Init repo

deploy/scripts/write-release-manifest.mjs

@@ -0,0 +1,30 @@
+import { readFileSync } from 'node:fs';
+
+function requireEnv(name) {
+  const value = process.env[name];
+  if (!value) {
+    throw new Error(`${name} is required`);
+  }
+  return value;
+}
+
+function readJson(path) {
+  return JSON.parse(readFileSync(path, 'utf8'));
+}
+
+const smoke = readJson(requireEnv('SMOKE_RESULT_PATH'));
+
+const manifest = {
+  commitSha: requireEnv('COMMIT_SHA'),
+  releaseId: requireEnv('RELEASE_ID'),
+  webImageDigest: requireEnv('WEB_IMAGE_DIGEST'),
+  deployTimestamp: new Date().toISOString(),
+  smokeResult: smoke,
+  workflowRunId: requireEnv('WORKFLOW_RUN_ID'),
+};
+
+if (!/@sha256:[a-f0-9]{64}$/i.test(manifest.webImageDigest)) {
+  throw new Error('webImageDigest must be digest-pinned');
+}
+
+console.log(JSON.stringify(manifest, null, 2));