Repository navigation
Add windows/amd64 Node 26.12.1 + linux/arm64 Go support - #163
Conversation
Port the gated Windows Node ZIP installer and add the canonical v26.12.1 windows/amd64 artifact lock, fixture coverage, and platform documentation. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Superseded — see the current review report for commit
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| self.assertEqual(self.phase_outputs()["node"], version) | ||
| self.assertEqual(json.loads(self.phase_outputs()["versions"]), {"node": version}) | ||
|
|
||
| @unittest.skipUnless(os.name == "nt" and shutil.which("pwsh"), "requires native Windows PowerShell") |
There was a problem hiding this comment.
🟡 Suggestion (medium confidence): No workflow in .github/workflows/ runs this suite on a Windows runner, so this test always skips in CI. That means the new node branch in install-tool.ps1 (canonical-URL pin, hash before extract, nested node.exe leaf, PATH publication) never actually runs. The dispatch test above stubs pwsh. If a later edit breaks the Windows node path, it would first show up in a consumer's release-windows job. Consider adding a small windows-latest job that runs these negative controls.
Superseded — see the current review report for commit
|
Run only the self-contained installer fixture on windows-latest with read-only permissions, pinned checkout, and no persisted credentials or release secrets. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Superseded — see the current review report for commit
|
Superseded — see the current review report for commit
|
Accept equivalent short and long Windows temp paths without weakening archive hash, extraction, leaf, or negative-control checks. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Superseded — see the current review report for commit
|
Superseded — see the current review report for commit
|
Pin Go 1.27.3 linux/arm64 from official release metadata and a real archive download. Exercise both uname aliases and hash-before-extraction failure using the existing architecture-generic installer. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Superseded — see the current review report for commit
|
| # Minisign lock ported verbatim from ductone/multipass PR #953 (release-sign-split); producer/reviewer verified it independently. | ||
| minisign 0.12 darwin/arm64 89000b19535765f9cffc65a65d64a820f433ef6db8020667f7570e06bf6aac63 https://github.com/jedisct1/minisign/releases/download/0.12/minisign-0.12-macos.zip | ||
| node v26.12.1 windows/amd64 b3efd5c70cba3308ed46e7e699a9b8aac075bbc6b027fcb39c84c31acc25e2b4 https://nodejs.org/dist/v26.12.1/node-v26.12.1-win-x64.zip | ||
| go go1.27.3 linux/arm64 a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49 https://go.dev/dl/go1.27.3.linux-arm64.tar.gz |
There was a problem hiding this comment.
🟡 Suggestion: This go go1.27.3 linux/arm64 lock goes beyond the PR's stated scope (Windows Node), and the PR body gives no provenance for this hash. The Windows Node row does have provenance. The installer, URL canonicalization, and tests look correct, but this repo can't verify the hash itself. Please add a note on where it came from (e.g. the go.dev/dl JSON manifest), or split it into its own PR. (confidence: medium)
General PR Review: locked-tools: add windows/amd64 Node 26.12.1 supportBlocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0 Review SummaryNew in this push: one Already in the PR:
Coverage: I scanned the full PR diff for security and correctness, and found no partial or dropped paths. Against the source I confirmed:
I could not verify the upstream SHA-256 values offline. No repo-local criteria loaded, so only the base criteria were applied. Security IssuesNone found. Correctness IssuesNone found. Suggestions
Prompt for AI agentsReviewed commit: |
gontzess
changed the title
Why
The locked-tools action lacks Windows/amd64 Node and Linux/arm64 Go locks, so consumers requiring either tool/platform pair fail closed on the missing row. This adds both using the existing approved Node 26.12.1 and Go 1.27.3 versions.
What
tool-locks.txt:node v26.12.1 windows/amd64— sha256b3efd5c7…from the officialSHASUMS256.txt, independently re-downloaded and hash-verified (41,901,456 bytes;node-v26.12.1-win-x64/node.exeleaf, MZ header, all 2,398 entries under the package root).tool-locks.txt:go go1.27.3 linux/arm64— SHA256a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49from official Go release metadata, re-verified by a real archive download (67,076,044 bytes; executable regulargo/bin/goleaf, mode 0755, ELF64 AArch64).arm64andaarch64uname values, GOROOT/PATH publication, and hash mismatch before extraction.install-tool.ps1: the node case — ported byte-identically from ductone/multipass's gated installer (Get-FileHash before Expand-Archive, nested package-dir leaf check onnode.exe, PATH publication; goreleaser-pro → goreleaser.exe mapping untouched).Verification