Public release release-e47f9c27bbeb

Source commit: e47f9c27bbebe6759f6b6fe7b12fd00bb20d116d

Public tree identity: sha256:4c1af1dfd67d3f2b5088531ea8727b11124b013d2251a4d5088f51a6424c0196

scripts/prepare-manual-github-release.js

@@ -51,7 +51,7 @@ function copyVerifiedAsset(asset, destinationRoot) {
   return destination;
 }
 
-function extractBinaries(archive, destinationRoot) {
+function extractBinaries(archive, destinationRoot, expectedDigests) {
   const staging = path.join(destinationRoot, ".binary-extract");
   fs.mkdirSync(staging, { recursive: true });
   const extracted = spawnSync("tar", ["-xzf", archive, "-C", staging], {
@@ -69,6 +69,11 @@ function extractBinaries(archive, destinationRoot) {
     const destination = path.join(destinationRoot, "binaries", name);
     fs.copyFileSync(source, destination);
     fs.chmodSync(destination, 0o755);
+    assert.strictEqual(
+      `sha256:${sha256(destination)}`,
+      expectedDigests[name],
+      `tested binary digest changed: ${name}`
+    );
     copied.push(destination);
   }
   fs.rmSync(staging, { recursive: true, force: true });
@@ -87,11 +92,21 @@ function main() {
   assert.strictEqual(result.source_tree_digest, manifest.source_tree_digest);
   assert.deepStrictEqual(result.binary_digests, manifest.binary_digests);
   assert.strictEqual(result.scenario_skips.length, 0);
-  assert.strictEqual(result.strict_requirement_ledger.length, 25);
+  assert(result.strict_requirement_ledger.length >= 29);
   assert(
-    result.strict_requirement_ledger.every((requirement) => requirement.passed === true),
+    result.strict_requirement_ledger.every(
+      (requirement) =>
+        requirement.passed === true &&
+        Number.isFinite(requirement.duration_ms) &&
+        requirement.duration_ms > 0 &&
+        requirement.evidence
+    ),
     "final validation contains a failed launch requirement"
   );
+  assert.strictEqual(
+    result.named_scenarios.length,
+    result.strict_requirement_ledger.length
+  );
 
   const destinationRoot = path.resolve(
     process.env.CLUSTERFLUX_GITHUB_RELEASE_DIR ||
@@ -104,11 +119,26 @@ function main() {
   const copiedAssets = manifest.assets.map((asset) =>
     copyVerifiedAsset(asset, destinationRoot)
   );
+  const publicationGuidance = [
+    JSON.stringify(manifest.notes || []),
+    ...copiedAssets
+      .filter((file) => file.endsWith(".md"))
+      .map((file) => fs.readFileSync(file, "utf8")),
+  ].join("\n");
+  assert.doesNotMatch(
+    publicationGuidance,
+    /(?:download|upload|release downloads?)[^\n]*Forgejo/i,
+    "manual GitHub package contains Forgejo release-publication instructions"
+  );
   const binaryArchive = copiedAssets.find((file) =>
     path.basename(file).startsWith("clusterflux-public-binaries-")
   );
   assert(binaryArchive, "final manifest omitted the public binary archive");
-  const binaries = extractBinaries(binaryArchive, destinationRoot);
+  const binaries = extractBinaries(
+    binaryArchive,
+    destinationRoot,
+    manifest.binary_digests
+  );
   const vsix = copiedAssets.find((file) => file.endsWith(".vsix"));
   assert(vsix, "final manifest omitted the tested VSIX");
   assert.strictEqual(
@@ -124,7 +154,6 @@ function main() {
   );
   write(path.join(destinationRoot, "VSIX_SHA256"), `${sha256(vsix)}  ${path.basename(vsix)}\n`);
   fs.copyFileSync(manifestPath, path.join(destinationRoot, "public-release-manifest.json"));
-  fs.copyFileSync(resultPath, path.join(destinationRoot, "final-result.json"));
   fs.copyFileSync(transcriptPath, path.join(destinationRoot, "VALIDATION_TRANSCRIPT.log"));
   write(
     path.join(destinationRoot, "RELEASE_NOTES.md"),
@@ -138,6 +167,31 @@ function main() {
       "- Full Windows sandbox validation is deferred.\n" +
       "- Providers, billing, teams, managed compute, and operator-panel UI are not part of this release.\n"
   );
+  const testedUploadAssets = [
+    ...copiedAssets,
+    ...binaries,
+  ]
+    .sort()
+    .map((file) => ({
+      file: path.relative(destinationRoot, file),
+      sha256: `sha256:${sha256(file)}`,
+    }));
+  write(
+    path.join(destinationRoot, "final-result.json"),
+    `${JSON.stringify(
+      {
+        ...result,
+        manual_release: {
+          source_revision: manifest.source_commit,
+          source_tree_digest: manifest.source_tree_digest,
+          tested_upload_assets: testedUploadAssets,
+          publication: "manual GitHub upload from this directory",
+        },
+      },
+      null,
+      2
+    )}\n`
+  );
 
   const checksummed = [
     ...copiedAssets,