tegwick
a835c11ae7
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a101af-e240-7882-a1e3-e37720cbdbea
40 lines
1.5 KiB
Python
40 lines
1.5 KiB
Python
#!/usr/bin/env python3
|
|
"""Seal reviewed package files, or check the existing seal. Never reads secrets."""
|
|
from pathlib import Path
|
|
import argparse
|
|
import hashlib
|
|
import sys
|
|
|
|
import yaml
|
|
|
|
|
|
def manifest(root):
|
|
catalog = yaml.safe_load((root / "catalog.yaml").read_text())
|
|
paths = [root / "catalog.yaml", root / "sources.yaml"]
|
|
paths += sorted((root / "cards").glob("*.md"))
|
|
paths += sorted((root / "adapters").glob("*.md"))
|
|
return {"schema": "emergent.release.v1", "version": catalog["version"],
|
|
"trust": "repository-reviewed-content; hashes are not signatures",
|
|
"files": {str(p.relative_to(root)): hashlib.sha256(p.read_bytes()).hexdigest() for p in paths}}
|
|
|
|
|
|
def main():
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument("--check", action="store_true")
|
|
parser.add_argument("--bundle", type=Path, default=Path(__file__).resolve().parents[1] / "knowledge")
|
|
args = parser.parse_args()
|
|
expected = manifest(args.bundle)
|
|
path = args.bundle / "release.yaml"
|
|
if args.check:
|
|
if not path.exists() or yaml.safe_load(path.read_text()) != expected:
|
|
print("Release differs from reviewed files; review before resealing.")
|
|
return 1
|
|
print(f"Knowledge {expected['version']}: seal matches all package files.")
|
|
else:
|
|
path.write_text(yaml.safe_dump(expected, sort_keys=False))
|
|
print(f"Sealed {len(expected['files'])} reviewed files; inspect the diff before release.")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|