release: v0.1.1192

.github/actions/setup-deno/action.yml

@@ -61,46 +61,105 @@ runs:
         esac
 
         archive="deno-${arch_target}-${os_target}.zip"
-        case "${arch_target}-${os_target}" in
-          x86_64-unknown-linux-gnu)
-            archive_sha256="0cd918870657ccc3d96ac682290e894dda374e2a742424aae9118b258a6cf7a3"
-            ;;
-          aarch64-unknown-linux-gnu)
-            archive_sha256="e654ef4b41d8f1369dfe7d69374c8f226660153d077e0ac25353d454e03ef798"
-            ;;
-          x86_64-apple-darwin)
-            archive_sha256="2ca88d69c369a2757f17fce7c21d979f04cf56a6990d1f3858bd80b0487d0b74"
-            ;;
-          aarch64-apple-darwin)
-            archive_sha256="5f0ef47e706ecdae5e6248e33bf367340b1d86f87886f60419fe7450f6ffc39a"
-            ;;
-          x86_64-pc-windows-msvc)
-            archive_sha256="dcb4aa0a87a1e0e3a096692d27443bd2496e9204b327150fb01b31984255c3aa"
-            ;;
-          aarch64-pc-windows-msvc)
-            archive_sha256="5693b3107fa22476f007bdb61f0157f16870edd56a636b95eccfdcbec9c82db6"
-            ;;
-          *) echo "Missing Deno archive checksum for ${arch_target}-${os_target}" >&2; exit 1 ;;
-        esac
-
         deno_dir="${RUNNER_TEMP}/deno-${version}-${arch_target}-${os_target}"
         deno_bin="${deno_dir}/${deno_exe}"
         if [ ! -x "${deno_bin}" ]; then
           mkdir -p "${deno_dir}"
           zip_path="${deno_dir}/deno.zip"
-          curl --fail --location --show-error --retry 5 --retry-delay 2 \
+          checksums_manifest_path="${deno_dir}/checksums.txt"
+          checksums_manifest_sha256="0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5"
+          archive_checksum_path="${deno_dir}/archive-checksum.txt"
+          checksums_manifest_downloaded="false"
+
+          if ! curl --fail --location --show-error --retry 5 --retry-delay 2 \
+            --retry-max-time 120 \
+            --remove-on-error \
+            --connect-timeout 20 --max-time 120 \
+            "https://github.com/denoland/deno/releases/download/v${version}/${archive}.sha256sum" \
+            --output "${archive_checksum_path}"; then
+            if ! curl --fail --location --show-error --retry 5 --retry-delay 2 \
+              --retry-max-time 120 \
+              --remove-on-error \
+              --connect-timeout 20 --max-time 120 \
+              "https://github.com/denoland/deno/releases/download/v${version}/checksums.txt" \
+              --output "${checksums_manifest_path}"; then
+              echo "Failed to download checksums manifest for v${version}" >&2
+              exit 1
+            fi
+            checksum_parse_path="${checksums_manifest_path}"
+            checksums_manifest_downloaded="true"
+          else
+            checksum_parse_path="${archive_checksum_path}"
+            if curl --fail --location --show-error --retry 5 --retry-delay 2 \
+              --retry-max-time 120 \
+              --remove-on-error \
+              --connect-timeout 20 --max-time 120 \
+              "https://github.com/denoland/deno/releases/download/v${version}/checksums.txt" \
+              --output "${checksums_manifest_path}"; then
+              checksums_manifest_downloaded="true"
+            fi
+          fi
+
+          if [ "${checksums_manifest_downloaded}" = "true" ] && [ -n "${checksums_manifest_sha256}" ]; then
+            if command -v sha256sum >/dev/null 2>&1; then
+              checksums_manifest_actual_sha256="$(sha256sum "${checksums_manifest_path}" | awk '{print $1}')"
+            elif command -v shasum >/dev/null 2>&1; then
+              checksums_manifest_actual_sha256="$(shasum -a 256 "${checksums_manifest_path}" | awk '{print $1}')"
+            elif command -v openssl >/dev/null 2>&1; then
+              checksums_manifest_actual_sha256="$(openssl dgst -sha256 "${checksums_manifest_path}" | awk '{print $NF}')"
+            elif command -v node >/dev/null 2>&1; then
+              checksums_manifest_actual_sha256="$(node -e "const fs = require('fs'); const crypto = require('crypto'); process.stdout.write(crypto.createHash('sha256').update(fs.readFileSync(process.argv[1])).digest('hex')" "${checksums_manifest_path}")"
+            else
+              echo "No checksum utility available (sha256sum/shasum/openssl/node)" >&2
+              exit 1
+            fi
+            if [ "${checksums_manifest_actual_sha256}" != "${checksums_manifest_sha256}" ]; then
+              echo "Checksums manifest checksum mismatch for v${version}" >&2
+              echo "Expected: ${checksums_manifest_sha256}" >&2
+              echo "Actual:   ${checksums_manifest_actual_sha256}" >&2
+              exit 1
+            fi
+          fi
+
+          if [ "${checksums_manifest_downloaded}" = "true" ]; then
+            checksum_parse_path="${checksums_manifest_path}"
+          fi
+
+          if ! curl --fail --location --show-error --retry 5 --retry-delay 2 \
             --retry-max-time 120 \
             --remove-on-error \
             --connect-timeout 20 --max-time 120 \
             "https://github.com/denoland/deno/releases/download/v${version}/${archive}" \
-            --output "${zip_path}"
+            --output "${zip_path}"; then
+            echo "Failed to download Deno archive for ${archive}" >&2
+            exit 1
+          fi
 
-          case "${os}" in
-            Darwin) actual_sha256="$(shasum -a 256 "${zip_path}" | awk '{print $1}')" ;;
-            *) actual_sha256="$(sha256sum "${zip_path}" | awk '{print $1}')" ;;
-          esac
+          archive_sha256="$(awk 'BEGIN {IGNORECASE = 1} /^Hash[[:space:]]*:/ { print tolower($3) }' "${checksum_parse_path}")"
+          if [ -z "${archive_sha256}" ]; then
+            archive_sha256="$(awk -v target="${archive}" '$2 == target || $2 == "*" target { print tolower($1) }' "${checksum_parse_path}")"
+          fi
+          if [ -z "${archive_sha256}" ]; then
+            echo "Missing Deno archive checksum for ${archive} in release checksums for v${version}" >&2
+            exit 1
+          fi
+
+          if command -v sha256sum >/dev/null 2>&1; then
+            actual_sha256="$(sha256sum "${zip_path}" | awk '{print $1}')"
+          elif command -v shasum >/dev/null 2>&1; then
+            actual_sha256="$(shasum -a 256 "${zip_path}" | awk '{print $1}')"
+          elif command -v openssl >/dev/null 2>&1; then
+            actual_sha256="$(openssl dgst -sha256 "${zip_path}" | awk '{print $NF}')"
+          elif command -v node >/dev/null 2>&1; then
+            actual_sha256="$(node -e "const fs = require('fs'); const crypto = require('crypto'); process.stdout.write(crypto.createHash('sha256').update(fs.readFileSync(process.argv[1])).digest('hex')" "${zip_path}")"
+          else
+            echo "No checksum utility available (sha256sum/shasum/openssl/node)" >&2
+            exit 1
+          fi
           if [ "${actual_sha256}" != "${archive_sha256}" ]; then
             echo "Deno archive checksum mismatch for ${archive}" >&2
+            echo "Expected: ${archive_sha256}" >&2
+            echo "Actual:   ${actual_sha256}" >&2
             exit 1
           fi
 

.github/workflows/cicd.yml

@@ -71,6 +71,8 @@ jobs:
         with:
           node-version: "24"
           package-manager-cache: false
+      - name: Install Node resolver test dependencies
+        run: npm install --no-save esbuild@0.28.1 ajv@8.18.0 ajv-formats@3.0.1 zod@4.3.6 es-module-lexer@2.3.1 react@19.2.4 react-dom@19.2.4
       - name: Run Node cache-link compatibility tests
         run: node ./tests/node/run-tests.mjs 'src/utils/cache-dir.test.ts'
       - uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0

deno.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.1191",
+  "version": "0.1.1192",
   "license": "Apache-2.0",
   "nodeModulesDir": "auto",
   "minimumDependencyAge": {

scripts/ci/setup-deno-workflow.test.ts

@@ -196,15 +196,58 @@ describe("setup-deno CI contract", () => {
     assertStringIncludes(install, "--retry-max-time 120");
     assertStringIncludes(install, "--remove-on-error");
     assertMatch(install, /--connect-timeout\s+20\s+--max-time\s+120/);
-    assertEquals(
-      install.match(/archive_sha256="[0-9a-f]{64}"/g)?.length,
-      6,
-      "every supported Deno archive must have a pinned SHA-256 digest",
+    assertStringIncludes(
+      install,
+      "https://github.com/denoland/deno/releases/download/v${version}/${archive}.sha256sum",
+    );
+    assertStringIncludes(
+      install,
+      "https://github.com/denoland/deno/releases/download/v${version}/checksums.txt",
+    );
+    assertStringIncludes(
+      install,
+      'checksum_parse_path="${checksums_manifest_path}"',
+    );
+    assertStringIncludes(
+      install,
+      'checksums_manifest_actual_sha256="$(sha256sum "${checksums_manifest_path}" | awk',
+    );
+    assertStringIncludes(
+      install,
+      'checksums_manifest_actual_sha256="$(shasum -a 256 "${checksums_manifest_path}" | awk',
+    );
+    assertStringIncludes(
+      install,
+      'checksums_manifest_actual_sha256="$(openssl dgst -sha256 "${checksums_manifest_path}" | awk',
+    );
+    assertStringIncludes(
+      install,
+      'checksums_manifest_actual_sha256="$(node -e "const fs = require(\'fs\'); const crypto = require(\'crypto\'); process.stdout.write(crypto.createHash(\'sha256\').update(fs.readFileSync(process.argv[1])).digest(\'hex\')" "${checksums_manifest_path}")"',
+    );
+    assertStringIncludes(
+      install,
+      'if [ "${checksums_manifest_downloaded}" = "true" ]; then',
+    );
+    assertStringIncludes(
+      install,
+      'if [ "${checksums_manifest_actual_sha256}" != "${checksums_manifest_sha256}" ]',
+    );
+    assertStringIncludes(
+      install,
+      'archive_sha256="$(awk \'BEGIN {IGNORECASE = 1} /^Hash[[:space:]]*:/ { print tolower($3) }\' "${checksum_parse_path}")"',
+    );
+    assertStringIncludes(
+      install,
+      'archive_sha256="$(awk -v target="${archive}" \'$2 == target || $2 == "\*" target { print tolower($1) }\' "${checksum_parse_path}")"',
     );
     assertStringIncludes(
       install,
       'if [ "${actual_sha256}" != "${archive_sha256}" ]',
     );
+    assertStringIncludes(
+      install,
+      'if [ -z "${archive_sha256}" ]; then',
+    );
     assertEquals(
       /\bnpm\b/.test(install),
       false,

src/utils/version-constant.ts

@@ -1,4 +1,4 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
 /** Shared version value. */
-export const VERSION = "0.1.1191";
+export const VERSION = "0.1.1192";