chore: initial sanitized public snapshot

2026-07-18 14:04:26 +08:00
commit 7b3816441c
320 changed files with 76813 additions and 0 deletions
@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+stable_toolchain="${1:-1.88.0}"
+nightly_toolchain="${2:-nightly}"
+
+if ! command -v rustup >/dev/null 2>&1; then
+  curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+    | sh -s -- -y --profile minimal --default-toolchain none
+fi
+
+if [ -f "${HOME}/.cargo/env" ]; then
+  # shellcheck disable=SC1091
+  source "${HOME}/.cargo/env"
+fi
+command -v rustup >/dev/null 2>&1 || {
+  echo "rustup is required after bootstrap" >&2
+  exit 1
+}
+
+export RUSTUP_MAX_RETRIES="${RUSTUP_MAX_RETRIES:-3}"
+
+toolchain_is_installed() {
+  local requested="$1"
+  local installed
+
+  while read -r installed _; do
+    if [[ "${installed}" == "${requested}" || "${installed}" == "${requested}-"* ]]; then
+      return 0
+    fi
+  done < <(rustup toolchain list)
+
+  return 1
+}
+
+component_is_installed() {
+  local toolchain="$1"
+  local component="$2"
+
+  rustup component list --toolchain "${toolchain}" --installed \
+    | awk '{ print $1 }' \
+    | grep -Fxq "${component}"
+}
+
+ensure_toolchain() {
+  local toolchain="$1"
+  shift
+  local missing_components=()
+  local install_args=()
+  local component
+
+  if toolchain_is_installed "${toolchain}"; then
+    for component in "$@"; do
+      if ! component_is_installed "${toolchain}" "${component}"; then
+        missing_components+=("${component}")
+      fi
+    done
+
+    if [ "${#missing_components[@]}" -eq 0 ]; then
+      echo "rustup: reusing installed ${toolchain}"
+      return 0
+    fi
+
+    rustup component add --toolchain "${toolchain}" "${missing_components[@]}"
+    return 0
+  fi
+
+  for component in "$@"; do
+    install_args+=(--component "${component}")
+  done
+
+  rustup toolchain install "${toolchain}" --profile minimal "${install_args[@]}"
+}
+
+ensure_toolchain "${stable_toolchain}" rustfmt clippy rust-src
+if [ "${nightly_toolchain}" != "none" ]; then
+  ensure_toolchain "${nightly_toolchain}" rust-src
+fi
+rustup default "${stable_toolchain}"
+
+cargo --version
+rustc --version
+rustup show active-toolchain
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+readonly HEADER_PATTERN='^(feat|fix|perf|refactor|test|docs|build|ci|chore|revert)(\([[:alnum:]./_-]+\))?!?: .+$'
+
+is_conventional_header() {
+  [[ "$1" =~ ${HEADER_PATTERN} ]]
+}
+
+run_self_test() {
+  local subject
+
+  for subject in \
+    'feat(rpc): add request timeout' \
+    'fix!: preserve legacy config behavior' \
+    'docs(release): document versioning'; do
+    is_conventional_header "${subject}" || {
+      echo "expected valid Conventional Commit: ${subject}" >&2
+      exit 1
+    }
+  done
+
+  for subject in 'update dependency' 'feature: invalid type' 'fix missing separator'; do
+    if is_conventional_header "${subject}"; then
+      echo "expected invalid Conventional Commit: ${subject}" >&2
+      exit 1
+    fi
+  done
+}
+
+if [ "${1:-}" = "--self-test" ]; then
+  run_self_test
+  echo "Conventional Commit validator self-test passed"
+  exit 0
+fi
+
+baseline="${1:-v1.0.0}"
+git rev-parse --verify "${baseline}^{commit}" >/dev/null
+
+invalid=0
+while IFS=$'\t' read -r commit subject; do
+  if ! is_conventional_header "${subject}"; then
+    echo "${commit}: ${subject}" >&2
+    invalid=1
+  fi
+done < <(git log --format='%H%x09%s' --no-merges "${baseline}..HEAD")
+
+if [ "${invalid}" -ne 0 ]; then
+  echo "Conventional Commit validation failed after ${baseline}" >&2
+  exit 1
+fi
+
+echo "Conventional Commit validation passed after ${baseline}"
@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+mode="${1:-fast}"
+stable_toolchain="${2:-1.88.0}"
+nightly_toolchain="${3:-nightly}"
+nextest_version="${NEXTEST_VERSION:-0.9.114}"
+cargo_deny_version="${CARGO_DENY_VERSION:-0.19.8}"
+cargo_udeps_version="${CARGO_UDEPS_VERSION:-0.1.61}"
+git_cliff_version="${GIT_CLIFF_VERSION:-2.13.1}"
+cargo_semver_checks_version="${CARGO_SEMVER_CHECKS_VERSION:-0.44.0}"
+
+if [ -f "${HOME}/.cargo/env" ]; then
+  # shellcheck disable=SC1091
+  source "${HOME}/.cargo/env"
+fi
+command -v cargo >/dev/null 2>&1 || {
+  echo "cargo is required to install CI tools" >&2
+  exit 1
+}
+
+export CARGO_BUILD_JOBS="${CARGO_BUILD_JOBS:-1}"
+
+install_nextest() {
+  local cargo_home
+  cargo_home="${CARGO_HOME:-${HOME}/.cargo}"
+
+  if cargo nextest --version 2>/dev/null | grep -q " ${nextest_version}"; then
+    return
+  fi
+
+  curl -LsSf "https://get.nexte.st/${nextest_version}/linux" \
+    | tar zxf - -C "${cargo_home}/bin"
+}
+
+install_with_binary_fallback() {
+  local toolchain="$1"
+  local crate="$2"
+  shift 2
+
+  if command -v cargo-binstall >/dev/null 2>&1; then
+    cargo binstall -y "${crate}" "$@" && return
+  fi
+
+  cargo +"${toolchain}" install --locked --force --jobs "${CARGO_BUILD_JOBS}" "${crate}" "$@"
+}
+
+tool_has_version() {
+  local command_name="$1"
+  local expected_version="$2"
+
+  "${command_name}" --version 2>/dev/null | grep -q " ${expected_version}"
+}
+
+install_nextest
+
+if ! tool_has_version git-cliff "${git_cliff_version}"; then
+  install_with_binary_fallback "${stable_toolchain}" git-cliff --version "${git_cliff_version}"
+fi
+
+if [ "${mode}" = "strict" ]; then
+  if ! tool_has_version cargo-deny "${cargo_deny_version}"; then
+    install_with_binary_fallback "${stable_toolchain}" cargo-deny --version "${cargo_deny_version}"
+  fi
+  if ! cargo +"${nightly_toolchain}" udeps --version 2>/dev/null | grep -q " ${cargo_udeps_version}"; then
+    install_with_binary_fallback "${nightly_toolchain}" cargo-udeps --version "${cargo_udeps_version}"
+  fi
+  if ! tool_has_version cargo-semver-checks "${cargo_semver_checks_version}"; then
+    install_with_binary_fallback "${stable_toolchain}" cargo-semver-checks --version "${cargo_semver_checks_version}"
+  fi
+fi
+
+cargo nextest --version
+git-cliff --version
+
+if [ "${mode}" = "strict" ]; then
+  cargo deny --version
+  cargo +"${nightly_toolchain}" udeps --version
+  cargo semver-checks --version
+fi
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+export DEBIAN_FRONTEND=noninteractive
+
+missing=()
+for command_name in cc curl git jq pkg-config xz; do
+  if ! command -v "${command_name}" >/dev/null 2>&1; then
+    missing+=("${command_name}")
+  fi
+done
+if command -v pkg-config >/dev/null 2>&1; then
+  for package_name in libssh2 openssl zlib; do
+    if ! pkg-config --exists "${package_name}"; then
+      missing+=("pkg-config:${package_name}")
+    fi
+  done
+fi
+
+if [ "${#missing[@]}" -eq 0 ]; then
+  echo "Linux build dependencies are already available"
+  exit 0
+fi
+
+if [ "$(id -u)" -ne 0 ]; then
+  printf 'missing Linux build dependencies: %s\n' "${missing[*]}" >&2
+  echo "run this CI job as root or bake the missing dependencies into the runner image" >&2
+  exit 1
+fi
+
+apt-get update
+apt-get install -y --no-install-recommends \
+  build-essential \
+  ca-certificates \
+  curl \
+  git \
+  jq \
+  libssh2-1-dev \
+  libssl-dev \
+  pkg-config \
+  xz-utils \
+  zlib1g-dev
+rm -rf /var/lib/apt/lists/*
@@ -0,0 +1,167 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+require_env() {
+  local name="$1"
+  if [ -z "${!name:-}" ]; then
+    echo "missing required environment variable: ${name}" >&2
+    exit 1
+  fi
+}
+
+require_env GITEA_SERVER_URL
+require_env GITEA_REPOSITORY
+require_env GITEA_TOKEN
+require_env RELEASE_TAG
+require_env RELEASE_NAME
+require_env RELEASE_VERSION
+require_env RELEASE_TARGET
+
+server="${GITEA_SERVER_URL%/}"
+repo="${GITEA_REPOSITORY}"
+tag="${RELEASE_TAG}"
+name="${RELEASE_NAME}"
+version="${RELEASE_VERSION}"
+target="${RELEASE_TARGET}"
+draft="${RELEASE_DRAFT:-false}"
+prerelease="${RELEASE_PRERELEASE:-false}"
+notes_file="${RELEASE_BODY_FILE:-}"
+
+if [ -z "${notes_file}" ]; then
+  echo "missing required environment variable: RELEASE_BODY_FILE" >&2
+  exit 1
+fi
+if [ ! -f "${notes_file}" ]; then
+  echo "release body file does not exist: ${notes_file}" >&2
+  exit 1
+fi
+body="$(cat "${notes_file}")"
+
+asset_name_for() {
+  local family="$1"
+  local file="$2"
+  local base_name
+  base_name="$(basename "${file}")"
+
+  if [ "${base_name}" = "SHA256SUMS.txt" ]; then
+    printf '%s-SHA256SUMS.txt' "${family}"
+  else
+    printf '%s' "${base_name}"
+  fi
+}
+
+release_dir="dist/release/v${version}"
+docker_dir="dist/docker/v${version}"
+
+declare -a asset_files=()
+declare -a asset_names=()
+
+if [ -d "${release_dir}" ]; then
+  while IFS= read -r -d '' file; do
+    asset_files+=("${file}")
+    asset_names+=("$(asset_name_for release "${file}")")
+  done < <(find "${release_dir}" -maxdepth 1 -type f -print0 | sort -z)
+fi
+
+if [ -d "${docker_dir}" ]; then
+  while IFS= read -r -d '' file; do
+    asset_files+=("${file}")
+    asset_names+=("$(asset_name_for docker "${file}")")
+  done < <(find "${docker_dir}" -maxdepth 1 -type f -print0 | sort -z)
+fi
+
+if [ "${#asset_files[@]}" -eq 0 ]; then
+  echo "no release assets found under ${release_dir} or ${docker_dir}" >&2
+  exit 1
+fi
+
+api_base="${server}/api/v1/repos/${repo}"
+auth_header="Authorization: token ${GITEA_TOKEN}"
+accept_header="Accept: application/json"
+curl_args=(-sS)
+
+if [ "${GITEA_CURL_INSECURE:-false}" = "true" ]; then
+  curl_args+=(-k)
+fi
+
+release_lookup="$(mktemp)"
+release_payload="$(mktemp)"
+trap 'rm -f "${release_lookup}" "${release_payload}"' EXIT
+
+lookup_status="$(
+  curl "${curl_args[@]}" -o "${release_lookup}" -w '%{http_code}' \
+    -H "${auth_header}" \
+    -H "${accept_header}" \
+    "${api_base}/releases/tags/${tag}"
+)"
+
+printf '%s' "${body}" | jq -Rs \
+  --arg tag "${tag}" \
+  --arg name "${name}" \
+  --arg target "${target}" \
+  --argjson draft "${draft}" \
+  --argjson prerelease "${prerelease}" \
+  '{tag_name:$tag,name:$name,target_commitish:$target,body:.,draft:$draft,prerelease:$prerelease}' \
+  > "${release_payload}"
+
+if [ "${lookup_status}" = "200" ]; then
+  release_id="$(jq -r '.id' "${release_lookup}")"
+  curl -f "${curl_args[@]}" \
+    -X PATCH \
+    -H "${auth_header}" \
+    -H "${accept_header}" \
+    -H 'Content-Type: application/json' \
+    --data @"${release_payload}" \
+    "${api_base}/releases/${release_id}" \
+    > "${release_lookup}"
+elif [ "${lookup_status}" = "404" ]; then
+  curl -f "${curl_args[@]}" \
+    -X POST \
+    -H "${auth_header}" \
+    -H "${accept_header}" \
+    -H 'Content-Type: application/json' \
+    --data @"${release_payload}" \
+    "${api_base}/releases" \
+    > "${release_lookup}"
+  release_id="$(jq -r '.id' "${release_lookup}")"
+else
+  echo "failed to look up release ${tag}: Gitea returned HTTP ${lookup_status}" >&2
+  cat "${release_lookup}" >&2
+  exit 1
+fi
+
+release_id="${release_id:-$(jq -r '.id' "${release_lookup}")}"
+
+for index in "${!asset_files[@]}"; do
+  file="${asset_files[${index}]}"
+  asset_name="${asset_names[${index}]}"
+  existing_asset_id="$(
+    jq -r --arg name "${asset_name}" '.assets[]? | select(.name == $name) | .id' "${release_lookup}" \
+      | head -n 1
+  )"
+
+  if [ -n "${existing_asset_id}" ] && [ "${existing_asset_id}" != "null" ]; then
+    curl -f "${curl_args[@]}" \
+      -X DELETE \
+      -H "${auth_header}" \
+      -H "${accept_header}" \
+      "${api_base}/releases/${release_id}/assets/${existing_asset_id}" \
+      >/dev/null
+  fi
+
+  encoded_name="$(python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1]))' "${asset_name}")"
+
+  curl -f "${curl_args[@]}" \
+    -X POST \
+    -H "${auth_header}" \
+    -H "${accept_header}" \
+    -F "attachment=@${file}" \
+    "${api_base}/releases/${release_id}/assets?name=${encoded_name}" \
+    >/dev/null
+done
+
+release_url="$(jq -r '.html_url // empty' "${release_lookup}")"
+echo "Published release ${name} (${tag})"
+if [ -n "${release_url}" ]; then
+  echo "Release URL: ${release_url}"
+fi
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ -f "${HOME}/.cargo/env" ]; then
+  # shellcheck disable=SC1091
+  source "${HOME}/.cargo/env"
+fi
+command -v cargo >/dev/null 2>&1 || {
+  echo "cargo is required to run fast gates" >&2
+  exit 1
+}
+
+cargo fmt --all --check
+cargo check --workspace --all-targets --all-features --locked
+cargo nextest run --workspace --all-targets --all-features --locked
+# `clippy::cargo` spawns nested `cargo metadata` from clippy-driver. On the
+# NAS runner this can wait behind the parent cargo/clippy target lock; keep
+# dependency policy in strict gates via cargo-deny and cargo-udeps instead.
+cargo clippy --workspace --all-targets --all-features --locked --no-deps -- \
+  -D warnings \
+  -D clippy::pedantic \
+  -D clippy::nursery
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+release_type() {
+  local current="${1#v}"
+  local baseline="${2#v}"
+  local current_major current_minor baseline_major baseline_minor
+
+  IFS='.' read -r current_major current_minor _ <<< "${current}"
+  IFS='.' read -r baseline_major baseline_minor _ <<< "${baseline}"
+
+  if [ "${current_major}" != "${baseline_major}" ]; then
+    printf '%s\n' major
+  elif [ "${current_minor}" != "${baseline_minor}" ]; then
+    printf '%s\n' minor
+  else
+    printf '%s\n' patch
+  fi
+}
+
+run_self_test() {
+  [ "$(release_type v2.0.0 v1.9.9)" = major ]
+  [ "$(release_type v1.3.0 v1.2.9)" = minor ]
+  [ "$(release_type v1.2.4 v1.2.3)" = patch ]
+}
+
+if [ "${1:-}" = "--self-test" ]; then
+  run_self_test
+  echo "SemVer release-type self-test passed"
+  exit 0
+fi
+
+release_tag="${1:?release tag is required}"
+git rev-parse --verify "${release_tag}^{commit}" >/dev/null
+
+baseline_tag="$({ git tag --merged "${release_tag}" --sort=-version:refname | grep -Fxv "${release_tag}" || true; } | head -n 1)"
+if [ -z "${baseline_tag}" ]; then
+  echo "No earlier SemVer tag before ${release_tag}; skipping baseline comparison"
+  exit 0
+fi
+
+release_kind="$(release_type "${release_tag}" "${baseline_tag}")"
+for package in \
+  aria2-rust-pro-cli \
+  aria2-rust-pro-compat \
+  aria2-rust-pro-core \
+  aria2-rust-pro-protocol \
+  aria2-rust-pro-rpc \
+  aria2-rust-pro-storage; do
+  cargo semver-checks check-release \
+    --package "${package}" \
+    --baseline-rev "${baseline_tag}" \
+    --release-type "${release_kind}"
+done
@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ -f "${HOME}/.cargo/env" ]; then
+  # shellcheck disable=SC1091
+  source "${HOME}/.cargo/env"
+fi
+command -v cargo >/dev/null 2>&1 || {
+  echo "cargo is required to run strict gates" >&2
+  exit 1
+}
+
+# cargo-udeps injects sysroot crates on nightly; let udeps report real unused deps.
+nightly_toolchain="${CARGO_NIGHTLY_TOOLCHAIN:-nightly}"
+RUSTFLAGS="-A unused-crate-dependencies" cargo +"${nightly_toolchain}" udeps --workspace --all-targets --all-features --locked
+
+deny_db_path="${CARGO_DENY_DB_PATH:-target/cargo-deny-advisory-dbs}"
+deny_config="${CARGO_DENY_CONFIG:-deny.toml}"
+mkdir -p "${deny_db_path}"
+
+cargo_deny() {
+  case "$(uname -s 2>/dev/null || echo unknown)" in
+    MINGW* | MSYS* | CYGWIN*)
+      GIT_CONFIG_COUNT=1 \
+      GIT_CONFIG_KEY_0=http.sslbackend \
+      GIT_CONFIG_VALUE_0=openssl \
+        cargo deny "$@"
+      ;;
+    *)
+      cargo deny "$@"
+      ;;
+  esac
+}
+
+dump_deny_db_state() {
+  echo "cargo deny version: $(cargo deny --version 2>/dev/null || true)" >&2
+  echo "git version: $(git --version 2>/dev/null || true)" >&2
+  echo "cargo deny db path: ${deny_db_path}" >&2
+  if [ -d "${deny_db_path}" ]; then
+    find "${deny_db_path}" -maxdepth 2 -type d -print >&2
+  else
+    echo "cargo deny db path does not exist" >&2
+  fi
+}
+
+fetch_deny_db() {
+  cargo_deny fetch db --config "${deny_config}"
+}
+
+if ! fetch_deny_db; then
+  dump_deny_db_state
+  echo "retrying cargo deny advisory DB fetch after clearing ${deny_db_path}" >&2
+  rm -rf "${deny_db_path}"
+  mkdir -p "${deny_db_path}"
+  if ! fetch_deny_db; then
+    dump_deny_db_state
+    exit 1
+  fi
+fi
+if ! find "${deny_db_path}" -mindepth 1 -maxdepth 1 -type d -name 'advisory-db-*' | grep -q .; then
+  echo "cargo deny did not populate advisory DB under ${deny_db_path}" >&2
+  dump_deny_db_state
+  exit 1
+fi
+
+cargo_deny --locked check --disable-fetch --config "${deny_config}"
+
+cargo run --manifest-path ./xtask/Cargo.toml -- release smoke-version --build
+cargo run --manifest-path ./xtask/Cargo.toml -- docker smoke-local
+command -v docker >/dev/null 2>&1 || {
+  echo "docker CLI is required for daemon-backed Docker smoke tests" >&2
+  exit 1
+}
+docker info >/dev/null 2>&1 || {
+  echo "docker daemon is required for daemon-backed Docker smoke tests" >&2
+  echo "attach a Docker-capable runner or split this gate to a Docker runner label" >&2
+  exit 1
+}
+cargo run --manifest-path ./xtask/Cargo.toml -- docker smoke --tag aria2-rust-pro:ci-smoke