cf39fb6957
Two blockers from the parallel Opus review batch: 1. The Tauri CLI install in release-desktop.yml was the last unfrozen install path: `npm install --save-dev --prefix studio @tauri-apps/cli@2.10.1 --no-fund --no-audit` pins the top-level version but leaves the transitive closure floating, defeats the pre-install lockfile audit (no lockfile to scan), and skips integrity verification. Committed a minimal studio/package.json (devDep @tauri-apps/cli@2.10.1) plus the resolved studio/package-lock.json (12 packages: CLI + 11 platform-native binaries, all with integrity hashes, lockfileVersion 3). Switched the step to `npm ci --prefix studio` and added a pre-install lockfile_supply_chain_audit.py step ahead of it so any tarball postinstall is gated by the structural scan. Allowlisted studio/package-lock.json .gitignore and added it to the audit script's default scan set. 2. The bun branch was dead code in build.sh, studio/setup.sh, and studio/setup.ps1: nowhere in the repo is a bun.lock committed, and `bun install --frozen-lockfile` cannot migrate from package-lock.json. With no lockfile, every entry to the bun path either silently regenerates a bun.lock (under permissive install modes -- a fresh attack surface) or fails outright (under frozen-lockfile). Removed `npm install -g bun` bootstrap, the `_try_bun_install` helper + cache-retry, every `if bun.lock && command -v bun` guard, and the now-unreachable "fall back to npm" messaging. All three scripts now have a single `npm ci` path. bun.lock skip entries in lint-ci.yml + wheel-smoke.yml are kept as forward-compat sanity checks -- they assert bun.lock is NOT shipped / scanned, which is stronger after this commit, not weaker. Smoke-tested locally: `npm ci --prefix studio` resolves 3 packages (CLI + 2 linux native binaries), `npx --prefix studio tauri --version` prints `tauri-cli 2.10.1` exactly. `python3 scripts/lockfile_supply_chain_audit.py` scans 3 npm + 1 cargo lockfiles, 0 findings. `bash -n build.sh`, `bash -n studio/setup.sh`, and a pwsh scriptblock parse of studio/setup.ps1 all succeed.
99 lines
3.2 KiB
Bash
99 lines
3.2 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
# PyPI/Studio release publishing must use `./build.sh publish` (or an
|
|
# equivalent stamp -> build -> verify-dist -> upload flow) so packaged Studio
|
|
# artifacts include the display-only Studio release version.
|
|
|
|
# 1. Build frontend (Vite outputs to dist/)
|
|
cd studio/frontend
|
|
|
|
# Clean stale dist to force a full rebuild
|
|
rm -rf dist
|
|
|
|
# Tailwind v4's oxide scanner respects .gitignore in parent directories.
|
|
# Python venvs create a .gitignore with "*" (ignore everything), which
|
|
# prevents Tailwind from scanning .tsx source files for class names.
|
|
# Temporarily hide any such .gitignore during the build, then restore it.
|
|
_HIDDEN_GITIGNORES=()
|
|
_dir="$(pwd)"
|
|
while [ "$_dir" != "/" ]; do
|
|
_dir="$(dirname "$_dir")"
|
|
if [ -f "$_dir/.gitignore" ] && grep -qx '\*' "$_dir/.gitignore" 2>/dev/null; then
|
|
mv "$_dir/.gitignore" "$_dir/.gitignore._twbuild"
|
|
_HIDDEN_GITIGNORES+=("$_dir/.gitignore")
|
|
fi
|
|
done
|
|
|
|
_restore_gitignores() {
|
|
for _gi in "${_HIDDEN_GITIGNORES[@]+"${_HIDDEN_GITIGNORES[@]}"}"; do
|
|
mv "${_gi}._twbuild" "$_gi" 2>/dev/null || true
|
|
done
|
|
}
|
|
trap _restore_gitignores EXIT
|
|
|
|
# Frontend installs always use npm ci against the committed lockfile.
|
|
# There is no bun.lock anywhere in the repo, so a bun-first branch
|
|
# would always miss and silently regenerate (or fail under
|
|
# --frozen-lockfile). Keep this single path until/unless a real
|
|
# bun.lock lands.
|
|
if ! npm ci; then
|
|
echo "❌ ERROR: npm ci failed" >&2
|
|
exit 1
|
|
fi
|
|
npm run build # outputs to studio/frontend/dist/
|
|
|
|
_restore_gitignores
|
|
trap - EXIT
|
|
|
|
# Validate CSS output -- catch truncated Tailwind builds before packaging
|
|
MAX_CSS_SIZE=$(find dist/assets -name '*.css' -exec wc -c {} + 2>/dev/null | sort -n | tail -1 | awk '{print $1}')
|
|
if [ -z "$MAX_CSS_SIZE" ]; then
|
|
echo "❌ ERROR: No CSS files were emitted into dist/assets."
|
|
echo " The frontend build may have failed silently."
|
|
exit 1
|
|
fi
|
|
if [ "$MAX_CSS_SIZE" -lt 100000 ]; then
|
|
echo "❌ ERROR: Largest CSS file is only $((MAX_CSS_SIZE / 1024))KB (expected >100KB)."
|
|
echo " Tailwind may not have scanned all source files."
|
|
echo " Check for .gitignore files blocking the Tailwind oxide scanner."
|
|
exit 1
|
|
fi
|
|
echo "✅ Frontend CSS validated (${MAX_CSS_SIZE} bytes)"
|
|
|
|
cd ../..
|
|
|
|
# 2. Clean old artifacts
|
|
rm -rf build dist *.egg-info
|
|
|
|
# 3. Stamp display-only Studio release metadata for packaged builds.
|
|
_STUDIO_BUILD_INFO="studio/backend/utils/_studio_release_build.py"
|
|
_STUDIO_BUILD_INFO_BACKUP="$(mktemp)"
|
|
cp "$_STUDIO_BUILD_INFO" "$_STUDIO_BUILD_INFO_BACKUP"
|
|
_restore_studio_build_info() {
|
|
cp "$_STUDIO_BUILD_INFO_BACKUP" "$_STUDIO_BUILD_INFO" 2>/dev/null || true
|
|
rm -f "$_STUDIO_BUILD_INFO_BACKUP"
|
|
}
|
|
trap _restore_studio_build_info EXIT
|
|
|
|
if [ "${1:-}" = "publish" ]; then
|
|
STUDIO_STAMPED_VERSION="$(python scripts/stamp_studio_release.py --require-release)"
|
|
else
|
|
STUDIO_STAMPED_VERSION="$(python scripts/stamp_studio_release.py)"
|
|
fi
|
|
|
|
# 4. Build wheel/sdist
|
|
python -m build
|
|
|
|
if [ "${1:-}" = "publish" ]; then
|
|
python scripts/stamp_studio_release.py --verify-dist dist --expected "$STUDIO_STAMPED_VERSION"
|
|
fi
|
|
|
|
_restore_studio_build_info
|
|
trap - EXIT
|
|
|
|
# 5. Optionally publish
|
|
if [ "${1:-}" = "publish" ]; then
|
|
python -m twine upload dist/*
|
|
fi
|