From 8b6990c407d8f56ab6e459e080201ad76973f5a1 Mon Sep 17 00:00:00 2001 From: bigboateng Date: Fri, 7 Aug 2026 23:13:39 +0100 Subject: [PATCH] Normalize Rust artifacts at transport boundary --- .github/workflows/npm-publish.yml | 1 + scripts/check-release-control.mjs | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index d42dfe0..b121d4f 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -139,6 +139,7 @@ jobs: shell: bash run: | set -euo pipefail + chmod 0644 dist/packages/rust/runtime/*/runtime/* node packaging/crates-release.mjs inspect --version "$VERSION" --rust dist/packages/rust mkdir -p dist/crates for directory in dist/packages/rust/runtime/*; do diff --git a/scripts/check-release-control.mjs b/scripts/check-release-control.mjs index 5b39650..058aa61 100644 --- a/scripts/check-release-control.mjs +++ b/scripts/check-release-control.mjs @@ -80,6 +80,7 @@ export async function checkReleaseControl(root = resolve(import.meta.dirname, ". expect(raw["npm-publish.yml"].indexOf("Publish platform runtimes") < raw["npm-publish.yml"].indexOf("Publish SDK and CLI"), "runtime packages must publish before the SDK package"); expect(raw["npm-publish.yml"].includes("pypa/gh-action-pypi-publish@"), "PyPI publishing must use the trusted-publishing action"); expect(raw["npm-publish.yml"].includes("rust-lang/crates-io-auth-action@"), "crates.io publishing must use the trusted-publishing action"); + expect(raw["npm-publish.yml"].includes("chmod 0644 dist/packages/rust/runtime/*/runtime/*"), "Rust archives must normalize embedded runtime modes before artifact transport"); expect(raw["npm-publish.yml"].indexOf("rust/runtime/*") < raw["npm-publish.yml"].indexOf("rust/yieldskill"), "Rust runtime crates must publish before the SDK crate"); expect(!raw["npm-publish.yml"].includes("skip-existing"), "PyPI retries must verify hashes instead of blindly skipping existing files");