chore: adopt node-addon-landlock-run source as native/ subtree

Bring the node-addon-landlock-run tree (tag v0.0.1, commit 614f7fd) into native/landlock-run as its source of record: launcher development happens here, next to the harness consumers, and the standalone repository becomes the release mirror the tree is exported to for packing and publishing (procedure in native/README.md). The subtree keeps its own pnpm workspace and lockfile and is NOT added to the harness workspace: harness installs, gates, and CI never touch it. The mirror's .github/ stays out of the subtree; a separate manually-dispatched workflow (.github/workflows/landlock-run.yml) runs the subtree's CI legs — the per-architecture native builds, real-kernel launcher proofs, and pack rehearsal — adapted with working-directory/cache paths. eslint ignores the subtree like vendor/; AGENTS.md gains the native/ layout line (+5 words on its budget ceiling).
2026-07-14 23:34:47 +08:00
parent 513a8d2177
commit 0a486f09c9
46 changed files with 2582 additions and 1 deletions
@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+/**
+ * Assemble downloaded release artifacts into the platform packages and
+ * verify the result. The Release workflow's build legs upload one
+ * `prebuild-<package>` artifact per platform package (its `bin/` payload);
+ * this script copies each into `packages/<package>/bin/` and then checks
+ * every declared binary for presence and ELF architecture.
+ *
+ * Usage: `node scripts/assemble-prebuilds.mjs <artifact-root>`.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { platformDirs, root, verifyPlatformBinaries } from './repo.mjs';
+
+const artifactRoot = path.resolve(process.argv[2] || '.release/prebuild-artifacts');
+
+if (!fs.existsSync(artifactRoot)) {
+  throw new Error(`prebuild artifact directory does not exist: ${artifactRoot}`);
+}
+
+const platforms = platformDirs().map((dir) => path.basename(dir));
+
+for (const name of platforms) {
+  const binDir = path.join(root, 'packages', name, 'bin');
+  fs.rmSync(binDir, { recursive: true, force: true });
+  fs.mkdirSync(binDir, { recursive: true });
+}
+
+for (const artifactName of fs.readdirSync(artifactRoot)) {
+  const artifactDir = path.join(artifactRoot, artifactName);
+  if (!fs.statSync(artifactDir).isDirectory()) continue;
+
+  const name = platforms.find((candidate) => artifactName === `prebuild-${candidate}`);
+  if (!name) {
+    throw new Error(`cannot map artifact to a platform package: ${artifactName}`);
+  }
+
+  for (const file of fs.readdirSync(artifactDir)) {
+    const source = path.join(artifactDir, file);
+    const destination = path.join(root, 'packages', name, 'bin', file);
+    fs.copyFileSync(source, destination);
+    fs.chmodSync(destination, 0o755);
+    console.log(`Copied ${path.relative(root, source)} -> ${path.relative(root, destination)}`);
+  }
+}
+
+for (const dir of platformDirs()) {
+  const { name, count } = verifyPlatformBinaries(path.join(root, dir));
+  console.log(`Verified ${name}: ${count} binaries`);
+}