fix(release): validate cli prerelease artifacts and scripts

Author: jdalton

package.json

@@ -225,9 +225,9 @@
     "build:sea": "node scripts/repo/cli-build/sea/build.mts",
     "check:sea-package": "node scripts/repo/cli-build/sea/check.mts",
     "prepack": "pnpm run check:sea-package",
-    "test:sea": "node scripts/fleet/test.mts test/repo/unit/sea-package.test.mts",
+    "test:sea": "node scripts/fleet/test.mts test/repo/unit/sea test/repo/unit/rolldown.cli.test.mts",
     "bump": "node scripts/repo/bump.mts",
-    "prepublish:check": "node scripts/repo/check/publish-contract.mts",
+    "prepublish:check": "node scripts/repo/check/publish-contract-is-valid.mts",
     "build:publish": "pnpm run prepublish:check --reserved && pnpm run build:sea"
   },
   "devDependencies": {

scripts/repo/bump.mts

@@ -119,9 +119,12 @@ export async function main(): Promise<void> {
   writeFileSync(PACKAGE_JSON, replaceVersion(original, source.version))
 }
 
+const SCRIPT_META = {
+  describe: 'generates a source-bound Socket CLI prerelease',
+  help: 'Usage: pnpm run bump --dry-run | --write-only',
+  json: 'result' as const,
+}
+
 if (isMainModule(import.meta.url)) {
-  runMain(main, {
-    describe: 'generates a source-bound Socket CLI prerelease',
-    help: 'Usage: pnpm run bump --dry-run | --write-only',
-  })
+  runMain(main, SCRIPT_META)
 }

scripts/repo/check/publish-contract.mts …repo/check/publish-contract-is-valid.mtsscripts/repo/check/publish-contract.mts renamed to scripts/repo/check/publish-contract-is-valid.mts scripts/repo/check/publish-contract.mts renamed to scripts/repo/check/publish-contract-is-valid.mts

@@ -34,9 +34,12 @@ export async function main(): Promise<void> {
   }
 }
 
+const SCRIPT_META = {
+  describe: 'validates the Socket CLI npm release contract',
+  help: 'Usage: pnpm run prepublish:check [--reserved]',
+  json: 'result' as const,
+}
+
 if (isMainModule(import.meta.url)) {
-  runMain(main, {
-    describe: 'validates the Socket CLI npm release contract',
-    help: 'Usage: pnpm run prepublish:check [--reserved]',
-  })
+  runMain(main, SCRIPT_META)
 }

scripts/repo/cli-build/build.mts

@@ -11,7 +11,7 @@ import { getDefaultLogger } from '@socketsecurity/lib-stable/logger/default'
 import { spawn } from '@socketsecurity/lib-stable/process/spawn/child'
 import { getEnvValue } from '@socketsecurity/lib-stable/env/rewire'
 import { buildSdxgenBundle } from './sdxgen.mts'
-import { safeDelete } from '../../fleet/fs/safe.mts'
+import { safeDelete } from '@socketsecurity/lib-stable/fs/safe'
 import { isMainModule } from '../../fleet/process/is-main-module.mts'
 import { runMain } from '../../fleet/process/run-main.mts'
 

scripts/repo/cli-build/sea/assets.mts

@@ -2,7 +2,11 @@ import crypto from 'node:crypto'
 import { chmod, readFile, writeFile } from 'node:fs/promises'
 import path from 'node:path'
 import { httpRequest } from '@socketsecurity/lib-stable/http-request'
-import { BASE_ASSET_SHA256 } from '../constants/sea-assets.mts'
+import {
+  BASE_ASSET_SHA256,
+  BASE_ASSETS_MIRROR_OWNER,
+  BASE_ASSETS_MIRROR_REPO,
+} from '../constants/sea-assets.mts'
 import { SEA_BUILD_DIR } from './paths.mts'
 
 export function verifySeaAsset(bytes: Uint8Array, expected: string): boolean {
@@ -32,7 +36,7 @@ export async function fetchSeaAsset(
   }
   if (!bytes || !verifySeaAsset(bytes, expected)) {
     const response = await httpRequest(
-      `https://github.com/SocketDev/socket-cli/releases/download/base-assets-${tag}/${name}`,
+      `https://github.com/${BASE_ASSETS_MIRROR_OWNER}/${BASE_ASSETS_MIRROR_REPO}/releases/download/base-assets-${tag}/${name}`,
     )
     if (!response.ok) {
       throw new Error(

scripts/repo/cli-build/sea/build.mts

@@ -39,15 +39,13 @@ export async function main(): Promise<void> {
   await mkdir(SEA_OUTPUT_DIR, { recursive: true })
   const payload = await readFile(SEA_PAYLOAD_PATH, 'utf8')
   await writeFile(SEA_ENTRY_PATH, createSeaEntry(payload))
-  const host = resolveSeaTarget(
-    process.platform,
-    process.arch,
-    (
+  const host = resolveSeaTarget(process.platform, process.arch, {
+    glibc: (
       process.report.getReport() as {
         header: { glibcVersionRuntime?: string | undefined }
       }
     ).header.glibcVersionRuntime,
-  )
+  })
   const arg = process.argv
     .find(value => value.startsWith('--target='))
     ?.slice(9)
@@ -183,11 +181,13 @@ async function buildSeaTarget(
     .digest('hex')
 }
 
+const SCRIPT_META = {
+  describe: 'build the socket package SEA platform matrix',
+  heavyJob: 'build' as const,
+  help: 'Usage: pnpm run build:sea [--target=host|TARGET]',
+  json: 'native' as const,
+}
+
 if (isMainModule(import.meta.url)) {
-  runMain(main, {
-    describe: 'build the socket package SEA platform matrix',
-    help: 'Usage: pnpm run build:sea [--target=host|TARGET]',
-    json: 'native',
-    heavyJob: 'build',
-  })
+  runMain(main, SCRIPT_META)
 }

scripts/repo/cli-build/sea/check.mts

@@ -42,15 +42,13 @@ export async function main(): Promise<void> {
   }
   const targets = process.argv.includes('--host')
     ? [
-        resolveSeaTarget(
-          process.platform,
-          process.arch,
-          (
+        resolveSeaTarget(process.platform, process.arch, {
+          glibc: (
             process.report.getReport() as {
               header: { glibcVersionRuntime?: string | undefined }
             }
           ).header.glibcVersionRuntime,
-        ),
+        }),
       ]
     : SEA_TARGETS
   for (const target of targets) {
@@ -62,15 +60,13 @@ export async function main(): Promise<void> {
       )
     }
   }
-  const host = resolveSeaTarget(
-    process.platform,
-    process.arch,
-    (
+  const host = resolveSeaTarget(process.platform, process.arch, {
+    glibc: (
       process.report.getReport() as {
         header: { glibcVersionRuntime?: string | undefined }
       }
     ).header.glibcVersionRuntime,
-  )
+  })
   for (const args of [['--version'], ['--help'], ['npm', '--version']]) {
     const result = await spawn(seaBinaryPath(host), args, {
       stdio: 'pipe',
@@ -89,11 +85,13 @@ export async function main(): Promise<void> {
   }
 }
 
+const SCRIPT_META = {
+  describe: 'verify socket SEA artifact integrity and execution',
+  heavyJob: 'test' as const,
+  help: 'Usage: pnpm run check:sea-package [--host]',
+  json: 'native' as const,
+}
+
 if (isMainModule(import.meta.url)) {
-  runMain(main, {
-    describe: 'verify socket SEA artifact integrity and execution',
-    help: 'Usage: pnpm run check:sea-package [--host]',
-    json: 'native',
-    heavyJob: 'test',
-  })
+  runMain(main, SCRIPT_META)
 }

scripts/repo/cli-build/sea/paths.mts

@@ -1,6 +1,8 @@
 import path from 'node:path'
 import { PACKAGE_ROOT } from '../paths.mts'
 
+export * from '../paths.mts'
+
 export const SEA_OUTPUT_DIR = path.join(PACKAGE_ROOT, 'dist', 'sea')
 export const SEA_BUILD_DIR = path.join(PACKAGE_ROOT, 'build', 'sea')
 export const SEA_ENTRY_PATH = path.join(SEA_BUILD_DIR, 'entry.generated.cjs')

scripts/repo/cli-build/sea/targets.mts

@@ -1,19 +1,13 @@
-export const SEA_TARGETS = [
-  'darwin-arm64',
-  'darwin-x64',
-  'linux-arm64',
-  'linux-arm64-musl',
-  'linux-x64',
-  'linux-x64-musl',
-  'win32-arm64',
-  'win32-x64',
-] as const
+import { PACK_APP_TRIPLETS } from '../../../fleet/util/pack-app-triplets.mts'
+
+export const SEA_TARGETS = PACK_APP_TRIPLETS
 
 export function resolveSeaTarget(
   platform: string,
   arch: string,
-  glibc?: string | undefined,
+  options?: { glibc?: string | undefined } | undefined,
 ): string {
+  const { glibc } = { __proto__: null, ...options }
   const target = `${platform}-${arch}${platform === 'linux' && !glibc ? '-musl' : ''}`
   if (!(SEA_TARGETS as readonly string[]).includes(target)) {
     throw new Error(