M034: rebuild unpublished tail without temp artifacts

Author: snowdamiz

.DS_Store

@@ -5,6 +5,9 @@ on:
     tags: ['v*']
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: deploy-fly-${{ github.ref_name }}
   cancel-in-progress: false
@@ -13,6 +16,7 @@ jobs:
   deploy-registry:
     name: Deploy mesh-registry
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -29,6 +33,7 @@ jobs:
   deploy-packages-website:
     name: Deploy mesh-packages website
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -46,21 +51,14 @@ jobs:
     name: Post-deploy health checks
     needs: [deploy-registry, deploy-packages-website]
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
-      - name: Check registry API
-        run: |
-          curl -sf --retry 5 --retry-delay 10 --retry-connrefused \
-            https://api.packages.meshlang.dev/api/v1/packages > /dev/null && \
-            echo "Registry API: OK"
-
-      - name: Check packages website
-        run: |
-          curl -sf --retry 5 --retry-delay 10 --retry-connrefused \
-            https://packages.meshlang.dev > /dev/null && \
-            echo "Packages website: OK"
+      - name: Checkout
+        uses: actions/checkout@v4
 
-      - name: Check docs site
+      - name: Verify public surface contract
+        shell: bash
+        timeout-minutes: 8
         run: |
-          curl -sf --retry 3 --retry-delay 5 \
-            https://meshlang.dev > /dev/null && \
-            echo "Docs site: OK"
+          set -euo pipefail
+          python3 scripts/lib/m034_public_surface_contract.py public-http --root "$GITHUB_WORKSPACE" --artifact-dir "$RUNNER_TEMP/m034-public-surface-contract"

.github/workflows/deploy-services.yml

@@ -18,6 +18,7 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -42,6 +43,12 @@ jobs:
         run: npm run build
         working-directory: website
 
+      - name: Verify public docs contract
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 scripts/lib/m034_public_surface_contract.py built-docs --root "$GITHUB_WORKSPACE" --dist-root "$GITHUB_WORKSPACE/website/docs/.vitepress/dist"
+
       - name: Upload artifact
         uses: actions/upload-pages-artifact@v3
         with:
@@ -53,6 +60,7 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     needs: build
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Deploy to GitHub Pages
         id: deployment

.github/workflows/deploy.yml

@@ -0,0 +1,111 @@
+name: Extension release proof
+
+on:
+  workflow_call:
+    outputs:
+      verified_vsix_path:
+        description: Repo-relative path to the verified VSIX.
+        value: ${{ jobs.proof.outputs.verified_vsix_path }}
+      verified_vsix_artifact_name:
+        description: Artifact name containing the verified VSIX file.
+        value: ${{ jobs.proof.outputs.verified_vsix_artifact_name }}
+
+permissions:
+  contents: read
+
+jobs:
+  proof:
+    name: Verify extension release proof
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    outputs:
+      verified_vsix_path: ${{ steps.capture.outputs.verified_vsix_path }}
+      verified_vsix_artifact_name: ${{ steps.capture.outputs.verified_vsix_artifact_name }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Verify extension proof entrypoint
+        shell: bash
+        run: test -f scripts/verify-m034-s04-extension.sh
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: tools/editors/vscode-mesh/package-lock.json
+
+      - name: Cache LLVM
+        uses: actions/cache@v4
+        id: cache-llvm
+        with:
+          path: ~/llvm
+          key: llvm-21.1.8-v3-x86_64-unknown-linux-gnu
+
+      - name: Install LLVM 21 (Linux x86_64)
+        if: steps.cache-llvm.outputs.cache-hit != 'true'
+        timeout-minutes: 10
+        run: |
+          LLVM_VERSION="21.1.8"
+          LLVM_ARCHIVE="LLVM-${LLVM_VERSION}-Linux-X64.tar.xz"
+          LLVM_URL="https://github.com/llvm/llvm-project/releases/download/llvmorg-${LLVM_VERSION}/${LLVM_ARCHIVE}"
+          curl -sSfL "$LLVM_URL" -o llvm.tar.xz
+          mkdir -p "$HOME/llvm"
+          tar xf llvm.tar.xz --strip-components=1 -C "$HOME/llvm"
+          rm llvm.tar.xz
+
+      - name: Set LLVM prefix (Linux tarball)
+        shell: bash
+        run: echo "LLVM_SYS_211_PREFIX=$HOME/llvm" >> "$GITHUB_ENV"
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        timeout-minutes: 10
+        with:
+          targets: x86_64-unknown-linux-gnu
+
+      - name: Cargo cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          key: extension-release-proof-x86_64-unknown-linux-gnu
+
+      - name: Run extension release proof
+        id: proof
+        shell: bash
+        timeout-minutes: 35
+        run: |
+          if [[ "$GITHUB_REF_TYPE" == "tag" ]]; then
+            export EXPECTED_TAG="$GITHUB_REF_NAME"
+          fi
+          bash scripts/verify-m034-s04-extension.sh
+
+      - name: Capture verified VSIX metadata
+        id: capture
+        shell: bash
+        run: |
+          verified_vsix_path="$(< .tmp/m034-s04/verify/verified-vsix-path.txt)"
+          artifact_name="extension-release-vsix"
+          test -n "$verified_vsix_path"
+          test -f "$verified_vsix_path"
+          echo "verified_vsix_path=$verified_vsix_path" >> "$GITHUB_OUTPUT"
+          echo "verified_vsix_artifact_name=$artifact_name" >> "$GITHUB_OUTPUT"
+
+      - name: Upload verified VSIX
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ steps.capture.outputs.verified_vsix_artifact_name }}
+          path: ${{ steps.capture.outputs.verified_vsix_path }}
+          if-no-files-found: error
+          retention-days: 7
+
+      - name: Upload extension proof diagnostics
+        if: failure()
+        uses: actions/upload-artifact@v4
+        timeout-minutes: 5
+        with:
+          name: extension-release-proof-diagnostics
+          path: .tmp/m034-s04/verify/**
+          if-no-files-found: error
+          retention-days: 7

.github/workflows/extension-release-proof.yml

@@ -1,5 +1,5 @@
 # Publish Mesh VS Code extension to VS Code Marketplace and Open VSX
-# Trigger: git tag ext-v0.2.0 && git push origin ext-v0.2.0
+# Trigger: git tag ext-vX.Y.Z && git push origin ext-vX.Y.Z
 # Requires secrets: VS_MARKETPLACE_TOKEN, OPEN_VSX_TOKEN
 
 name: Publish Extension
@@ -13,40 +13,41 @@ permissions:
   contents: read
 
 jobs:
+  proof:
+    name: Verify extension release proof
+    uses: ./.github/workflows/extension-release-proof.yml
+
   publish:
+    name: Publish verified extension
+    needs:
+      - proof
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
+      - name: Download verified VSIX
+        uses: actions/download-artifact@v4
         with:
-          node-version: 20
-
-      - name: Install dependencies
-        run: npm ci
-        working-directory: tools/editors/vscode-mesh
-
-      - name: Compile TypeScript
-        run: npm run compile
-        working-directory: tools/editors/vscode-mesh
+          name: ${{ needs.proof.outputs.verified_vsix_artifact_name }}
+          path: tools/editors/vscode-mesh/dist/
 
-      - name: Package VSIX
-        id: package
+      - name: Confirm verified VSIX handoff
+        shell: bash
+        env:
+          VERIFIED_VSIX_PATH: ${{ needs.proof.outputs.verified_vsix_path }}
         run: |
-          npx vsce package --no-dependencies
-          echo "vsix_path=$(ls *.vsix)" >> "$GITHUB_OUTPUT"
-        working-directory: tools/editors/vscode-mesh
+          test -n "$VERIFIED_VSIX_PATH"
+          test -f "$VERIFIED_VSIX_PATH"
+          echo "Publishing verified VSIX: $VERIFIED_VSIX_PATH"
 
       - name: Publish to Open VSX Registry
         uses: HaaLeo/publish-vscode-extension@v2
-        continue-on-error: true
         with:
           pat: ${{ secrets.OPEN_VSX_TOKEN }}
-          extensionFile: tools/editors/vscode-mesh/${{ steps.package.outputs.vsix_path }}
+          extensionFile: ${{ needs.proof.outputs.verified_vsix_path }}
 
       - name: Publish to Visual Studio Marketplace
         uses: HaaLeo/publish-vscode-extension@v2
         with:
           pat: ${{ secrets.VS_MARKETPLACE_TOKEN }}
           registryUrl: https://marketplace.visualstudio.com
-          extensionFile: tools/editors/vscode-mesh/${{ steps.package.outputs.vsix_path }}
+          extensionFile: ${{ needs.proof.outputs.verified_vsix_path }}