Files
玉澜 f37bb1cee6 fix(release): validate every universal slice in the Darwin SG_READ_ONLY gate
Review on #1446 flagged that the publication gate parsed only the first
__DATA_CONST flags word of an otool -l capture, so a universal library
with a healthy first slice and a broken later slice would still ship.
Replace the inline one-shot awk with scripts/release/extract-data-const-
flags.awk, a state machine that emits one flags word per __DATA_CONST
segment in every slice (segname is only honored directly after cmdsize,
so section entries can never contribute), and fail closed if any entry
lacks SG_READ_ONLY.

Add a regression test driven by real otool captures: broken/healthy
v1.0.62 thin binaries, the vendored universal runtime dylib, and a
universal sample whose last slice is broken — the exact case the old
parser wrongly passed. Also remove MACOSX_DEPLOYMENT_TARGET from the
--exec ambient pass-through so the container always receives the single
unconditional 11.0 pin from compiler_env.
2026-09-23 16:49:05 +08:00
..
2026-03-27 17:55:57 +08:00

Go Bootstrap Scripts

These repo-local entrypoints are the supported shell entrypoints for building, testing, packaging, and policy checks.

  • make build: build the dws CLI from cmd
  • make test: run every default package returned by go list ./...
  • make test-plan: verify every default Go package belongs to exactly one CI test shard
  • make lint: run the repository-wide format check, go vet, and required staticcheck
  • make format-check: check every tracked or non-ignored untracked repository Go source file with gofmt
  • make fmt: format every tracked or non-ignored untracked repository Go source file
  • make policy: reuse the current dws binary and run the complete policy suite (make build first)
  • make package: build all six CGO-enabled release artifacts with Docker and the pinned cross toolchain
  • make release-pre VERSION=vX.Y.Z-beta.N: validate a prerelease (PUBLISH=1 pushes its tag)
  • make release-stable VERSION=vX.Y.Z FROM_BETA=vX.Y.Z-beta.N: validate a stable promotion (PUBLISH=1 pushes its tag)

Script groups:

  • Root installers: ./scripts/install.sh, ./scripts/install.ps1, ./scripts/install-skills.sh
  • Product convenience installers: ./scripts/install-devapp.sh, ./scripts/install-devapp.ps1, ./scripts/install-event.sh
  • CI package and coverage plan: ./scripts/ci/test-packages.sh, ./scripts/ci/run-coverage-shard.sh, ./scripts/ci/run-full-coverage.sh, ./scripts/ci/merge-coverage-profiles.sh
  • Dev helpers: ./scripts/dev/build.sh, ./scripts/dev/lint.sh, ./scripts/dev/ci-local.sh, ./scripts/dev/run-mock-e2e.sh, ./scripts/dev/coverage.sh
  • Policy checks: ./scripts/policy/check-generated-drift.sh, ./scripts/policy/check-command-surface.sh, ./scripts/policy/check-command-compatibility.sh --base-ref <main-ref> --stable-ref <latest-GA-tag> --candidate-ref <candidate-sha>, ./scripts/policy/check-schema-catalog.sh, ./scripts/policy/check-schema-binary.sh, ./scripts/policy/check-open-source-assets.sh
  • Policy runtime files: set DWS_POLICY_TMPDIR to override the default .worktrees/policy-tmp workspace
  • Release entrypoint and contract: ./scripts/release/release.sh, ./scripts/release/release-contract.sh; operator guide: docs/releasing.md
  • Release packaging helpers: ./scripts/release/run-goreleaser-cross.sh, ./scripts/release/post-goreleaser.sh, ./scripts/release/stage-npm-package.sh, ./scripts/release/pack-npm-package.sh, ./scripts/release/verify-delivered-stable.sh, ./scripts/release/verify-release-artifacts.sh, ./scripts/release/verify-github-release-assets.sh, ./scripts/release/verify-github-tag-authority.sh, ./scripts/release/verify-package-managers.sh, ./scripts/release/publish-homebrew-formula.sh