Merge PR #7660: ci(release): add SHA256SUMS.txt to GitHub releases (@andrew-scott-fischer)

scripts/ci-release-checksums.test.ts

@@ -0,0 +1,16 @@
+import { describe, expect, it } from "bun:test";
+import { formatChecksums } from "./ci-release-checksums";
+
+describe("formatChecksums", () => {
+	it("sorts entries by basename and formats as `sha256sum -c`-compatible lines", () => {
+		const output = formatChecksums([
+			{ name: "omp-linux-x64", sha256: "b".repeat(64) },
+			{ name: "omp-darwin-arm64", sha256: "a".repeat(64) },
+		]);
+		expect(output).toBe(`${"a".repeat(64)}  omp-darwin-arm64\n${"b".repeat(64)}  omp-linux-x64\n`);
+	});
+
+	it("returns an empty string for no entries", () => {
+		expect(formatChecksums([])).toBe("");
+	});
+});

scripts/ci-release-checksums.ts

@@ -0,0 +1,54 @@
+#!/usr/bin/env bun
+/**
+ * Generate a `sha256sum`-compatible checksums file for release assets.
+ *
+ * Usage:
+ *   bun scripts/ci-release-checksums.ts <out-file> <asset>...
+ *
+ * Each `<asset>` is hashed and written as a `<sha256>  <basename>` line,
+ * sorted by basename, so the result can be verified after download with
+ * `sha256sum -c SHA256SUMS.txt` (or `shasum -a 256 -c` on macOS).
+ *
+ * Intended for the `release_github` CI job, run after the release binaries
+ * and browser-relay archive are assembled and before the GitHub Release is
+ * created, so the checksums file itself ships as one of the release assets.
+ */
+
+import * as path from "node:path";
+
+export interface ChecksumEntry {
+	name: string;
+	sha256: string;
+}
+
+export function formatChecksums(entries: readonly ChecksumEntry[]): string {
+	return entries
+		.slice()
+		.sort((a, b) => a.name.localeCompare(b.name))
+		.map(({ sha256, name }) => `${sha256}  ${name}\n`)
+		.join("");
+}
+
+async function main(): Promise<void> {
+	const [outFile, ...assetPaths] = process.argv.slice(2);
+	if (!outFile || assetPaths.length === 0) {
+		throw new Error("usage: ci-release-checksums.ts <out-file> <asset>...");
+	}
+
+	const entries = await Promise.all(
+		assetPaths.map(async assetPath => {
+			const hasher = new Bun.CryptoHasher("sha256");
+			for await (const chunk of Bun.file(assetPath).stream()) {
+				hasher.update(chunk);
+			}
+			return { name: path.basename(assetPath), sha256: hasher.digest("hex") };
+		}),
+	);
+
+	await Bun.write(outFile, formatChecksums(entries));
+	console.log(`Wrote ${entries.length} checksum(s) to ${outFile}`);
+}
+
+if (import.meta.main) {
+	await main();
+}