ci: all-platform node binaries in the signed release manifest; signed SHA256SUMS for the archives; web build once before the parallel backend builds; release 0.3.3 [CI SKIP]

ci/tests/binary-hashes-test.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# release-binary-hashes.sh 的测试：用本地的假 Gitea 包仓库（python http.server），造 8 个平台的压缩包（tar.gz 和 zip），
+# 核对脚本算出来的哈希就是压缩包里可执行文件的 SHA-256。运行：bash ci/tests/binary-hashes-test.sh
+set -eu
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+T="$(mktemp -d)"
+SERVER=
+trap '[ -z "$SERVER" ] || kill "$SERVER" 2>/dev/null || true; rm -rf "$T" 2>/dev/null || true' EXIT
+V=9.9.9
+PKG="$T/srv/api/packages/justme/generic/moshiro-node/$V"
+mkdir -p "$PKG"
+fail=0
+expected=()
+for component in agent probe; do
+  for target in linux-amd64 linux-arm64 linux-musl-amd64 linux-musl-arm64 macos-x64 macos-arm64 windows-amd64 windows-arm64; do
+    stage="$T/stage-$component-$target"; mkdir -p "$stage"
+    if [[ "$target" == windows-* ]]; then member="moshiro-$component.exe"; else member="moshiro-$component"; fi
+    printf 'binary of %s for %s\n' "$component" "$target" > "$stage/$member"
+    printf 'noise' > "$stage/fleet-enroll"; printf 'readme' > "$stage/README.md"
+    if [[ "$target" == windows-* ]]; then
+      (cd "$stage" && python3 -c "import zipfile,sys; z=zipfile.ZipFile('out.zip','w'); [z.write(n) for n in sys.argv[1:]]" "$member" fleet-enroll README.md && mv out.zip "$PKG/moshiro-$component-v$V-$target.zip")
+    else
+      tar -czf "$PKG/moshiro-$component-v$V-$target.tar.gz" -C "$stage" "$member" fleet-enroll README.md
+    fi
+    [[ "$component" == agent ]] && expected+=("$(sha256sum "$stage/$member" | cut -d' ' -f1)")
+  done
+done
+want="$(printf '%s\n' "${expected[@]}" | sort -u | paste -sd,)"
+
+(cd "$T/srv" && python3 -u -m http.server 0 --bind 127.0.0.1 >"$T/server.log" 2>&1 & echo $! > "$T/pid")
+SERVER="$(cat "$T/pid")"
+for _ in $(seq 1 50); do port="$(grep -o 'port [0-9]*' "$T/server.log" | head -1 | cut -d' ' -f2 || true)"; [[ -n "$port" ]] && break; sleep 0.2; done
+[[ -n "${port:-}" ]] || { echo "FAIL the fake package server did not start"; cat "$T/server.log"; exit 1; }
+
+got="$(GITEA_BASE="http://127.0.0.1:$port" bash "$ROOT/ci/release-binary-hashes.sh" agent "$V")"
+if [[ "$got" == "$want" ]]; then echo "ok   agent: all 8 platform binaries hashed ($(echo "$got" | tr ',' '\n' | wc -l) distinct)"; else echo "FAIL agent hashes differ"; echo " want $want"; echo " got  $got"; fail=1; fi
+[[ "$(echo "$got" | tr ',' '\n' | wc -l)" -eq 8 ]] && echo "ok   eight different binaries, none dropped" || { echo "FAIL expected 8 hashes"; fail=1; }
+
+# 缺一个平台的压缩包：整个脚本失败，不能悄悄少签一个
+rm "$PKG/moshiro-probe-v$V-macos-arm64.tar.gz"
+if GITEA_BASE="http://127.0.0.1:$port" bash "$ROOT/ci/release-binary-hashes.sh" probe "$V" >/dev/null 2>&1; then echo "FAIL a missing archive was ignored"; fail=1; else echo "ok   a missing archive fails the script instead of signing fewer binaries"; fi
+if bash "$ROOT/ci/release-binary-hashes.sh" other "$V" >/dev/null 2>&1; then echo "FAIL unknown component accepted"; fail=1; else echo "ok   unknown component is refused"; fi
+exit "$fail"