From 5a2be35c1857d6653e3ae1e9f096455f798d2705 Mon Sep 17 00:00:00 2001 From: Dave Thompson Date: Wed, 29 Jul 2026 13:37:27 -0400 Subject: [PATCH] chore: package and CI maintenance for 0.4.9 Raise the secure Go floor and preferred toolchain, refresh selected golang.org/x modules, pin goneat and govulncheck, repair self-bootstrap flags, move release publish to softprops/action-gh-release v3, and validate the corpus manifest in-repo. Release docs and VERSION updated. Role: devlead Generated by Grok 4.5 (https://x.ai) running Grok Build (https://x.ai) under supervision of [@3leapsdave](https://github.com/3leapsdave) Co-Authored-By: Grok 4.5 Committer-of-Record: Dave Thompson [@3leapsdave] --- .github/workflows/ci.yml | 16 +++++++-------- .github/workflows/release.yml | 21 ++++++++++--------- CHANGELOG.md | 38 ++++++++++++++++++++++++++--------- Makefile | 12 ++++++----- RELEASE_NOTES.md | 32 +++++++++++++++++++++++++++-- VERSION | 2 +- docs/releases/v0.4.8.md | 4 ++-- docs/releases/v0.4.9.md | 37 ++++++++++++++++++++++++++++++++++ go.mod | 10 ++++----- go.sum | 12 +++++------ main_test.go | 30 +++++++++++++++++++++++++++ 11 files changed, 165 insertions(+), 49 deletions(-) create mode 100644 docs/releases/v0.4.9.md diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7a56602..27caeeb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,7 +22,7 @@ jobs: - uses: actions/setup-go@v6 with: - go-version: '1.26.4' + go-version: '1.26.5' - name: Install system tools run: | @@ -38,7 +38,7 @@ jobs: - name: Install goneat via sfetch (dogfooding) run: | ./bin/sfetch --repo fulmenhq/goneat \ - --tag v0.5.13 \ + --tag v0.5.15 \ --dest-dir bin \ --require-minisign ./bin/goneat version @@ -75,7 +75,7 @@ jobs: - uses: actions/setup-go@v6 with: - go-version: '1.26.4' + go-version: '1.26.5' - name: Build sfetch (from this commit) shell: bash @@ -94,7 +94,7 @@ jobs: export PATH="$BIN_DIR:$PATH" sfetch --repo fulmenhq/goneat \ - --tag v0.5.13 \ + --tag v0.5.15 \ --dest-dir "$BIN_DIR" \ --cache-dir "$CACHE_DIR" \ --require-minisign @@ -109,7 +109,7 @@ jobs: - uses: actions/setup-go@v6 with: - go-version: '1.26.4' + go-version: '1.26.5' - name: Install minisign shell: pwsh @@ -127,7 +127,7 @@ jobs: run: | .\bin\sfetch.exe ` --repo fulmenhq/goneat ` - --tag v0.5.13 ` + --tag v0.5.15 ` --dest-dir bin ` --require-minisign .\bin\goneat.exe version @@ -140,7 +140,7 @@ jobs: - uses: actions/setup-go@v6 with: - go-version: '1.26.4' + go-version: '1.26.5' - name: Install minisign shell: pwsh @@ -174,7 +174,7 @@ jobs: run: | .\bin\sfetch.exe ` --repo fulmenhq/goneat ` - --tag v0.5.13 ` + --tag v0.5.15 ` --dest-dir bin ` --require-minisign .\bin\goneat.exe version diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 13a5d5e..e5915b1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -18,14 +18,15 @@ jobs: steps: - uses: actions/checkout@v5 - # softprops/action-gh-release@v2 (Node 24) replaces the archived, - # Node12-era actions/create-release@v1 + actions/upload-release-asset@v1. - # It creates the release for the pushed tag (idempotent) and uploads the - # install script. The build matrix below appends per-platform archives to - # the same release. Maintainer signs + adds SHA256SUMS/notes afterward via - # scripts/ (see README "Manual signing workflow"). + # softprops/action-gh-release@v3 (Node 24) replaces the archived, + # Node12-era actions/create-release@v1 + actions/upload-release-asset@v1 + # and the Node-20 softprops/action-gh-release@v2 pin. It creates the + # release for the pushed tag (idempotent) and uploads the install script. + # The build matrix below appends per-platform archives to the same release. + # Maintainer signs + adds SHA256SUMS/notes afterward via scripts/ + # (see README "Manual signing workflow"). - name: Create release and upload install script - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@v3 with: name: sfetch ${{ github.ref_name }} body: | @@ -68,7 +69,7 @@ jobs: - uses: actions/setup-go@v6 with: - go-version: '1.26.4' + go-version: '1.26.5' - name: License check # go-licenses v1.6.0 errors on stdlib packages ("Package fmt does not @@ -120,10 +121,10 @@ jobs: # Maintainer generates SHA256SUMS locally and signs with minisign/pgp # Appends this matrix entry's archive to the release created above. - # action-gh-release@v2 is idempotent on the tag; parallel matrix jobs each + # action-gh-release@v3 is idempotent on the tag; parallel matrix jobs each # upload a distinctly-named asset, so no upload_url plumbing is needed. - name: Upload Archive - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@v3 with: files: ${{ env.ASSET_FILE }} diff --git a/CHANGELOG.md b/CHANGELOG.md index 4600f47..e494399 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,13 +9,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.4.9] - 2026-07-29 + +### Changed +- **Go toolchain pinned to 1.26.5.** `go.mod` now declares `go 1.25.12` with `toolchain go1.26.5`, and CI/release `setup-go` pins `1.26.5`. Clears reachable stdlib advisories (including GO-2026-5856) while remaining inside Go's supported-major window. +- **Dependencies updated:** `golang.org/x/crypto` v0.53.0 → v0.54.0, `golang.org/x/sys` v0.46.0 → v0.47.0, `golang.org/x/text` v0.38.0 → v0.40.0. Pinned `govulncheck@v1.6.0` on the precommit/CI path reports zero reachable vulnerabilities. +- **goneat pinned to v0.5.15** (was v0.5.13) across the `Makefile` and all CI dogfood install steps; installed via sfetch with minisign verification. +- **Release publish action bumped to Node 24.** `softprops/action-gh-release@v2` (Node 20) → `@v3` (Node 24) on both release steps. + +### Fixed +- **Self-bootstrap trust anchor.** `make bootstrap` now passes the installer `--dir` flag (was incorrect `--dest`), pins the binary with `--tag` matching `SFETCH_VERSION` (N-1: v0.4.8), and requires minisign verification. The installer script and installed binary are the same reviewed release. +- **Unpinned schema CLI removed from precommit.** Corpus validation runs in-repo via `jsonschema/v6` v6.0.2 (the product dependency) instead of network-fetched `cmd/jv@latest`. + +### Added +- **Pinned `govulncheck@v1.6.0` gate** in `make precommit` (and therefore CI Quality). + ## [0.4.8] - 2026-06-22 ### Changed - **Go toolchain pinned to 1.26.4.** `go.mod` now declares `go 1.25.5` with `toolchain go1.26.4`, and CI/release `setup-go` pins `1.26.4` (was the floating `1.26`). Default builds (`GOTOOLCHAIN=auto`) transparently use the patched 1.26.4 standard library while the module still builds on Go 1.25.x, keeping us inside Go's supported-major window and clearing the stdlib advisories that source-based vulnerability scans were flagging. - **Dependencies updated:** `golang.org/x/crypto` v0.47.0 → v0.53.0, `golang.org/x/text` v0.33.0 → v0.38.0, `golang.org/x/sys` v0.40.0 → v0.46.0, `github.com/dlclark/regexp2` v1.11.5 → v1.12.0, and `github.com/jedisct1/go-minisign` refreshed to its latest commit. `govulncheck ./...` reports no vulnerabilities. - **goneat pinned to v0.5.13** (was v0.5.10) across the `Makefile` and the CI dogfood install steps. -- **Release workflow migrated off archived Node12 actions.** `actions/create-release@v1` and `actions/upload-release-asset@v1` (both archived, Node12-era) are replaced with `softprops/action-gh-release@v2` (Node 24), completing the Node 20 → 24 runner transition begun in v0.4.7 (which had already moved `checkout`/`setup-go`). +- **Release workflow migrated off archived Node12 actions.** `actions/create-release@v1` and `actions/upload-release-asset@v1` (both archived, Node12-era) are replaced with `softprops/action-gh-release@v2` (Node 20). Checkout and setup-go had already moved to Node 24-era majors in v0.4.7. ### Added - **Pinned YAML formatting standard.** Added repo-root `.yamlfmt` and `.yamllint` so goneat's bundled yamlfmt and any standalone yamlfmt agree on inline-comment padding (two spaces) and document-start handling. Ends the intermittent `make precommit`/CI churn on workflow and config files. The config preserves sfetch's `---` + blank-line house style rather than collapsing it. @@ -138,15 +153,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Security - Block URL credentials by default to avoid leaking user info during redirects. -## [0.3.4] - 2026-01-10 - -### Added -- **Proxy support:** New `--http-proxy`, `--https-proxy`, and `--no-proxy` flags with environment variable overrides (`HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`) for proxied networks. -- **Proxy validation tests:** Added coverage for proxy URL validation and env overrides. - -### Documentation -- Documented proxy support in `README.md`. - --- > **Maintenance note:** This file is pruned to the latest 10 releases. For older entries, see `docs/releases/`. + +[Unreleased]: https://github.com/3leaps/sfetch/compare/v0.4.9...HEAD +[0.4.9]: https://github.com/3leaps/sfetch/compare/v0.4.8...v0.4.9 +[0.4.8]: https://github.com/3leaps/sfetch/compare/v0.4.7...v0.4.8 +[0.4.7]: https://github.com/3leaps/sfetch/compare/v0.4.6...v0.4.7 +[0.4.6]: https://github.com/3leaps/sfetch/compare/v0.4.5...v0.4.6 +[0.4.5]: https://github.com/3leaps/sfetch/compare/v0.4.4...v0.4.5 +[0.4.4]: https://github.com/3leaps/sfetch/compare/v0.4.3...v0.4.4 +[0.4.3]: https://github.com/3leaps/sfetch/compare/v0.4.2...v0.4.3 +[0.4.2]: https://github.com/3leaps/sfetch/compare/v0.4.1...v0.4.2 +[0.4.1]: https://github.com/3leaps/sfetch/compare/v0.4.0...v0.4.1 +[0.4.0]: https://github.com/3leaps/sfetch/compare/v0.3.4...v0.4.0 diff --git a/Makefile b/Makefile index 8534fe2..5aac9fb 100644 --- a/Makefile +++ b/Makefile @@ -40,9 +40,10 @@ SCOOP_BUCKET_REPO ?= https://github.com/3leaps/scoop-bucket.git # Tool installation directory (repo-local) BIN_DIR := $(CURDIR)/bin -# Pinned tool versions (minimums; existing installs are respected) -SFETCH_VERSION := v0.3.4 -GONEAT_VERSION ?= v0.5.13 +# Pinned tool versions (every gate/release tool is version-pinned; no @latest) +SFETCH_VERSION := v0.4.8 +GONEAT_VERSION ?= v0.5.15 +GOVULNCHECK_VERSION ?= v1.6.0 # Tool paths (sfetch bootstrap may land in bin/; goneat must be on PATH) SFETCH = $(shell [ -x "$(BIN_DIR)/sfetch" ] && echo "$(BIN_DIR)/sfetch" || command -v sfetch 2>/dev/null) @@ -94,7 +95,8 @@ bootstrap: ## Install development tools via trust chain @mkdir -p "$(BIN_DIR)" @if [ ! -x "$(BIN_DIR)/sfetch" ] && ! command -v sfetch >/dev/null 2>&1; then \ echo "[..] Installing sfetch $(SFETCH_VERSION) (self-bootstrap)..."; \ - curl -fsSL https://github.com/3leaps/sfetch/releases/download/$(SFETCH_VERSION)/install-sfetch.sh | bash -s -- --dest "$(BIN_DIR)"; \ + curl -fsSL https://github.com/3leaps/sfetch/releases/download/$(SFETCH_VERSION)/install-sfetch.sh | bash -s -- \ + --dir "$(BIN_DIR)" --tag "$(SFETCH_VERSION)" --require-minisign; \ else \ echo "[ok] sfetch already installed"; \ fi @@ -188,7 +190,7 @@ gosec-high: ## Run gosec (high confidence only) precommit: ## Run pre-commit checks (goneat assess + Go tests + build) @command -v goneat >/dev/null 2>&1 || { echo "[!!] goneat not found on PATH"; exit 1; } goneat assess --categories format,lint --check --fail-on critical - go run github.com/santhosh-tekuri/jsonschema/cmd/jv@latest testdata/corpus.schema.json testdata/corpus.json + go run golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION) ./... go test -v -race ./... $(MAKE) gosec-high $(MAKE) build-all diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md index 1d5784b..38da5c7 100644 --- a/RELEASE_NOTES.md +++ b/RELEASE_NOTES.md @@ -1,7 +1,35 @@ +## v0.4.9 + +### Summary +Maintenance release: patches the Go toolchain and selected dependencies, adds a pinned vulnerability gate, hardens the self-bootstrap trust anchor, and moves release publish onto Node 24. No user-facing feature or API changes. + +### Highlights + +**Toolchain & supply chain** +- `go.mod` pins `go 1.25.12` + `toolchain go1.26.5`; CI/release build with Go `1.26.5`. Clears reachable stdlib advisories while the module still builds on Go 1.25.x. +- Updated `golang.org/x/crypto` (v0.54.0), `golang.org/x/sys` (v0.47.0), and `golang.org/x/text` (v0.40.0). +- Precommit/CI runs pinned `govulncheck@v1.6.0` with zero reachable vulnerabilities as the pass condition. + +**CI / release** +- `softprops/action-gh-release@v2` (Node 20) → `@v3` (Node 24) on both release steps. +- Pinned goneat to `v0.5.15`, installed via sfetch with minisign verification. + +**Bootstrap & gates** +- `make bootstrap` self-install uses `--dir`, `--tag` (N-1 pin `v0.4.8`), and `--require-minisign` so the script and binary match a reviewed release. +- Corpus schema validation runs in-repo on `jsonschema/v6` v6.0.2 instead of an unpinned external CLI. + +### Install + +```bash +curl -sSfL https://github.com/3leaps/sfetch/releases/latest/download/install-sfetch.sh | bash +``` + +--- + ## v0.4.8 ### Summary -Maintenance release: refreshes the Go toolchain and dependencies, completes the GitHub Actions Node 20 → 24 migration, bumps goneat, and pins a repo-wide YAML formatting standard. No user-facing feature or behavior changes. +Maintenance release: refreshes the Go toolchain and dependencies, retires archived Node12 release Actions in favor of softprops/action-gh-release@v2, bumps goneat, and pins a repo-wide YAML formatting standard. No user-facing feature or behavior changes. ### Highlights @@ -10,7 +38,7 @@ Maintenance release: refreshes the Go toolchain and dependencies, completes the - Updated `golang.org/x/crypto`, `golang.org/x/text`, `golang.org/x/sys`, `github.com/dlclark/regexp2`, and `github.com/jedisct1/go-minisign`. `govulncheck ./...` is clean. **CI / release** -- Replaced the archived Node12 `actions/create-release@v1` + `actions/upload-release-asset@v1` with `softprops/action-gh-release@v2` (Node 24), completing the runner transition started in v0.4.7. +- Replaced the archived Node12 `actions/create-release@v1` + `actions/upload-release-asset@v1` with `softprops/action-gh-release@v2` (Node 20). Checkout and setup-go had already moved to Node 24-era majors in v0.4.7. - Pinned goneat to `v0.5.13`. **Developer experience** diff --git a/VERSION b/VERSION index cb498ab..76914dd 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.4.8 +0.4.9 diff --git a/docs/releases/v0.4.8.md b/docs/releases/v0.4.8.md index f52f913..9989619 100644 --- a/docs/releases/v0.4.8.md +++ b/docs/releases/v0.4.8.md @@ -1,5 +1,5 @@ ## Summary -Maintenance release: refreshes the Go toolchain and dependencies, completes the GitHub Actions Node 20 → 24 migration, bumps the dogfooded goneat toolchain, and pins a repo-wide YAML formatting standard. No user-facing feature or behavior changes, no API changes. +Maintenance release: refreshes the Go toolchain and dependencies, retires archived Node12 release Actions in favor of softprops/action-gh-release@v2, bumps the dogfooded goneat toolchain, and pins a repo-wide YAML formatting standard. No user-facing feature or behavior changes, no API changes. ## Highlights @@ -8,7 +8,7 @@ Maintenance release: refreshes the Go toolchain and dependencies, completes the - Updated `golang.org/x/crypto` (v0.53.0), `golang.org/x/text` (v0.38.0), `golang.org/x/sys` (v0.46.0), `github.com/dlclark/regexp2` (v1.12.0), and `github.com/jedisct1/go-minisign` (latest commit). `govulncheck ./...` reports no vulnerabilities. ### CI / release -- Replaced the archived, Node12-era `actions/create-release@v1` and `actions/upload-release-asset@v1` with `softprops/action-gh-release@v2` (Node 24), completing the Node 20 → 24 runner transition begun in v0.4.7 (which had already moved `checkout`/`setup-go`). +- Replaced the archived, Node12-era `actions/create-release@v1` and `actions/upload-release-asset@v1` with `softprops/action-gh-release@v2` (Node 20). Checkout and setup-go had already moved to Node 24-era majors in v0.4.7. - Pinned the dogfooded goneat toolchain to `v0.5.13` (was `v0.5.10`) across the `Makefile` and CI install steps. ### Developer experience diff --git a/docs/releases/v0.4.9.md b/docs/releases/v0.4.9.md new file mode 100644 index 0000000..ccb0ca2 --- /dev/null +++ b/docs/releases/v0.4.9.md @@ -0,0 +1,37 @@ +## Summary +Maintenance release: patches the Go toolchain and selected dependencies, adds a pinned vulnerability gate, hardens the self-bootstrap trust anchor, and moves release publish onto Node 24. No user-facing feature or API changes. + +## Highlights + +### Toolchain & supply chain +- `go.mod` now pins `go 1.25.12` with `toolchain go1.26.5`; CI and the release workflow build with Go `1.26.5`. Released binaries ship with the patched 1.26.5 standard library while the module still builds on Go 1.25.x, clearing reachable stdlib advisories (including GO-2026-5856) inside Go's supported-major window. +- Updated `golang.org/x/crypto` (v0.54.0), `golang.org/x/sys` (v0.47.0), and `golang.org/x/text` (v0.40.0). Pinned `govulncheck@v1.6.0` reports no reachable vulnerabilities. +- Direct product dependencies (`go-minisign`, `jsonschema/v6` v6.0.2, `regexp2`) are unchanged. + +### CI / release +- Bumped both `softprops/action-gh-release` steps from `@v2` (Node 20) to `@v3` (Node 24). +- Pinned the dogfooded goneat toolchain to `v0.5.15` (was `v0.5.13`) across the `Makefile` and all CI install steps; install path uses sfetch with minisign verification. + +### Bootstrap & quality gates +- Self-bootstrap (`make bootstrap`) now passes the installer `--dir` flag (was incorrect `--dest`), pins the binary with `--tag` matching `SFETCH_VERSION` (N-1: `v0.4.8`), and requires minisign verification so the downloaded script and installed binary are the same reviewed release. +- Removed the unpinned external schema CLI from precommit. Corpus manifest validation runs in-repo via the product's `jsonschema/v6` v6.0.2 dependency. +- `make precommit` (and CI Quality) runs pinned `govulncheck@v1.6.0`. + +## Validation +- `make precommit` green (including govulncheck, gosec-high, five-platform build-all) +- `go test ./...` green under Go 1.26.5 +- `GOTOOLCHAIN=go1.25.12 go test ./...` green (minimum supported line) +- `govulncheck@v1.6.0 ./...` reports no reachable vulnerabilities +- Corpus schema/manifest in-repo validation green + +## Install + +```bash +curl -sSfL https://github.com/3leaps/sfetch/releases/latest/download/install-sfetch.sh | bash +``` + +Or self-update: + +```bash +sfetch --self-update --yes +``` diff --git a/go.mod b/go.mod index c5e2025..cfc8ed8 100644 --- a/go.mod +++ b/go.mod @@ -1,8 +1,8 @@ module github.com/3leaps/sfetch -go 1.25.5 +go 1.25.12 -toolchain go1.26.4 +toolchain go1.26.5 require ( github.com/jedisct1/go-minisign v0.0.0-20260527172527-a09352b57a22 @@ -11,7 +11,7 @@ require ( require ( github.com/dlclark/regexp2 v1.12.0 // indirect - golang.org/x/crypto v0.53.0 // indirect - golang.org/x/sys v0.46.0 // indirect - golang.org/x/text v0.38.0 // indirect + golang.org/x/crypto v0.54.0 // indirect + golang.org/x/sys v0.47.0 // indirect + golang.org/x/text v0.40.0 // indirect ) diff --git a/go.sum b/go.sum index a68b7cf..21e1388 100644 --- a/go.sum +++ b/go.sum @@ -4,9 +4,9 @@ github.com/jedisct1/go-minisign v0.0.0-20260527172527-a09352b57a22 h1:C68TAi+k12 github.com/jedisct1/go-minisign v0.0.0-20260527172527-a09352b57a22/go.mod h1:vYVVh81Lqe/TP0sPLjiNYcX9Hxy/YSfkUx96lYJeyKo= github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ= github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU= -golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto= -golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio= -golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= -golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE= -golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4= +golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= +golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= +golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= +golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= +golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= diff --git a/main_test.go b/main_test.go index d7e1f7b..41401b4 100644 --- a/main_test.go +++ b/main_test.go @@ -2058,6 +2058,36 @@ func TestResolveMinisignKey(t *testing.T) { }) } +// TestCorpusSchemaValidity validates that testdata/corpus.schema.json is valid JSON Schema 2020-12. +func TestCorpusSchemaValidity(t *testing.T) { + c := jsonschema.NewCompiler() + if _, err := c.Compile("testdata/corpus.schema.json"); err != nil { + t.Fatalf("corpus schema is not valid JSON Schema 2020-12: %v", err) + } +} + +// TestCorpusManifestValidates checks testdata/corpus.json against the in-repo +// schema using the same jsonschema/v6 module the product requires (v6.0.2). +// Replaces the previous unpinned external cmd/jv precommit invocation. +func TestCorpusManifestValidates(t *testing.T) { + c := jsonschema.NewCompiler() + schema, err := c.Compile("testdata/corpus.schema.json") + if err != nil { + t.Fatalf("compile corpus schema: %v", err) + } + raw, err := os.ReadFile("testdata/corpus.json") + if err != nil { + t.Fatalf("read testdata/corpus.json: %v", err) + } + var doc any + if err := json.Unmarshal(raw, &doc); err != nil { + t.Fatalf("unmarshal testdata/corpus.json: %v", err) + } + if err := schema.Validate(doc); err != nil { + t.Fatalf("testdata/corpus.json does not validate: %v", err) + } +} + // TestProvenanceSchemaValidity validates that provenance.schema.json is valid JSON Schema 2020-12. // This catches schema syntax errors during development. func TestProvenanceSchemaValidity(t *testing.T) {