Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.
| Merge main into rm-agents: mirroring removal, open signups, free-tier limits, the g1t CLI and runner fixes, with the agent removal kept. The CLI's table of operations is regenerated from the API without the agent, customize and AI credit operations; no CLI command used them. | 1 | // node --test scripts/cli-release.test.mjs |
| 2 | import assert from "node:assert/strict"; | |
| 3 | import { createPrivateKey } from "node:crypto"; | |
| 4 | import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs"; | |
| 5 | import { tmpdir } from "node:os"; | |
| 6 | import { join } from "node:path"; | |
| 7 | import { test } from "node:test"; | |
| 8 | ||
| Release tags' runs no longer save to the cache what only their own tag could read, and the CLI's release builds in a pinned image from a cache kept on main. scripts/sccache.sh sets SCCACHE_GHA_RW_MODE=READ_ONLY when GITHUB_REF_TYPE is tag, for the server and the steps after it: against a stand-in for the cache service, sccache 0.18.0 on a branch's run made a CreateCacheEntry call and on a tag's run made none, and looked its compile up in both. The CLI's release ran in ghcr.io/rust-cross/cargo-zigbuild:latest; it now runs in that image pinned by digest (sha256:d8313491ec57…, Rust 1.93.0, zig 0.16.0), reads the crates entry CI saves from the job's ~/.cargo/registry instead of an empty Docker volume, hands what it wrote as root back to the job's user, and restores target/zig from cli-release-<os>-<image digest>-<deps>, which the Caches workflow builds whole when the key is new (ci-cache.mjs keys gives the digest as zigbuild). Built in that image on an 8-core machine, the five platforms took 162 s from nothing and 103 s from the cache, with only the g1t crate compiled again for each; the entry is 1.3 GB, 463 MB compressed. Tests hold the tag rule in sccache.sh, the CLI's entry to the image's digest and to being built whole, and the builder's flags; CONTRIBUTING.md and the Actions guide say both. | 9 | import { BUILDER, TARGETS, builderArgs, builderScript, manifest, sha256, version } from "./cli-release.mjs"; |
| Merge main into rm-agents: mirroring removal, open signups, free-tier limits, the g1t CLI and runner fixes, with the agent removal kept. The CLI's table of operations is regenerated from the API without the agent, customize and AI credit operations; no CLI command used them. | 10 | import { keygen, signBytes, verifyBytes } from "./runner-release.mjs"; |
| 11 | ||
| Release tags' runs no longer save to the cache what only their own tag could read, and the CLI's release builds in a pinned image from a cache kept on main. scripts/sccache.sh sets SCCACHE_GHA_RW_MODE=READ_ONLY when GITHUB_REF_TYPE is tag, for the server and the steps after it: against a stand-in for the cache service, sccache 0.18.0 on a branch's run made a CreateCacheEntry call and on a tag's run made none, and looked its compile up in both. The CLI's release ran in ghcr.io/rust-cross/cargo-zigbuild:latest; it now runs in that image pinned by digest (sha256:d8313491ec57…, Rust 1.93.0, zig 0.16.0), reads the crates entry CI saves from the job's ~/.cargo/registry instead of an empty Docker volume, hands what it wrote as root back to the job's user, and restores target/zig from cli-release-<os>-<image digest>-<deps>, which the Caches workflow builds whole when the key is new (ci-cache.mjs keys gives the digest as zigbuild). Built in that image on an 8-core machine, the five platforms took 162 s from nothing and 103 s from the cache, with only the g1t crate compiled again for each; the entry is 1.3 GB, 463 MB compressed. Tests hold the tag rule in sccache.sh, the CLI's entry to the image's digest and to being built whole, and the builder's flags; CONTRIBUTING.md and the Actions guide say both. | 12 | test("a workflow's build uses the job's Cargo registry, which the crates cache restores", () => { |
| 13 | const job = builderArgs({ root: "/home/runner/work/repo", env: { GITHUB_ACTIONS: "true" }, home: "/home/node" }); | |
| 14 | assert.ok(job.includes("/home/node/.cargo/registry:/usr/local/cargo/registry"), job.join(" ")); | |
| 15 | assert.ok(job.includes("/home/runner/work/repo:/src")); | |
| 16 | assert.equal(job.at(-1), BUILDER); | |
| 17 | // Elsewhere a Docker volume keeps it. | |
| 18 | assert.ok(builderArgs({ root: "/x", env: {}, home: "/h" }).includes("g1t-cargo-registry:/usr/local/cargo/registry")); | |
| 19 | // What the container wrote as root goes back to the user, even when the build fails. | |
| 20 | const script = builderScript("x86_64-unknown-linux-musl", "1000:1000"); | |
| 21 | assert.match(script, /^trap 'chown -R 1000:1000 \/src\/target\/zig \/usr\/local\/cargo\/registry' EXIT; set -e;/); | |
| 22 | assert.ok(!builderScript("t", null).includes("chown")); | |
| 23 | }); | |
| 24 | ||
| Merge main into rm-agents: mirroring removal, open signups, free-tier limits, the g1t CLI and runner fixes, with the agent removal kept. The CLI's table of operations is regenerated from the API without the agent, customize and AI credit operations; no CLI command used them. | 25 | test("the version is crates/g1t's", () => { |
| 26 | assert.match(version(), /^\d+\.\d+\.\d+/); | |
| 27 | }); | |
| 28 | ||
| 29 | test("the manifest and SHA256SUMS name each binary that was built", () => { | |
| 30 | const dir = mkdtempSync(join(tmpdir(), "cli-release-")); | |
| 31 | try { | |
| 32 | writeFileSync(join(dir, TARGETS["linux-x64"].file), "linux"); | |
| 33 | writeFileSync(join(dir, TARGETS["windows-x64"].file), "windows"); | |
| 34 | const m = manifest(dir, "0.2.0", new Date("2026-10-12T00:00:00Z")); | |
| 35 | assert.deepEqual(m, { | |
| 36 | version: "0.2.0", | |
| 37 | published_at: "2026-10-12T00:00:00.000Z", | |
| 38 | files: { | |
| 39 | "linux-x64": { name: "g1t-linux-x64", sha256: sha256("linux") }, | |
| 40 | "windows-x64": { name: "g1t-windows-x64.exe", sha256: sha256("windows") }, | |
| 41 | }, | |
| 42 | }); | |
| 43 | // The install scripts read `<sha256> <name>` lines. | |
| 44 | assert.equal( | |
| 45 | readFileSync(join(dir, "SHA256SUMS"), "utf8"), | |
| 46 | `${sha256("linux")} g1t-linux-x64\n${sha256("windows")} g1t-windows-x64.exe\n`, | |
| 47 | ); | |
| 48 | assert.equal(readFileSync(join(dir, "latest.json"), "utf8"), readFileSync(join(dir, "manifest.json"), "utf8")); | |
| 49 | const keys = keygen(); | |
| 50 | const key = createPrivateKey({ key: Buffer.from(keys.private, "base64"), format: "der", type: "pkcs8" }); | |
| 51 | const bytes = readFileSync(join(dir, "latest.json")); | |
| 52 | assert.ok(verifyBytes(bytes, signBytes(bytes, key), keys.public)); | |
| 53 | } finally { | |
| 54 | rmSync(dir, { recursive: true, force: true }); | |
| 55 | } | |
| 56 | }); | |
| 57 | ||
| 58 | test("a manifest of nothing is refused", () => { | |
| 59 | const dir = mkdtempSync(join(tmpdir(), "cli-release-")); | |
| 60 | try { | |
| 61 | assert.throws(() => manifest(dir, "0.2.0"), /no binaries/); | |
| 62 | } finally { | |
| 63 | rmSync(dir, { recursive: true, force: true }); | |
| 64 | } | |
| 65 | }); |
This file's history is long; its oldest lines are credited to the oldest commit read.