fix(ci): preserve verified WASM artifacts

Author: roomote

src/scripts/copy-tree-sitter-wasms.mjs

@@ -26,21 +26,26 @@ export function publishTreeSitterWasms(sourceDir, destinationDir, filesystem = f
 	const cleanup = () => cleanPublishedTreeSitterWasms(destinationDir, filesystem)
 
 	filesystem.mkdirSync(destinationDir, { recursive: true })
+	const previousFiles = new Map(
+		filesystem
+			.readdirSync(destinationDir)
+			.filter((filename) => wasmPattern.test(filename))
+			.map((filename) => [filename, filesystem.readFileSync(path.join(destinationDir, filename))]),
+	)
 	for (const filename of filesystem.readdirSync(destinationDir)) {
 		if (temporaryPattern.test(filename)) filesystem.rmSync(path.join(destinationDir, filename), { force: true })
 	}
 
+	const temporaryFiles = []
 	try {
 		for (const filename of sourceFiles) {
 			const destination = path.join(destinationDir, filename)
 			const temporary = `${destination}.${process.pid}.tmp`
-
-			try {
-				filesystem.copyFileSync(path.join(sourceDir, filename), temporary)
-				filesystem.renameSync(temporary, destination)
-			} finally {
-				filesystem.rmSync(temporary, { force: true })
-			}
+			temporaryFiles.push(temporary)
+			filesystem.copyFileSync(path.join(sourceDir, filename), temporary)
+		}
+		for (const [index, filename] of sourceFiles.entries()) {
+			filesystem.renameSync(temporaryFiles[index], path.join(destinationDir, filename))
 		}
 
 		for (const filename of filesystem.readdirSync(destinationDir)) {
@@ -50,7 +55,12 @@ export function publishTreeSitterWasms(sourceDir, destinationDir, filesystem = f
 		}
 	} catch (error) {
 		cleanup()
+		for (const [filename, content] of previousFiles) {
+			filesystem.writeFileSync(path.join(destinationDir, filename), content)
+		}
 		throw error
+	} finally {
+		for (const temporary of temporaryFiles) filesystem.rmSync(temporary, { force: true })
 	}
 
 	return { sourceFiles, cleanup }

src/scripts/copy-tree-sitter-wasms.spec.mjs

@@ -30,12 +30,14 @@ describe("publishTreeSitterWasms", () => {
 		expect(fs.readFileSync(path.join(destination, "tree-sitter-a.wasm"), "utf8")).toBe("a")
 	})
 
-	it("removes published and temporary outputs when publication fails", () => {
+	it("restores published outputs when publication fails", () => {
 		const source = path.join(root, "source")
 		const destination = path.join(root, "dist")
 		fs.mkdirSync(source)
+		fs.mkdirSync(destination)
 		fs.writeFileSync(path.join(source, "tree-sitter-a.wasm"), "a")
 		fs.writeFileSync(path.join(source, "tree-sitter-b.wasm"), "b")
+		fs.writeFileSync(path.join(destination, "tree-sitter-existing.wasm"), "existing")
 		let copies = 0
 		const filesystem = {
 			...fs,
@@ -46,22 +48,31 @@ describe("publishTreeSitterWasms", () => {
 		}
 
 		expect(() => publishTreeSitterWasms(source, destination, filesystem)).toThrow("copy failed")
-		expect(fs.readdirSync(destination)).toEqual([])
+		expect(fs.readdirSync(destination)).toEqual(["tree-sitter-existing.wasm"])
+		expect(fs.readFileSync(path.join(destination, "tree-sitter-existing.wasm"), "utf8")).toBe("existing")
 	})
 
-	it("removes published and temporary outputs when an atomic rename fails", () => {
+	it("restores published outputs when an atomic rename fails", () => {
 		const source = path.join(root, "source")
 		const destination = path.join(root, "dist")
 		fs.mkdirSync(source)
+		fs.mkdirSync(destination)
 		fs.writeFileSync(path.join(source, "tree-sitter-a.wasm"), "a")
+		fs.writeFileSync(path.join(source, "tree-sitter-b.wasm"), "b")
+		fs.writeFileSync(path.join(destination, "tree-sitter-a.wasm"), "previous-a")
+		fs.writeFileSync(path.join(destination, "tree-sitter-b.wasm"), "previous-b")
+		let renames = 0
 		const filesystem = {
 			...fs,
-			renameSync() {
-				throw new Error("rename failed")
+			renameSync(...args) {
+				if (++renames === 2) throw new Error("rename failed")
+				return fs.renameSync(...args)
 			},
 		}
 
 		expect(() => publishTreeSitterWasms(source, destination, filesystem)).toThrow("rename failed")
-		expect(fs.readdirSync(destination)).toEqual([])
+		expect(fs.readdirSync(destination)).toEqual(["tree-sitter-a.wasm", "tree-sitter-b.wasm"])
+		expect(fs.readFileSync(path.join(destination, "tree-sitter-a.wasm"), "utf8")).toBe("previous-a")
+		expect(fs.readFileSync(path.join(destination, "tree-sitter-b.wasm"), "utf8")).toBe("previous-b")
 	})
 })

src/scripts/verify-coverage-contract.mjs

@@ -4,6 +4,8 @@ import path from "node:path"
 import process from "node:process"
 import { fileURLToPath } from "node:url"
 
+import { assertMatchingFiles } from "./verify-wasm-files.mjs"
+
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..")
 const pnpm = process.platform === "win32" ? process.env.npm_execpath : "pnpm"
 if (!pnpm) throw new Error("pnpm executable path is unavailable")
@@ -60,6 +62,12 @@ try {
 	if (source.length === 0) throw new Error("Dependency contains no tree-sitter WASMs")
 	if (JSON.stringify(source) !== JSON.stringify(published))
 		throw new Error("Published WASM set does not match dependency")
+	assertMatchingFiles(
+		path.join(root, "src", "node_modules", "tree-sitter-wasms", "out"),
+		dist,
+		source,
+		"Published WASM content does not match dependency",
+	)
 	if (fs.readdirSync(dist).some((filename) => filename.endsWith(".tmp")))
 		throw new Error("Temporary WASM files remain")
 
@@ -85,6 +93,12 @@ try {
 		.filter((filename) => /^tree-sitter-.*\.wasm$/.test(filename))
 		.sort()
 	if (JSON.stringify(source) !== JSON.stringify(restored)) throw new Error("WASM cache did not restore exact outputs")
+	assertMatchingFiles(
+		path.join(root, "src", "node_modules", "tree-sitter-wasms", "out"),
+		dist,
+		source,
+		"WASM cache restored corrupted output",
+	)
 } finally {
 	fs.rmSync(cacheDir, { recursive: true, force: true })
 }

src/scripts/verify-wasm-files.mjs

@@ -0,0 +1,14 @@
+import fs from "node:fs"
+import path from "node:path"
+
+export function assertMatchingFiles(expectedDir, actualDir, filenames, message, filesystem = fs) {
+	for (const filename of filenames) {
+		if (
+			!filesystem
+				.readFileSync(path.join(expectedDir, filename))
+				.equals(filesystem.readFileSync(path.join(actualDir, filename)))
+		) {
+			throw new Error(`${message}: ${filename}`)
+		}
+	}
+}

src/scripts/verify-wasm-files.spec.mjs

@@ -0,0 +1,29 @@
+import fs from "node:fs"
+import os from "node:os"
+import path from "node:path"
+import { afterEach, beforeEach, describe, expect, it } from "vitest"
+
+import { assertMatchingFiles } from "./verify-wasm-files.mjs"
+
+describe("assertMatchingFiles", () => {
+	let root
+
+	beforeEach(() => {
+		root = fs.mkdtempSync(path.join(os.tmpdir(), "verify-wasm-files-"))
+	})
+
+	afterEach(() => fs.rmSync(root, { recursive: true, force: true }))
+
+	it("rejects a restored WASM with corrupted content", () => {
+		const expected = path.join(root, "expected")
+		const actual = path.join(root, "actual")
+		fs.mkdirSync(expected)
+		fs.mkdirSync(actual)
+		fs.writeFileSync(path.join(expected, "tree-sitter-a.wasm"), "expected")
+		fs.writeFileSync(path.join(actual, "tree-sitter-a.wasm"), "corrupted")
+
+		expect(() => assertMatchingFiles(expected, actual, ["tree-sitter-a.wasm"], "WASM mismatch")).toThrow(
+			"WASM mismatch: tree-sitter-a.wasm",
+		)
+	})
+})