fix: harden release gate and page delivery

2026-07-26 14:32:01 +08:00
parent d3141a3e91
commit b1577a16e9
61 changed files with 6017 additions and 89 deletions
@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+
+import { assertPortalRuntimePath, hashArtifact } from '../release-gate/artifact.mjs';
+
+const root = path.resolve(new URL('..', import.meta.url).pathname);
+const runtime = assertPortalRuntimePath(path.join(root, '.runtime', 'portal'), { repoRoot: root });
+
+async function buildRuntime() {
+  const code = await new Promise((resolve, reject) => {
+    const child = spawn('npm', ['run', 'build:portal-runtime'], {
+      cwd: root,
+      env: process.env,
+      stdio: 'inherit',
+    });
+    child.once('error', reject);
+    child.once('close', (status) => resolve(status ?? 1));
+  });
+  if (code !== 0) throw new Error(`runtime rebuild failed with code ${code}`);
+}
+
+const candidate = await hashArtifact(runtime);
+await buildRuntime();
+const firstRebuild = await hashArtifact(runtime);
+await buildRuntime();
+const secondRebuild = await hashArtifact(runtime);
+
+const hashes = [candidate.sha256, firstRebuild.sha256, secondRebuild.sha256];
+if (new Set(hashes).size !== 1) {
+  throw new Error(`runtime is not reproducible: ${hashes.join(' != ')}`);
+}
+console.log(`PASS REL-03 reproducible runtime sha256=${candidate.sha256}`);