Extract independent MIT Mortar kit and contribution workflow

scripts/release.mjs

@@ -0,0 +1,46 @@
+// Run by a protected release job after maintainer review and exact-commit CI.
+import { readFile, mkdir, writeFile } from "node:fs/promises";
+import { execFileSync } from "node:child_process";
+import { resolve } from "node:path";
+import { createHash } from "node:crypto";
+import { checkKit, ROOT } from "./check.mjs";
+const report = await checkKit();
+if (!report.passed)
+  throw Error("Baseline checks failed; run npm run check:json.");
+if (
+  execFileSync("git", ["status", "--porcelain"], {
+    cwd: ROOT,
+    encoding: "utf8",
+  }).trim()
+)
+  throw Error("Release requires a clean checkout.");
+const commit = execFileSync("git", ["rev-parse", "HEAD"], {
+  cwd: ROOT,
+  encoding: "utf8",
+}).trim();
+const pkg = JSON.parse(await readFile(resolve(ROOT, "package.json"), "utf8"));
+const out = resolve(ROOT, "release", pkg.version);
+await mkdir(resolve(ROOT, "release"), { recursive: true });
+await mkdir(out, { recursive: false });
+const packed = JSON.parse(
+  execFileSync("npm", ["pack", "--json", "--pack-destination", out], {
+    cwd: ROOT,
+    encoding: "utf8",
+  }),
+)[0];
+const bytes = await readFile(resolve(out, packed.filename));
+const provenance = {
+  schemaVersion: 1,
+  package: pkg.name,
+  version: pkg.version,
+  commit,
+  policyVersion: report.policyVersion,
+  integrity: "sha512-" + createHash("sha512").update(bytes).digest("base64"),
+  filename: packed.filename,
+};
+await writeFile(
+  resolve(out, "provenance.json"),
+  JSON.stringify(provenance, null, 2) + "\n",
+  { flag: "wx" },
+);
+console.log(JSON.stringify(provenance, null, 2));