up

scripts/api-changelog.mjs

@@ -1,12 +1,14 @@
 #!/usr/bin/env node
 import fs from 'node:fs';
 import path from 'node:path';
+import crypto from 'node:crypto';
 import yaml from 'yaml';
 
 const ROOT = path.resolve('src/Api/StellaOps.Api.OpenApi');
 const BASELINE = path.join(ROOT, 'baselines', 'stella-baseline.yaml');
 const CURRENT = path.join(ROOT, 'stella.yaml');
 const OUTPUT = path.join(ROOT, 'CHANGELOG.md');
+const RELEASE_OUT = path.resolve('src/Sdk/StellaOps.Sdk.Release/out/api-changelog');
 
 function panic(message) {
   console.error(`[api:changelog] ${message}`);
@@ -76,6 +78,25 @@ function renderMarkdown(diff) {
   return lines.join('\n');
 }
 
+function ensureReleaseDir() {
+  fs.mkdirSync(RELEASE_OUT, { recursive: true });
+}
+
+function sha256(content) {
+  return crypto.createHash('sha256').update(content).digest('hex');
+}
+
+function signDigest(digest) {
+  const key = process.env.API_CHANGELOG_SIGNING_KEY;
+  if (!key) {
+    return null;
+  }
+
+  const hmac = crypto.createHmac('sha256', Buffer.from(key, 'utf8'));
+  hmac.update(digest);
+  return hmac.digest('hex');
+}
+
 function main() {
   if (!fs.existsSync(BASELINE)) {
     console.log('[api:changelog] baseline missing; skipping');
@@ -85,6 +106,24 @@ function main() {
   const markdown = renderMarkdown(diff);
   fs.writeFileSync(OUTPUT, markdown, 'utf8');
   console.log(`[api:changelog] wrote changelog to ${OUTPUT}`);
+
+  ensureReleaseDir();
+  const releaseChangelog = path.join(RELEASE_OUT, 'CHANGELOG.md');
+  fs.writeFileSync(releaseChangelog, markdown, 'utf8');
+
+  const digest = sha256(markdown);
+  const digestFile = path.join(RELEASE_OUT, 'CHANGELOG.sha256');
+  fs.writeFileSync(digestFile, `${digest}  CHANGELOG.md\n`, 'utf8');
+
+  const signature = signDigest(digest);
+  if (signature) {
+    fs.writeFileSync(path.join(RELEASE_OUT, 'CHANGELOG.sig'), signature, 'utf8');
+    console.log('[api:changelog] wrote signature for release artifact');
+  } else {
+    console.log('[api:changelog] signature skipped (API_CHANGELOG_SIGNING_KEY not set)');
+  }
+
+  console.log(`[api:changelog] copied changelog + digest to ${RELEASE_OUT}`);
 }
 
 main();