fix(release): use built minimald when packing initramfs - #623

scripts/fetch-artifact.sh (1)

41-49: 🎯 Functional Correctness | 🔵 Trivial | 💤 Low value

Validation only checks executable bit, not regular-file type.

[ -x "$MIP" ] also returns true for an executable/searchable directory. If $MIP is misconfigured to point at a directory, the check passes and the failure only surfaces later at "$MIP" materialize ... with a less clear error. Since MIP is CI-controlled input and the downstream failure is still explicit, this is a minor edge case.

🛡️ Optional tightening

-  [ -x "$MIP" ] || { echo "MIP not an executable file: $MIP" >&2; exit 1; }
+  [ -f "$MIP" ] && [ -x "$MIP" ] || { echo "MIP not an executable file: $MIP" >&2; exit 1; }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/fetch-artifact.sh` around lines 41 - 49, The MIP validation in
fetch-artifact.sh only checks executability, so a directory can still pass and
fail later in the materialize step. Tighten the existing MIP branch by
validating that $MIP is a regular executable file before using it, keeping the
check near the current [ -x "$MIP" ] guard and preserving the same fallback
build-from-source path when MIP is unset.

scripts/fetch-libkrun.sh (1)

44-52: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Duplicated MIP-resolution logic across both fetch scripts.

This block (comment + conditional) is identical to the one in scripts/fetch-artifact.sh (lines 41-49). Consider extracting a small shared helper (e.g. scripts/lib/resolve-mip.sh, sourced by both) to avoid drift if the fallback/validation logic changes later.

♻️ Example extraction

# scripts/lib/resolve-mip.sh
resolve_mip() {
  if [ -n "${MIP:-}" ]; then
    [ -x "$MIP" ] || { echo "MIP not an executable file: $MIP" >&2; exit 1; }
  else
    cargo build -p mip
    MIP="$ROOT/target/debug/mip"
  fi
}

Then in each script:

-if [ -n "${MIP:-}" ]; then
-  [ -x "$MIP" ] || { echo "MIP not an executable file: $MIP" >&2; exit 1; }
-else
-  cargo build -p mip
-  MIP="$ROOT/target/debug/mip"
-fi
+. "$ROOT/scripts/lib/resolve-mip.sh"
+resolve_mip

Same -x vs -f note as flagged in fetch-artifact.sh also applies here.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/fetch-libkrun.sh` around lines 44 - 52, The MIP resolution block in
fetch-libkrun.sh duplicates the same fallback/validation logic used by
fetch-artifact.sh, so extract it into a shared helper such as resolve_mip in a
sourced script under scripts/lib and have both scripts call that helper instead.
While refactoring, keep the existing executable check in the MIP branch (the
same -x validation used in the current MIP handling) so the behavior stays
consistent and doesn’t drift between the two scripts.