feat: publish av-tools 0.2.0

scripts/package-ffmpeg-source.mjs

@@ -18,6 +18,11 @@ import { createReadStream } from 'node:fs';
 
 const repositoryRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const lockPath = join(repositoryRoot, 'scripts', 'ffmpeg-source-lock.json');
+const reviewedLockPath = join(
+  repositoryRoot,
+  'scripts',
+  'reviewed-ffmpeg-core-lock.json'
+);
 const readmePath = join(repositoryRoot, 'scripts', 'ffmpeg-source-README.md');
 const releaseDirectory = join(repositoryRoot, 'release');
 const force = process.argv.includes('--force');
@@ -204,7 +209,19 @@ async function publishSourcePair({
 
 const lock = JSON.parse(await readFile(lockPath, 'utf8'));
 assertLock(lock);
-const archiveName = `ffmpeg-core-${lock.coreVersion}-corresponding-source.tar.xz`;
+const reviewedLock = JSON.parse(await readFile(reviewedLockPath, 'utf8'));
+if (
+  reviewedLock?.schemaVersion !== 1 ||
+  reviewedLock.coreVersion !== lock.coreVersion ||
+  typeof reviewedLock.buildId !== 'string' ||
+  !/^[a-zA-Z0-9._-]+$/u.test(reviewedLock.buildId) ||
+  !reviewedLock.buildId.startsWith(`${lock.coreVersion}-`)
+) {
+  throw new Error(
+    'The reviewed-core lock does not identify a build-qualified source bundle.'
+  );
+}
+const archiveName = `ffmpeg-core-${reviewedLock.buildId}-corresponding-source.tar.xz`;
 const archivePath = join(releaseDirectory, archiveName);
 const checksumPath = `${archivePath}.sha256`;
 await ensureReleaseDirectory();