@automattic/vip 4.1.5 → 4.1.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automattic/vip",
-  "version": "4.1.5",
+  "version": "4.1.8",
   "description": "The VIP Javascript library & CLI",
   "main": "index.js",
   "bin": {
@@ -93,9 +93,9 @@
     "cmd:lint": "eslint --ext 'js,jsx,ts,tsx'",
     "prepare": "npm run clean && npm run build",
     "check-types": "tsc",
-    "postinstall": "node ./helpers/check-version.js",
-    "build": "babel src -d dist --extensions=\".js,.ts\"",
-    "build:watch": "babel src -d dist --watch --source-maps --extensions=\".js,.ts\"",
+    "build": "tsc -p tsconfig.build.json",
+    "postbuild": "node helpers/mark-cli-executable.js",
+    "build:watch": "npm run build && tsc -p tsconfig.build.json --watch --sourceMap",
     "format": "npm run cmd:format -- --write",
     "format:check": "npm run cmd:format -- --check",
     "jest": "jest --testPathIgnorePatterns __tests__/devenv-e2e/",
@@ -121,7 +121,7 @@
   ],
   "license": "MIT",
   "engines": {
-    "node": ">=22.19.0",
+    "node": ">=22.23.2",
     "npm": ">=8"
   },
   "bugs": {
@@ -129,14 +129,10 @@
   },
   "homepage": "https://github.com/Automattic/vip#readme",
   "devDependencies": {
-    "@automattic/eslint-plugin-wpvip": "^1.0.0",
-    "@babel/cli": "7.29.7",
-    "@babel/core": "7.29.7",
-    "@babel/preset-env": "7.29.7",
-    "@babel/preset-typescript": "7.29.7",
+    "@automattic/eslint-plugin-wpvip": "^2.0.0",
     "@jest/globals": "^30.0.0",
     "@jest/test-sequencer": "^30.0.0",
-    "@types/configstore": "^6.0.2",
+    "@types/configstore": "^8.0.0",
     "@types/debug": "^4.1.12",
     "@types/dockerode": "^4.0.1",
     "@types/ejs": "^3.1.5",
@@ -151,30 +147,30 @@
     "dockerode": "^5.0.0",
     "jest": "^30.0.0",
     "prettier": "npm:wp-prettier@3.0.3",
+    "ts-jest": "29.4.15",
     "typescript": "^6.0.2"
   },
   "dependencies": {
-    "@apollo/client": "4.3.1",
+    "@apollo/client": "4.3.5",
     "@automattic/vip-search-replace": "^2.0.0",
     "@json2csv/plainjs": "^7.0.3",
     "@wwa/single-line-log": "^1.1.4",
     "chalk": "^6.0.0",
-    "check-disk-space": "3.4.0",
+    "check-disk-space": "4.0.0",
     "cli-columns": "^4.0.0",
     "cli-table3": "^0.6.3",
     "commander": "^15.0.0",
     "configstore": "^8.0.0",
     "debug": "4.4.3",
-    "ejs": "^6.0.1",
+    "ejs": "^7.0.1",
     "enquirer": "2.4.1",
-    "fetch-retry": "^6.0.0",
     "graphql": "17.0.2",
     "graphql-tag": "2.12.7",
     "graphql-ws": "^6.2.0",
     "https-proxy-agent": "^9.0.0",
     "js-yaml": "^5.0.0",
     "jwt-decode": "4.0.0",
-    "lando": "github:automattic/lando-cli#78d382fcf40357c4a4cebe4a3cfaef032eab743a",
+    "lando": "github:automattic/lando-cli#9ae6f4f7316dfebfbfb9acd626158388c58dfd44",
     "node-stream-zip": "1.16.0",
     "open": "^11.0.0",
     "proxy-from-env": "^2.0.0",
@@ -196,7 +192,42 @@
   "publishConfig": {
     "access": "public"
   },
-  "bundleDependencies": true,
+  "bundleDependencies": [
+    "@apollo/client",
+    "@automattic/vip-search-replace",
+    "@json2csv/plainjs",
+    "@wwa/single-line-log",
+    "chalk",
+    "check-disk-space",
+    "cli-columns",
+    "cli-table3",
+    "commander",
+    "configstore",
+    "debug",
+    "ejs",
+    "enquirer",
+    "graphql",
+    "graphql-tag",
+    "graphql-ws",
+    "https-proxy-agent",
+    "js-yaml",
+    "jwt-decode",
+    "lando",
+    "node-stream-zip",
+    "open",
+    "proxy-from-env",
+    "rxjs",
+    "semver",
+    "shelljs",
+    "socket.io-client",
+    "socket.io-stream",
+    "socks-proxy-agent",
+    "ssh2",
+    "tar",
+    "undici",
+    "update-notifier",
+    "xml2js"
+  ],
   "allowScripts": {
     "ssh2@1.17.0": true,
     "@github/keytar@7.10.6": true,

package/.buildkite/build-linux.sh

@@ -1,68 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-# Build the Linux vip-next binaries + checksums on a Buildkite Linux agent.
-# Linux has no OS-enforced executable signature; we publish checksums.
-
-[ -f .buildkite/shared-pipeline-vars ] && . .buildkite/shared-pipeline-vars
-: "${BIN_BASE:=vip-next}"
-
-if ! command -v go >/dev/null 2>&1; then
-  echo "--- :package: install go"
-  version="$(awk '/^toolchain / { print $2; exit }' go.mod)"
-  version="${version#go}"
-  [ -n "${version}" ] || { echo "no toolchain directive in go.mod" >&2; exit 1; }
-  case "$(uname -m)" in
-    x86_64|amd64) arch=amd64 ;;
-    aarch64|arm64) arch=arm64 ;;
-    *) echo "unsupported arch $(uname -m)" >&2; exit 1 ;;
-  esac
-  # Not `$HOME/go` — that is GOPATH.
-  prefix="${HOME}/.local"
-  mkdir -p "${prefix}"
-  curl -fsSL "https://go.dev/dl/go${version}.linux-${arch}.tar.gz" | tar -C "${prefix}" -xz
-  export PATH="${prefix}/go/bin:${PATH}"
-fi
-go version
-
-echo "--- :package: fetch go-search-replace"
-.buildkite/fetch-search-replace.sh linux/amd64 linux/arm64
-
-VERSION="$(go run -mod=mod ./cmd/stamp-version)"
-COMMIT="$(git rev-parse --short HEAD 2>/dev/null || echo unknown)"
-
-build() {
-  local goarch="$1"
-  local out="dist/${BIN_BASE}-linux-${goarch}"
-  echo "--- :go: build linux/${goarch}"
-  CGO_ENABLED=0 GOOS=linux GOARCH="${goarch}" \
-    go build -buildvcs=false -trimpath \
-    -ldflags="-s -w -X github.com/Automattic/vip/internal/version.Version=${VERSION} -X github.com/Automattic/vip/internal/version.Commit=${COMMIT}" \
-    -o "${out}" ./cmd/vip-next
-}
-
-checksum() { shasum -a 256 "$1" > "$1.sha256"; }
-
-mkdir -p dist
-build amd64
-build arm64
-
-case "$(uname -m)" in
-  x86_64|amd64) native=amd64 ;;
-  aarch64|arm64) native=arm64 ;;
-  *) native="" ;;
-esac
-if [ -n "${native}" ]; then
-  echo "--- :test_tube: smoke linux/${native}"
-  "dist/${BIN_BASE}-linux-${native}" --version
-  "dist/${BIN_BASE}-linux-${native}" whoami --help
-fi
-
-for arch in amd64 arm64; do
-  bin="dist/${BIN_BASE}-linux-${arch}"
-  helper="third_party/go-search-replace/linux-${arch}/go-search-replace"
-  echo "--- :package: tarball linux/${arch}"
-  .buildkite/pack-release.sh linux "${arch}" "${bin}" "${helper}"
-  checksum "dist/${BIN_BASE}-linux-${arch}.tar.gz"
-  rm -f "${bin}"
-done
-

package/.buildkite/build-macos-installer.sh

@@ -1,34 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-# Package the already signed/notarized binaries from this build.
-[ -f .buildkite/shared-pipeline-vars ] && . .buildkite/shared-pipeline-vars
-: "${BIN_BASE:=vip-next}"
-
-if command -v install_gems >/dev/null 2>&1; then install_gems; else bundle install; fi
-if ! command -v go >/dev/null 2>&1; then brew install go; fi
-export GOFLAGS="${GOFLAGS:--mod=mod}"
-VERSION="$(go run -mod=mod ./cmd/stamp-version)"
-numeric_version="$(go run -mod=mod ./cmd/installer-version "$VERSION")"
-
-# This lane does not run in the binary job and never creates certificates.
-bundle exec fastlane configure_installer_signing
-stage="$(mktemp -d)"
-trap 'rm -rf "$stage"' EXIT
-buildkite-agent artifact download "dist/${BIN_BASE}-darwin-*.tar.gz*" "$stage" --step binaries-macos
-mkdir -p dist
-for arch in arm64 amd64; do
-  payload="$stage/$arch"
-  go run -mod=mod ./cmd/installer-payload darwin "$stage/dist/${BIN_BASE}-darwin-${arch}.tar.gz" "$payload"
-  bin="$payload/vip-next"
-  helper="$payload/go-search-replace"
-  bundle exec fastlane verify_code_signing binary:"$bin"
-  bundle exec fastlane verify_code_signing binary:"$helper"
-  pkg="dist/${BIN_BASE}-darwin-${arch}.pkg"
-  bash packaging/macos/build-pkg.sh "$VERSION" "$arch" "$bin" "$helper" "$pkg"
-  bundle exec fastlane sign_and_notarize_installer package:"$pkg"
-  python3 packaging/macos/verify-pkg.py "$pkg" "$numeric_version" "$arch" "$bin" "$helper"
-  shasum -a 256 "$pkg" > "$pkg.sha256"
-done
-# No automatic artifact_paths: failed/unsigned/partially verified packages must
-# never be uploaded by Buildkite's post-command hook.
-buildkite-agent artifact upload "dist/${BIN_BASE}-darwin-*.pkg;dist/${BIN_BASE}-darwin-*.pkg.sha256"

package/.buildkite/build-macos.sh

@@ -1,67 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-# Build, sign, and notarize portable macOS binary archives.
-# Native installers consume these archives in a separate downstream job.
-
-[ -f .buildkite/shared-pipeline-vars ] && . .buildkite/shared-pipeline-vars
-: "${BIN_BASE:=vip-next}"
-
-echo "--- :ruby: install gems"
-if command -v install_gems >/dev/null 2>&1; then install_gems; else bundle install; fi
-
-echo "--- :go: toolchain"
-if ! command -v go >/dev/null 2>&1; then
-  echo "--- :package: install go"
-  brew install go
-fi
-go version
-
-# Bundler installs to `vendor/bundle`, which makes Go take `-mod=vendor`.
-export GOFLAGS="${GOFLAGS:--mod=mod}"
-
-echo "--- :package: fetch go-search-replace"
-.buildkite/fetch-search-replace.sh darwin/arm64 darwin/amd64
-
-VERSION="$(go run -mod=mod ./cmd/stamp-version)"
-COMMIT="$(git rev-parse --short HEAD 2>/dev/null || echo unknown)"
-
-build() {
-  local goarch="$1"
-  local out="dist/${BIN_BASE}-darwin-${goarch}"
-  echo "--- :go: build darwin/${goarch}"
-  CGO_ENABLED=0 GOOS=darwin GOARCH="${goarch}" \
-    go build -buildvcs=false -trimpath \
-    -ldflags="-s -w -X github.com/Automattic/vip/internal/version.Version=${VERSION} -X github.com/Automattic/vip/internal/version.Commit=${COMMIT}" \
-    -o "${out}" ./cmd/vip-next
-}
-
-checksum() { shasum -a 256 "$1" > "$1.sha256"; }
-
-mkdir -p dist
-build arm64
-build amd64
-
-case "$(uname -m)" in
-  arm64) native=arm64 ;;
-  x86_64) native=amd64 ;;
-  *) native="" ;;
-esac
-if [ -n "${native}" ]; then
-  echo "--- :test_tube: smoke darwin/${native}"
-  "dist/${BIN_BASE}-darwin-${native}" --version
-  "dist/${BIN_BASE}-darwin-${native}" whoami --help
-fi
-
-echo "--- :closed_lock_with_key: fetch signing certs (fastlane match)"
-bundle exec fastlane configure_code_signing
-
-for arch in arm64 amd64; do
-  bin="dist/${BIN_BASE}-darwin-${arch}"
-  helper="third_party/go-search-replace/darwin-${arch}/go-search-replace"
-  echo "--- :closed_lock_with_key: sign and notarize darwin/${arch}"
-  bundle exec fastlane sign_and_notarize binary:"${bin}"
-  bundle exec fastlane sign_and_notarize binary:"${helper}"
-  .buildkite/pack-release.sh darwin "${arch}" "${bin}" "${helper}"
-  checksum "dist/${BIN_BASE}-darwin-${arch}.tar.gz"
-  rm -f "${bin}"
-done

package/.buildkite/build-windows-installer.ps1

@@ -1,65 +0,0 @@
-#Requires -Version 5.1
-# Consume the signed binaries from this build; installer failures are isolated.
-$ErrorActionPreference = 'Stop'
-$binBase = if ($env:BIN_BASE) { $env:BIN_BASE } else { 'vip-next' }
-
-# Any Go will do: go.mod's `toolchain` directive makes it fetch go1.27.0 itself.
-if (-not (Get-Command go -ErrorAction SilentlyContinue)) {
-  Write-Host "--- :package: install go"
-  choco install golang -y --no-progress
-  if ($LASTEXITCODE -ne 0) { throw 'choco install golang failed' }
-  # choco updates the machine PATH, not this process's.
-  $env:PATH = "$env:PATH;$env:ProgramFiles\Go\bin"
-}
-go version
-if ($LASTEXITCODE -ne 0) { throw 'go not usable after install' }
-
-$version = (& go run -mod=mod ./cmd/stamp-version | Out-String).Trim()
-if ($LASTEXITCODE -ne 0 -or -not $version) { throw 'stamp-version failed' }
-$stage = Join-Path ([System.IO.Path]::GetTempPath()) ([System.Guid]::NewGuid().ToString())
-New-Item -ItemType Directory -Path $stage | Out-Null
-try {
-  # Agent v3 stores Windows artifact paths with backslashes; v4 uses slashes.
-  # Match either prefix while retaining the exact upstream step and platform.
-  buildkite-agent artifact download "*$binBase-windows-amd64.tar.gz*" $stage --step binaries-windows
-  if ($LASTEXITCODE -ne 0) { throw 'binary artifact download failed' }
-  $payload = Join-Path $stage 'payload'
-  go run -mod=mod ./cmd/installer-payload windows "$stage/dist/$binBase-windows-amd64.tar.gz" $payload
-  if ($LASTEXITCODE -ne 0) { throw 'binary archive verification failed' }
-  $out = Join-Path $payload 'vip-next.exe'
-  $helper = Join-Path $payload 'go-search-replace.exe'
-  . "$PSScriptRoot/sign-windows.ps1"
-  foreach ($binary in @($out, $helper)) {
-    & $env:SIGNTOOL_PATH verify /pa /v $binary
-    if ($LASTEXITCODE -ne 0) { throw "binary signature verification failed: $binary" }
-  }
-  New-Item -ItemType Directory -Force -Path dist | Out-Null
-  Write-Host "--- :package: MSI"
-  $dotnet = Get-Command dotnet -ErrorAction SilentlyContinue
-  $dotnetMajor = 0
-  if ($dotnet) {
-    $dotnetVersion = (& $dotnet.Source --version | Out-String).Trim()
-    if ($LASTEXITCODE -eq 0 -and $dotnetVersion -match '^(\d+)\.') {
-      $dotnetMajor = [int]$Matches[1]
-    }
-  }
-  if ($dotnetMajor -lt 8) {
-    choco install dotnet-8.0-sdk -y --no-progress
-    if ($LASTEXITCODE -ne 0) { throw 'choco install dotnet-8.0-sdk failed' }
-    $env:PATH = "$env:PATH;$env:ProgramFiles\dotnet"
-  }
-
-  $msi = "dist/$binBase-windows-amd64.msi"
-  & ./packaging/windows/build-msi.ps1 -Version $version -CLI $out -Helper $helper -Output $msi
-  if ($LASTEXITCODE -ne 0) { throw 'build-msi.ps1 failed' }
-  Sign-File $msi
-  & ./packaging/windows/verify-msi.ps1 -MSI $msi -CLI $out -Helper $helper
-  if ($LASTEXITCODE -ne 0) { throw 'verify-msi.ps1 failed' }
-  $msiHash = (Get-FileHash -Algorithm SHA256 $msi).Hash.ToLower()
-  "$msiHash *$(Split-Path $msi -Leaf)" | Set-Content "$msi.sha256" -NoNewline -Encoding ascii
-  # Upload only after the signed MSI and its payload have passed verification.
-  buildkite-agent artifact upload "$msi;$msi.sha256"
-  if ($LASTEXITCODE -ne 0) { throw 'installer artifact upload failed' }
-} finally {
-  Remove-Item $stage -Recurse -Force
-}

package/.buildkite/build-windows.ps1

@@ -1,59 +0,0 @@
-#Requires -Version 5.1
-# Build and Authenticode-sign vip-next.exe on a Buildkite Windows agent.
-# Checksum is computed AFTER signing (signing changes the bytes).
-$ErrorActionPreference = 'Stop'
-
-$binBase = if ($env:BIN_BASE) { $env:BIN_BASE } else { 'vip-next' }
-
-function Get-GitOr($cmd, $fallback) {
-  try { $v = & git @cmd 2>$null; if ($LASTEXITCODE -eq 0 -and $v) { return $v.Trim() } } catch {}
-  return $fallback
-}
-
-New-Item -ItemType Directory -Force -Path dist | Out-Null
-$out = "dist/$binBase-windows-amd64.exe"
-
-# Any Go will do: go.mod's `toolchain` directive makes it fetch go1.27.0 itself.
-if (-not (Get-Command go -ErrorAction SilentlyContinue)) {
-  Write-Host "--- :package: install go"
-  choco install golang -y --no-progress
-  if ($LASTEXITCODE -ne 0) { throw 'choco install golang failed' }
-  # choco updates the machine PATH, not this process's.
-  $env:PATH = "$env:PATH;$env:ProgramFiles\Go\bin"
-}
-go version
-if ($LASTEXITCODE -ne 0) { throw 'go not usable after install' }
-
-$version = (& go run -mod=mod ./cmd/stamp-version | Out-String).Trim()
-if ($LASTEXITCODE -ne 0 -or -not $version) { throw 'stamp-version failed' }
-$commit = Get-GitOr @('rev-parse','--short','HEAD') 'unknown'
-
-Write-Host "--- :go: build windows/amd64"
-$env:CGO_ENABLED = '0'; $env:GOOS = 'windows'; $env:GOARCH = 'amd64'
-$ldflags = "-s -w -X github.com/Automattic/vip/internal/version.Version=$version -X github.com/Automattic/vip/internal/version.Commit=$commit"
-go build -buildvcs=false -trimpath -ldflags="$ldflags" -o $out ./cmd/vip-next
-if ($LASTEXITCODE -ne 0) { throw 'go build failed' }
-
-Write-Host "--- :test_tube: smoke"
-& $out --version
-& $out whoami --help
-
-Write-Host "--- :package: fetch go-search-replace"
-bash .buildkite/fetch-search-replace.sh windows/amd64
-if ($LASTEXITCODE -ne 0) { throw 'fetch-search-replace.sh failed' }
-$helper = 'third_party/go-search-replace/windows-amd64/go-search-replace.exe'
-
-. "$PSScriptRoot/sign-windows.ps1"
-
-Sign-File $out
-Sign-File $helper
-
-Write-Host "--- :package: tarball"
-$env:BIN_BASE = $binBase
-bash .buildkite/pack-release.sh windows amd64 $out $helper
-if ($LASTEXITCODE -ne 0) { throw 'pack-release.sh failed' }
-$tar = "dist/$binBase-windows-amd64.tar.gz"
-$hash = (Get-FileHash -Algorithm SHA256 $tar).Hash.ToLower()
-"$hash *$(Split-Path $tar -Leaf)" | Set-Content "$tar.sha256" -NoNewline
-
-Remove-Item $out -Force

package/.buildkite/fetch-search-replace.sh

@@ -1,65 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-# Fetch go-search-replace for each goos/goarch argument, verify against
-# third_party/go-search-replace/MANIFEST, install under that tree.
-# Usage: fetch-search-replace.sh darwin/arm64 darwin/amd64
-# No args: this host's GOOS/GOARCH.
-
-GSR_DIR=third_party/go-search-replace
-GSR_REPO=Automattic/go-search-replace
-
-sha256() {
-	if command -v shasum >/dev/null 2>&1; then
-		shasum -a 256 "$1" | awk '{ print $1 }'
-	else
-		sha256sum "$1" | awk '{ print $1 }'
-	fi
-}
-
-tag="$(awk '$1=="TAG"{print $2}' "${GSR_DIR}/MANIFEST")"
-[ -n "${tag}" ] || { echo "no TAG in ${GSR_DIR}/MANIFEST" >&2; exit 1; }
-
-if [ "$#" -eq 0 ]; then
-	set -- "$(go env GOOS)/$(go env GOARCH)"
-fi
-
-tmp="$(mktemp -d)"
-trap 'rm -rf "${tmp}"' EXIT
-
-for t in "$@"; do
-	os="${t%%/*}"
-	arch="${t##*/}"
-	want="$(awk -v k="${t}" '$1==k{print $2}' "${GSR_DIR}/MANIFEST")"
-	if [ -z "${want}" ]; then
-		echo "ERROR: ${t} is not pinned in ${GSR_DIR}/MANIFEST" >&2
-		exit 1
-	fi
-	name="go-search-replace_${os}_${arch}"
-	if [ "${os}" = windows ]; then
-		name="${name}.exe"
-	fi
-	url="https://github.com/${GSR_REPO}/releases/download/${tag}/${name}.gz"
-	echo "  fetching ${name} (${tag})"
-	if ! curl -fsSL "${url}" -o "${tmp}/${name}.gz"; then
-		echo "ERROR: could not download ${url}" >&2
-		exit 1
-	fi
-	gunzip -f "${tmp}/${name}.gz"
-	got="$(sha256 "${tmp}/${name}")"
-	if [ "${got}" != "${want}" ]; then
-		echo "ERROR: checksum mismatch for ${t}" >&2
-		echo "  expected (from upstream SLSA provenance): ${want}" >&2
-		echo "  got:                                      ${got}" >&2
-		echo "  Refusing to install. Do not bypass this." >&2
-		exit 1
-	fi
-	out="${GSR_DIR}/${os}-${arch}"
-	mkdir -p "${out}"
-	d="${out}/go-search-replace"
-	if [ "${os}" = windows ]; then
-		d="${d}.exe"
-	fi
-	mv "${tmp}/${name}" "${d}"
-	chmod +x "${d}"
-	echo "  verified + installed ${d}"
-done

package/.buildkite/pack-release.sh

@@ -1,26 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-# Pack vip-next + go-search-replace into dist/${BIN_BASE}-<os>-<arch>.tar.gz
-# Usage: pack-release.sh <goos> <goarch> <vip-next-path> <helper-path>
-
-: "${BIN_BASE:=vip-next}"
-
-os="${1:?}"
-arch="${2:?}"
-bin="${3:?}"
-helper="${4:?}"
-
-stage="$(mktemp -d)"
-trap 'rm -rf "${stage}"' EXIT
-
-if [ "${os}" = windows ]; then
-	cp "${bin}" "${stage}/vip-next.exe"
-	cp "${helper}" "${stage}/go-search-replace.exe"
-	chmod +x "${stage}/vip-next.exe" "${stage}/go-search-replace.exe"
-	tar -czf "dist/${BIN_BASE}-windows-${arch}.tar.gz" -C "${stage}" vip-next.exe go-search-replace.exe
-else
-	cp "${bin}" "${stage}/vip-next"
-	cp "${helper}" "${stage}/go-search-replace"
-	chmod +x "${stage}/vip-next" "${stage}/go-search-replace"
-	tar -czf "dist/${BIN_BASE}-${os}-${arch}.tar.gz" -C "${stage}" vip-next go-search-replace
-fi

package/.buildkite/pipeline.yml

@@ -1,81 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
----
-# Shared vars (CI_TOOLKIT_PLUGIN, BIN_BASE) come from
-# .buildkite/shared-pipeline-vars, which our setup source's before
-# `buildkite-agent pipeline upload` interpolates this file.
-#
-# Every commit builds + smoke-tests all three platforms. macOS signs and
-# notarizes, and Windows Authenticode-signs, on every build so those paths
-# are not tag-only.
-
-env:
-  DO_NOT_TRACK: '1'
-
-steps:
-  - label: ':macos: Build & sign (macOS)'
-    key: binaries-macos
-    command: .buildkite/build-macos.sh
-    plugins:
-      - $CI_TOOLKIT_PLUGIN
-    agents:
-      queue: mac
-    env:
-      IMAGE_ID: $IMAGE_ID
-    notify:
-      - github_commit_status:
-          context: 'Build & sign (macOS)'
-    artifact_paths:
-      - 'dist/vip-next-darwin-*.tar.gz*'
-
-  - label: ':windows: Build & sign (Windows)'
-    key: binaries-windows
-    command: powershell -NoProfile -ExecutionPolicy Bypass -File .buildkite/build-windows.ps1
-    plugins:
-      - $CI_TOOLKIT_PLUGIN
-    agents:
-      queue: windows
-    notify:
-      - github_commit_status:
-          context: 'Build & sign (Windows)'
-    artifact_paths:
-      - 'dist/vip-next-windows-amd64.tar.gz*'
-
-  - label: ':linux: Build (Linux)'
-    command: .buildkite/build-linux.sh
-    agents:
-      queue: default
-    notify:
-      - github_commit_status:
-          context: 'Build (Linux)'
-    artifact_paths:
-      - 'dist/vip-next-linux-*.tar.gz*'
-
-  # Installer failures remain visible but cannot fail the binary release build.
-  # Scripts explicitly upload only fully signed and verified installer pairs.
-  - label: ':macos: Package & sign installer (macOS)'
-    key: installer-macos
-    depends_on: binaries-macos
-    soft_fail: true
-    command: bash .buildkite/build-macos-installer.sh
-    plugins:
-      - $CI_TOOLKIT_PLUGIN
-    agents:
-      queue: mac
-    env:
-      IMAGE_ID: $IMAGE_ID
-    notify:
-      - github_commit_status:
-          context: 'Package & sign installer (macOS)'
-
-  - label: ':windows: Package & sign installer (Windows)'
-    key: installer-windows
-    depends_on: binaries-windows
-    soft_fail: true
-    command: powershell -NoProfile -ExecutionPolicy Bypass -File .buildkite/build-windows-installer.ps1
-    plugins:
-      - $CI_TOOLKIT_PLUGIN
-    agents:
-      queue: windows
-    notify:
-      - github_commit_status:
-          context: 'Package & sign installer (Windows)'

package/.buildkite/shared-pipeline-vars

@@ -1,16 +0,0 @@
-#!/bin/sh
-# This file is `source`'d before `buildkite-agent pipeline upload`, so the
-# variables below get interpolated into pipeline.yml before it is uploaded.
-# (Same mechanism as Automattic/download's .buildkite/shared-pipeline-vars.)
-
-# a8c CI toolkit Buildkite plugin — provides install_gems, secret injection, and
-# GitHub status helpers on the macOS agent.
-export CI_TOOLKIT_PLUGIN="automattic/a8c-ci-toolkit#6.3.0"
-
-export BIN_BASE="vip-next"
-
-# The macOS VM to run on. The `mac` queue's command hook aborts when IMAGE_ID is
-# unset, and the signing step needs `codesign` and `xcrun notarytool`
-# regardless of Go being the compiler.
-XCODE_VERSION=$(grep -Ev '^[[:space:]]*(#|$)' .xcode-version | head -n1 | sed -E 's/^[[:space:]]*//; s/^~> ?//; s/[[:space:]]*$//')
-export IMAGE_ID="xcode-$XCODE_VERSION"

package/.buildkite/sign-windows.ps1

@@ -1,21 +0,0 @@
-# Shared Azure setup and signing for independent binary and installer jobs.
-$ErrorActionPreference = 'Stop'
-
-Write-Host "--- :closed_lock_with_key: Azure Trusted Signing"
-$setupScript = (Get-Command setup_azure_trusted_signing.ps1 -ErrorAction Stop).Source
-& $setupScript
-if ($LASTEXITCODE -ne 0) { throw 'setup_azure_trusted_signing.ps1 failed' }
-
-function Sign-File([string]$path) {
-  Write-Host "--- :closed_lock_with_key: Authenticode sign $path"
-  & $env:SIGNTOOL_PATH sign /v `
-    /fd $env:AZURE_FILE_DIGEST `
-    /tr $env:AZURE_TIMESTAMP_SERVER `
-    /td $env:AZURE_TIMESTAMP_DIGEST `
-    /dlib $env:AZURE_CODE_SIGNING_DLIB `
-    /dmdf $env:AZURE_METADATA_JSON `
-    $path
-  if ($LASTEXITCODE -ne 0) { throw "signtool sign failed for $path" }
-  & $env:SIGNTOOL_PATH verify /pa /v $path
-  if ($LASTEXITCODE -ne 0) { throw "signtool verify failed for $path" }
-}