mirror of
https://github.com/danderson1988/visual-notes.git
synced 2026-07-22 08:30:17 +00:00
45c51c8e48
Three releases (1.0.13, 1.0.16, 1.0.17) failed Obsidian's review with "attestation exists but signature is invalid or does not match this repository" despite trying attest-build-provenance v1, v2, and actions/attest v4. Decoding the actual published bundles via the attestations API shows they are well-formed sigstore v0.3 bundles whose Fulcio certificates correctly identify this repo and workflow — the verification failure is on the checker's side and not fixable from here. Since a present-but-unverifiable attestation is a review Error while a missing one is only a Recommendation, the attest step is removed (comment in the workflow explains why, so it doesn't get re-added blindly). Attestations are permanent and keyed by file digest, and source didn't change across 1.0.13-1.0.17, so the old broken attestations still cover the current main.js/styles.css bytes. To escape them: - esbuild now emits a version-stamped banner comment in main.js (also makes installed copies identifiable) - styles.css header comment gains the repo URL Verified via the API that the new digests have zero attestations.
57 lines
1.6 KiB
JavaScript
57 lines
1.6 KiB
JavaScript
import esbuild from "esbuild";
|
|
import process from "process";
|
|
import { builtinModules } from "module";
|
|
import { readFileSync } from "fs";
|
|
|
|
const prod = process.argv[2] === "production";
|
|
const manifest = JSON.parse(readFileSync("./manifest.json", "utf8"));
|
|
|
|
const context = await esbuild.context({
|
|
entryPoints: ["src/main.ts"],
|
|
bundle: true,
|
|
banner: {
|
|
js: `/* Visual Notes v${manifest.version} — bundled file, do not edit. Source: https://github.com/danderson1988/visual-notes */`,
|
|
},
|
|
external: [
|
|
"obsidian",
|
|
"electron",
|
|
"@codemirror/autocomplete",
|
|
"@codemirror/collab",
|
|
"@codemirror/commands",
|
|
"@codemirror/language",
|
|
"@codemirror/lint",
|
|
"@codemirror/search",
|
|
"@codemirror/state",
|
|
"@codemirror/view",
|
|
"@lezer/common",
|
|
"@lezer/highlight",
|
|
"@lezer/lr",
|
|
...builtinModules,
|
|
],
|
|
format: "cjs",
|
|
target: "es2018",
|
|
logLevel: "info",
|
|
sourcemap: prod ? false : "inline",
|
|
treeShaking: true,
|
|
outfile: "main.js",
|
|
// Bundled UI images live in assets/ and get imported directly in source
|
|
// (e.g. `import icon from '../assets/icon.png'`) — esbuild inlines them as
|
|
// base64 data URIs right into main.js, so they ship with the plugin
|
|
// regardless of install method (community browser, manual 3-file copy,
|
|
// etc.) rather than needing a separate assets folder to be present.
|
|
loader: {
|
|
".png": "dataurl",
|
|
".jpg": "dataurl",
|
|
".jpeg": "dataurl",
|
|
".gif": "dataurl",
|
|
".svg": "dataurl",
|
|
".webp": "dataurl",
|
|
},
|
|
});
|
|
|
|
if (prod) {
|
|
await context.rebuild();
|
|
process.exit(0);
|
|
} else {
|
|
await context.watch();
|
|
}
|