fix(release):完善当前分发证明与质量门禁

scripts/check-doc-status.sh

@@ -142,15 +142,20 @@ require_contains "docs/reference/rpc-backend-api.md" "daemon.restart"
 require_contains "docs/reference/rpc-backend-api.md" "daemon.clean-stable"
 require_contains "docs/reference/rpc-backend-api.md" "localized_release_status"
 require_contains "docs/reference/rpc-backend-api.md" "official_distribution_ready"
-require_contains "docs/architecture/resource-release-layout.md" "release.status"
+require_contains "docs/reference/rpc-backend-api.md" "release.attestation"
+require_contains "docs/reference/rpc-backend-api.md" "expected_manifest_identity"
+require_contains "docs/architecture/resource-release-layout.md" "release.attestation"
 
 require_contains "Makefile" "check-docs:"
 require_contains "Makefile" "format: fmt"
 require_contains "Makefile" "ci-check:"
 require_contains "Makefile" "ci: ci-check"
 require_file "scripts/ci-check.sh"
+require_file "scripts/ci-versions.sh"
 require_contains "scripts/ci-check.sh" "RUN required:"
-require_contains "scripts/ci-check.sh" "SKIP optional:"
+require_contains "scripts/ci-check.sh" "Go lint version"
+require_contains "scripts/ci-check.sh" "GOLANGCI_LINT_VERSION"
+require_contains "scripts/ci-versions.sh" 'GOLANGCI_LINT_VERSION="2.12.2"'
 if grep -Fq "ci: fmt" Makefile; then
   fail "Makefile ci target must not run the mutating fmt target"
 fi
@@ -159,7 +164,8 @@ require_contains ".gitea/workflows/bat.yml" "make test-go-api"
 require_contains ".gitea/workflows/bat.yml" "go vet ./internal/api/... ./internal/backendrpc/... ./cmd/bat-api/..."
 require_contains ".gitea/workflows/bat.yml" "go build -o /tmp/bat-api ./cmd/bat-api"
 require_contains ".gitea/workflows/bat.yml" "Check Go formatting"
-require_contains ".gitea/workflows/bat.yml" "SKIP optional: Go lint"
+require_contains ".gitea/workflows/bat.yml" "Required Go lint"
+require_contains ".gitea/workflows/bat.yml" "source scripts/ci-versions.sh"
 require_contains "Makefile" "cargo clippy --workspace --all-targets -- -D warnings"
 
 openapi_tmp="$(mktemp)"

scripts/ci-check.sh

@@ -9,6 +9,9 @@ export GOCACHE
 : "${XDG_CACHE_HOME:=/tmp/bat-xdg-cache}"
 export XDG_CACHE_HOME
 
+source "${repo_root}/scripts/ci-versions.sh"
+export GOLANGCI_LINT_VERSION
+
 run_required() {
   local name="$1"
   shift
@@ -52,24 +55,18 @@ run_required "Rust tests" cargo test --workspace --locked
 run_required "Go API tests" go test ./internal/api/... ./internal/backendrpc/... ./cmd/bat-api/...
 run_required "Go API vet" go vet ./internal/api/... ./internal/backendrpc/... ./cmd/bat-api/...
 run_required "Go API build" go build -o /tmp/bat-api ./cmd/bat-api
+run_required "Go lint version" bash -c '
+  source scripts/ci-versions.sh
+  command -v golangci-lint >/dev/null 2>&1 ||
+    { printf "golangci-lint %s is required but not installed\n" "${GOLANGCI_LINT_VERSION}" >&2; exit 1; }
+  actual="$(golangci_lint_actual_version)"
+  if [[ "${actual}" != "${GOLANGCI_LINT_VERSION}" ]]; then
+    printf "golangci-lint version mismatch: required=%s actual=%s\n" \
+      "${GOLANGCI_LINT_VERSION}" "${actual:-unknown}" >&2
+    exit 1
+  fi
+'
+run_required "Go lint" golangci-lint run ./...
 run_required "Documentation, OpenAPI, and contract checks" make check-docs
 
-optional_failed=0
-if command -v golangci-lint >/dev/null 2>&1; then
-  printf 'RUN optional: Go lint (golangci-lint)\n'
-  if golangci-lint run ./...; then
-    printf 'PASS optional: Go lint (golangci-lint)\n'
-  else
-    printf 'FAIL optional: Go lint (golangci-lint); reason=lint findings\n' >&2
-    optional_failed=1
-  fi
-else
-  printf 'SKIP optional: Go lint (golangci-lint); reason=command not installed\n'
-fi
-
-if ((optional_failed)); then
-  printf 'required check-only gates passed; optional gates failed\n' >&2
-  exit 1
-fi
-
-printf 'required check-only gates passed; optional gates are reported above\n'
+printf 'all required check-only gates passed\n'

scripts/ci-versions.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+# Canonical versions for required local and Gitea CI tools.
+GOLANGCI_LINT_VERSION="2.12.2"
+
+golangci_lint_actual_version() {
+  golangci-lint version 2>/dev/null |
+    sed -n 's/.*has version \([^ ]*\).*/\1/p'
+}