fix(release): 完成分发证明代际绑定与质量门禁收口

scripts/check-doc-status.sh

@@ -144,18 +144,28 @@ require_contains "docs/reference/rpc-backend-api.md" "localized_release_status"
 require_contains "docs/reference/rpc-backend-api.md" "official_distribution_ready"
 require_contains "docs/reference/rpc-backend-api.md" "release.attestation"
 require_contains "docs/reference/rpc-backend-api.md" "expected_manifest_identity"
+require_contains "docs/reference/rpc-backend-api.md" "expected_verification_generation"
 require_contains "docs/architecture/resource-release-layout.md" "release.attestation"
 
 require_contains "Makefile" "check-docs:"
+require_contains "Makefile" "check-go-format:"
 require_contains "Makefile" "format: fmt"
 require_contains "Makefile" "ci-check:"
 require_contains "Makefile" "ci: ci-check"
 require_file "scripts/ci-check.sh"
+require_file "scripts/check-go-format.sh"
 require_file "scripts/ci-versions.sh"
 require_contains "scripts/ci-check.sh" "RUN required:"
+require_contains "scripts/ci-check.sh" "make check-go-format"
 require_contains "scripts/ci-check.sh" "Go lint version"
 require_contains "scripts/ci-check.sh" "GOLANGCI_LINT_VERSION"
 require_contains "scripts/ci-versions.sh" 'GOLANGCI_LINT_VERSION="2.12.2"'
+require_contains "docs/guides/development.md" "golangci-lint --version"
+require_contains "docs/guides/development.md" "required gate"
+if grep -RIEq --exclude=check-doc-status.sh --exclude-dir=.git --exclude-dir=archive --exclude-dir=historical \
+  -- '可选 lint|optional lint|optional golangci-lint' .; then
+  fail "current documentation still describes Go lint as optional"
+fi
 if grep -Fq "ci: fmt" Makefile; then
   fail "Makefile ci target must not run the mutating fmt target"
 fi
@@ -164,6 +174,7 @@ require_contains ".gitea/workflows/bat.yml" "make test-go-api"
 require_contains ".gitea/workflows/bat.yml" "go vet ./internal/api/... ./internal/backendrpc/... ./cmd/bat-api/..."
 require_contains ".gitea/workflows/bat.yml" "go build -o /tmp/bat-api ./cmd/bat-api"
 require_contains ".gitea/workflows/bat.yml" "Check Go formatting"
+require_contains ".gitea/workflows/bat.yml" "make check-go-format"
 require_contains ".gitea/workflows/bat.yml" "Required Go lint"
 require_contains ".gitea/workflows/bat.yml" "source scripts/ci-versions.sh"
 require_contains "Makefile" "cargo clippy --workspace --all-targets -- -D warnings"

scripts/check-go-format.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "${repo_root}"
+
+: "${GOCACHE:=/tmp/bat-go-cache}"
+export GOCACHE
+
+mapfile -t go_dirs < <(go list -f '{{.Dir}}' ./...)
+go_files=()
+for dir in "${go_dirs[@]}"; do
+  while IFS= read -r -d '' file; do
+    go_files+=("${file}")
+  done < <(find "${dir}" -maxdepth 1 -type f -name '*.go' -print0)
+done
+
+if ((${#go_files[@]} == 0)); then
+  exit 0
+fi
+
+formatted="$(gofmt -l "${go_files[@]}")"
+if [[ -n "${formatted}" ]]; then
+  printf 'gofmt required; files need formatting:\n%s\n' "${formatted}" >&2
+  exit 1
+fi

scripts/ci-check.sh

@@ -20,34 +20,8 @@ run_required() {
   printf 'PASS required: %s\n' "${name}"
 }
 
-check_gofmt() {
-  local -a go_dirs=()
-  local -a go_files=()
-  local dir file formatted dirs_file
-  dirs_file="$(mktemp)"
-  if ! go list -f '{{.Dir}}' ./... >"${dirs_file}"; then
-    rm -f "${dirs_file}"
-    return 1
-  fi
-  mapfile -t go_dirs <"${dirs_file}"
-  rm -f "${dirs_file}"
-  for dir in "${go_dirs[@]}"; do
-    for file in "${dir}"/*.go; do
-      [[ -f "${file}" ]] && go_files+=("${file}")
-    done
-  done
-  if ((${#go_files[@]} == 0)); then
-    return
-  fi
-  formatted="$(gofmt -l "${go_files[@]}")"
-  if [[ -n "${formatted}" ]]; then
-    printf 'gofmt required; files need formatting:\n%s\n' "${formatted}" >&2
-    return 1
-  fi
-}
-
 run_required "Rust formatting" cargo fmt --all -- --check
-run_required "Go formatting" check_gofmt
+run_required "Go formatting" make check-go-format
 run_required "Rust check" cargo check --workspace --locked
 run_required "Rust release build" cargo build --workspace --release --locked
 run_required "Rust clippy" cargo clippy --workspace --all-targets --locked -- -D warnings