- loader.ts: Log error when bundled workflow fails to parse (indicates
  build-time corruption)

Test coverage:
- Add bundled-defaults.test.ts for isBinaryBuild() and content validation
- Add connection.test.ts for getDatabaseType() function
- Add binary build bundled workflow tests to loader.test.ts
- Add binary build bundled command tests to executor.test.ts

All 959 tests pass.
2026-01-21 23:51:51 +02:00

48 lines
1 KiB
Bash
Executable file

#!/usr/bin/env bash
# scripts/checksums.sh
# Generate SHA256 checksums for release binaries
set -euo pipefail
DIST_DIR="${1:-dist/binaries}"
CHECKSUM_FILE="$DIST_DIR/checksums.txt"
# Expected binaries
EXPECTED_BINARIES=(
"archon-darwin-arm64"
"archon-darwin-x64"
"archon-linux-arm64"
"archon-linux-x64"
)
echo "Generating checksums for binaries in $DIST_DIR"
cd "$DIST_DIR"
# Verify at least one binary exists
if ! ls archon-* 1>/dev/null 2>&1; then
echo "ERROR: No archon-* binaries found in $DIST_DIR"
echo "Expected files: ${EXPECTED_BINARIES[*]}"
exit 1
fi
# Verify all expected binaries exist
missing=()
for binary in "${EXPECTED_BINARIES[@]}"; do
if [ ! -f "$binary" ]; then
missing+=("$binary")
fi
done
if [ ${#missing[@]} -gt 0 ]; then
echo "ERROR: Missing expected binaries: ${missing[*]}"
echo "Found binaries:"
ls -la archon-* 2>/dev/null || echo " (none)"
exit 1
fi
# Generate checksums
shasum -a 256 archon-* > checksums.txt
echo "Checksums written to $CHECKSUM_FILE:"
cat checksums.txt