Prove clean native release artifacts (#106)

tools/ci-matrix/src/main.rs

@@ -1,6 +1,7 @@
 use metacrate_ci_matrix::{
-    audit, audit_api_surface, audit_dependencies, audit_documentation, audit_provenance, load, run,
-    workspace_root, write_api_baseline, write_documentation_report, write_provenance_reports,
+    audit, audit_api_surface, audit_artifacts, audit_dependencies, audit_documentation,
+    audit_provenance, load, run, workspace_root, write_api_baseline, write_documentation_report,
+    write_provenance_reports,
 };
 use std::path::{Path, PathBuf};
 
@@ -49,6 +50,9 @@ fn execute() -> Result<(), Box<dyn std::error::Error>> {
             audit_dependencies(&root, &evidence)?;
             println!("dependency policy: ok ({})", evidence.display());
         }
+        Some("artifact-audit") => {
+            artifact_audit_command(&root, arguments)?;
+        }
         Some("documentation-report") if arguments.next().is_none() => {
             write_documentation_report(&root)?;
             println!("documentation coverage report: updated");
@@ -94,7 +98,7 @@ fn execute() -> Result<(), Box<dyn std::error::Error>> {
         }
         _ => {
             return Err(
-                "usage: ci-matrix audit | run PROFILE --evidence FILE | dependency-audit --evidence FILE | documentation-report | documentation-audit --evidence FILE | api-baseline-write | api-audit --evidence FILE | provenance-report | provenance-audit --evidence FILE"
+                "usage: ci-matrix audit | run PROFILE --evidence FILE | dependency-audit --evidence FILE | artifact-audit --artifact-dir DIR --package-dir DIR --evidence FILE | documentation-report | documentation-audit --evidence FILE | api-baseline-write | api-audit --evidence FILE | provenance-report | provenance-audit --evidence FILE"
                     .into(),
             );
         }
@@ -102,6 +106,42 @@ fn execute() -> Result<(), Box<dyn std::error::Error>> {
     Ok(())
 }
 
+fn artifact_audit_command(
+    root: &Path,
+    mut arguments: impl Iterator<Item = String>,
+) -> Result<(), Box<dyn std::error::Error>> {
+    let artifact_dir = option(&mut arguments, "--artifact-dir")?;
+    let package_dir = option(&mut arguments, "--package-dir")?;
+    let evidence = option(&mut arguments, "--evidence")?;
+    if arguments.next().is_some() {
+        return Err(
+            "usage: ci-matrix artifact-audit --artifact-dir DIR --package-dir DIR --evidence FILE"
+                .into(),
+        );
+    }
+    let artifact_dir = absolute_or_rooted(root, &artifact_dir);
+    let package_dir = absolute_or_rooted(root, &package_dir);
+    let evidence = absolute_or_rooted(root, &evidence);
+    audit_artifacts(root, &artifact_dir, &package_dir, &evidence)?;
+    println!("native release artifacts: ok ({})", evidence.display());
+    Ok(())
+}
+
+fn option(
+    arguments: &mut impl Iterator<Item = String>,
+    expected: &str,
+) -> Result<String, Box<dyn std::error::Error>> {
+    let flag = arguments
+        .next()
+        .ok_or_else(|| format!("missing {expected}"))?;
+    if flag != expected {
+        return Err(format!("expected {expected}, found {flag}").into());
+    }
+    arguments
+        .next()
+        .ok_or_else(|| format!("missing value for {expected}").into())
+}
+
 fn provenance_audit_command(
     root: &Path,
     mut arguments: impl Iterator<Item = String>,