feat(repo): add the build and release lane entry scripts - #3
Conversation
The repo docs claimed ownership of source patches, builtins, SEA packaging, platform artifacts, and release assembly, and the README pointed installers at gh release download, but the repo had zero releases and zero repo-owned build/release scripts - an agent asked to build or release node-smol had nothing to run. Flagged by the 2026-07-28 fleet code-as-law audit. What this adds: - scripts/repo/build.mts: real entry for what is buildable today. The default base target bakes the compile-environment image(s) declared in .config/repo/socket-wheelhouse.json docker.prebakes via docker buildx, mirroring the prebake-publish workflow; local runs load the host platform, --push covers the declared matrix. --dry-run prints the exact commands with preconditions. --target binary fails loud, naming exactly what was never ported from socket-btm (the pre-drop tree is socket-btm@55f8f23a packages/node-smol-builder) instead of pretending a lane exists. - scripts/repo/release.mts: release assembly from a built output dir. Dry-run is the default; --publish computes SHA-256 checksums, writes checksums.txt, verifies no release exists for the tag, and cuts a DRAFT via gh release create --draft. Undrafting stays a separate deliberate act. Fails loud on an empty asset dir. - scripts/repo/paths.mts: repo-tier path anchor inheriting the fleet paths module. - package.json: build:repo and release script entries (build is owned by the fleet hook-bundle build, so the repo lane gets a segmented name). - README: the Install section now states there are no releases yet and points at scripts/repo/build.mts for source builds. - CLAUDE.md: the .gitmodules pinning claim now describes the actual pin shape (branch = main + shallow = true, no sha256) with a TODO for the intended ref+sha256 contract; the sha256 pin itself is follow-up work, not part of this change.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.
Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit df1b557. Configure here.
| return `${digests | ||
| .map(entry => `${entry.digest} ${path.basename(entry.file)}`) | ||
| .join('\n')}\n` | ||
| } |
There was a problem hiding this comment.
Nested assets lose unique names
Medium Severity
The release.mts script collects assets recursively, but checksums.txt and gh release create use only the file's basename. This causes collisions for assets with identical names in different subdirectories, leading to ambiguous checksums and failed or clobbered GitHub release uploads.
Reviewed by Cursor Bugbot for commit df1b557. Configure here.
| platformsOverride: values.platforms, | ||
| push: values.push, | ||
| }) | ||
| } |
There was a problem hiding this comment.
Cover runs docker bake as build
High Severity
Placing the docker prebake entry at scripts/repo/build.mts makes the fleet cover runner treat it as the source-map build entry. pnpm run cover now spawns this script with no flags, so it tries a real docker buildx bake (or fails without Docker) instead of instrumenting sources directly as before.
Reviewed by Cursor Bugbot for commit df1b557. Configure here.
1 participant
Defect
The 2026-07-28 fleet code-as-law audit flagged a docs/reality gap in this repo:
gh release download --repo SocketDev/node-smol— but the repo has zero releases and zero repo-owned build/release scripts (onlydocker/repo/node-smol-base.Dockerfile+ the prebake workflow;scripts/repo/held only the cascaded bootstrap). An agent asked to build or release node-smol had nothing to run..gitmodulescarriesref+sha256:pins, while the actual.gitmodulesisbranch = main+shallow = truewith nosha256:(stuie publishes no release tags — the file says so itself).What this adds
scripts/repo/build.mts— a real, runnable build entry for what exists today:--target base(default) bakes the compile-environment image(s) declared in.config/repo/socket-wheelhouse.jsondocker.prebakesviadocker buildx build, mirroring.github/workflows/prebake-publish.yml(same config, same argv shape). Local default builds the host platform and--loads it;--pushbuilds the declared platform matrix (precondition stated:docker login ghcr.iowith packages:write; the workflow dispatch stays the canonical publisher).--dry-runprints the exact commands plus their preconditions (argv built by the same function the real run uses, so the plan cannot drift).--target binaryfails loud with a precise inventory of what is missing and where the sources are: the builder was never extracted from socket-btm — its extraction manifest (.config/repo/node-smol-rust-extraction.json) markspackages/node-smol-builderandpackages/npmas destined for node-smol withremovalStatus: "removed"; the pre-drop tree issocket-btm@55f8f23apackages/node-smol-builder. No fantasy steps.scripts/repo/release.mts— release assembly from a built output dir (defaultbuild/release/, or--dir). Dry-run is the default; it prints per-asset SHA-256 digests and the exactgh release create --draftcommand.--publishverifies gh auth, verifies no release exists for the tag (verify-before-publish), writeschecksums.txt, and cuts a draft; undrafting (gh release edit <tag> --draft=false) remains a separate deliberate act. Fails loud on a missing/empty asset dir, pointing at the missing binary lane.scripts/repo/paths.mts— repo-tier path anchor inheritingscripts/fleet/paths.mts(1 path, 1 reference). The Dockerfile path is deliberately resolved fromsocket-wheelhouse.json, not duplicated.package.json—build:repo+releasescript entries (buildis owned by the fleet hook-bundle build, so the repo lane gets a segmented name).scripts/repo/build.mtsfor source builds..gitmodulespinning claim now describes the actual pin shape (branch = main+shallow = true, nosha256:) with a TODO naming the intendedref+sha256:contract.Validation
pnpm run lint,pnpm run format:check,pnpm run type— green.pnpm run check— green exceptdispatch-table-is-current, which is red on the pristine tree too (pre-existing, unrelated to this diff).build.mts --dry-run(plan prints),--dry-run --push(full matrix plan),--target binary(fails loud, exit 1),release.mtsdry-run against a scratch asset dir (digests + plan) and against the empty default dir (fails loud, exit 1), bad-tag and unknown-target error paths.What remains (follow-ups, deliberately not in this PR)
ref+sha256:submodule pins (blocked on stuie shipping a taggable release;gen/gitmodules-hash --setis the intended tool).socket-btm@55f8f23apackages/node-smol-builder(Node source pin, patch series, additions/builtins, SEA packaging, strip/compress) and wiring--target binaryto it.release.mts.Note
Low Risk
New local/operator tooling and documentation honesty; no changes to auth, fleet hooks, or production CI behavior beyond wiring npm scripts to new entrypoints.
Overview
Adds repo-owned build and release entrypoints so agents and contributors can run what exists today instead of relying on docs that implied full binary/release workflows with zero scripts and zero GitHub releases.
scripts/repo/build.mtsdefaults to--target base: it readsdocker.prebakesfrom.config/repo/socket-wheelhouse.jsonand runs the samedocker buildx buildshape as the prebake-publish workflow (host platform--loadlocally; optional--push/--platforms).--dry-runprints the exact plan;--target binaryexits with a detailed inventory of what was never ported from socket-btm rather than stubbing steps.scripts/repo/release.mtsstages assets frombuild/release/(or--dir), computes SHA-256 digests andchecksums.txt, and by default dry-runs thegh release create --draftcommand;--publishverifies gh auth and that the tag does not already exist before cutting a draft. Empty or missing asset dirs fail loud.scripts/repo/paths.mtsextends fleet paths withBUILD_DIR/RELEASE_ASSETS_DIRwithout duplicating Dockerfile paths from wheelhouse config.package.jsonaddsbuild:repoandreleasescripts.README states there are no releases yet and documents the build/release scripts instead of implying
gh release downloadworks today. CLAUDE.md corrects.gitmodulespinning to the actualbranch+shallowshape and notes the futureref+sha256:contract.Reviewed by Cursor Bugbot for commit df1b557. Configure here.