build: pin toolchain via make bootstrap + tool-versions/preflight (repo-local .tools/)

Make targets now resolve a repo-local, gitignored .tools/bin (Hugo extended 0.167.0, Node 22.11.0, lychee 0.24.2) via a recipe-scoped PATH, so machines with old/missing tools can no longer produce error-127 mysteries or version drift. System PATH is never touched. make bootstrap one-time idempotent install (sha256-verified Hugo) make tool-versions pinned vs PATH-first diagnostic table make preflight strict check, wired ahead of build/serve/serve-lan
2026-10-12 22:53:03 -06:00
parent cfaab13e45
commit be9c92f6d2
4 changed files with 197 additions and 5 deletions
@@ -0,0 +1,69 @@
+#!/bin/sh
+# Install the pinned toolchain into the repo-local .tools/bin (gitignored):
+#   hugo extended 0.167.0, node 22.11.0 (provides npx/npm), lychee 0.24.2
+# Idempotent: a tool already present at the pinned version is skipped, so
+# re-running with everything installed is an instant no-op. Touches nothing
+# outside .tools/ and never modifies your system PATH.
+# Requires: curl, tar, sha256sum, and network on first run.
+set -eu
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+BIN="$ROOT/.tools/bin"
+TMP=$(mktemp -d)
+trap 'rm -rf "$TMP"' EXIT
+
+HUGO_VERSION=0.167.0
+HUGO_SHA256=0163f5c3deddac1f494a1629ddc40c65d18de9d5794facd98f7f96ac2c7d8957
+NODE_VERSION=22.11.0
+LYCHEE_VERSION=0.24.2
+
+case "$(uname -s)/$(uname -m)" in
+  Linux/x86_64)  HARCH=amd64;  NARCH=x64;   RARCH=x86_64 ;;
+  Linux/aarch64) HARCH=arm64;  NARCH=arm64; RARCH=aarch64 ;;
+  *) echo "bootstrap: unsupported platform $(uname -s) $(uname -m) (Linux x86_64/aarch64 only)" >&2; exit 1 ;;
+esac
+
+command -v curl >/dev/null 2>&1 || { echo "bootstrap: curl is required (downloads the pinned tarballs)" >&2; exit 1; }
+
+mkdir -p "$BIN"
+
+# --- hugo extended ---
+# Release builds report "v<ver>-<40-hex-commit>+extended"; strip the commit so
+# the pinned comparison is exact.
+hugo_norm() { "$1" version 2>/dev/null | awk '{print $2}' | sed 's/-[0-9a-f]\{40,\}//'; }
+if [ -x "$BIN/hugo" ] && [ "$(hugo_norm "$BIN/hugo")" = "v$HUGO_VERSION+extended" ]; then
+  echo "hugo v$HUGO_VERSION+extended: present, skipping"
+else
+  echo "hugo v$HUGO_VERSION+extended: downloading..."
+  curl -fsSL -o "$TMP/h.tgz" \
+    "https://github.com/gohugoio/hugo/releases/download/v$HUGO_VERSION/hugo_extended_${HUGO_VERSION}_linux-${HARCH}.tar.gz"
+  echo "$HUGO_SHA256  $TMP/h.tgz" | sha256sum -c -
+  tar xzf "$TMP/h.tgz" -C "$TMP"
+  install -m 0755 "$TMP/hugo" "$BIN/hugo"
+fi
+
+# --- node (+ npm/npx) ---
+if [ -x "$BIN/node" ] && [ "$("$BIN/node" --version 2>/dev/null)" = "v$NODE_VERSION" ]; then
+  echo "node v$NODE_VERSION: present, skipping"
+else
+  echo "node v$NODE_VERSION: downloading..."
+  curl -fsSL -o "$TMP/n.tar.xz" \
+    "https://nodejs.org/dist/v$NODE_VERSION/node-v${NODE_VERSION}-linux-${NARCH}.tar.xz"
+  rm -rf "$ROOT"/.tools/node-v*-linux-*
+  tar xJf "$TMP/n.tar.xz" -C "$ROOT/.tools"
+  for t in node npm npx; do
+    ln -sfn "../node-v${NODE_VERSION}-linux-${NARCH}/bin/$t" "$BIN/$t"
+  done
+fi
+
+# --- lychee ---
+if [ -x "$BIN/lychee" ] && "$BIN/lychee" --version 2>/dev/null | grep -q "$LYCHEE_VERSION"; then
+  echo "lychee $LYCHEE_VERSION: present, skipping"
+else
+  echo "lychee $LYCHEE_VERSION: downloading..."
+  curl -fsSL -o "$TMP/l.tgz" \
+    "https://github.com/lycheeverse/lychee/releases/download/lychee-v$LYCHEE_VERSION/lychee-${RARCH}-unknown-linux-musl.tar.gz"
+  tar xzf "$TMP/l.tgz" -C "$TMP"
+  install -m 0755 "$TMP/lychee-${RARCH}-unknown-linux-musl/lychee" "$BIN/lychee"
+fi
+
+echo "OK: pinned toolchain ready in $BIN   (verify with: make tool-versions)"