From 92f78983295552eb808a3116ca35a26be2a8d6f5 Mon Sep 17 00:00:00 2001
From: Kayshen-X <kayshen_xu@163.com>
Date: Sat, 9 May 2026 21:04:00 +0800
Subject: [PATCH] build(step-1b): add tools/fetch-skia-artifact.sh (Variant A
 release path)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Codex P0 mini-gate Round 3 BLOCK fix: P0.2 plan calls for
tools/fetch-skia-artifact.sh, and Phase A CI step invokes it before
measuring bundle size — but the script did not exist in the OP repo.
Phase A cannot start without it.

Variant A (GitHub release asset) selected per probe notes §3.1
"Artifact Distribution Strategy": <1 MB gzip, free hosting, no extra
git-lfs setup overhead.

Behavior:
  exit 0  artifact present and SHA matches OR no release pinned yet
          (Phase E will publish; dev loop uses skia-bindings from-source)
  exit 1  artifact present but SHA mismatched, or fetch failed after
          a download attempt

Phase E will overwrite RELEASE_TAG / RELEASE_FILE / EXPECTED_SHA256
constants with the published release asset metadata. Until then dev
builds run skia-bindings from source (no fetch needed).

Smoke run: `bash tools/fetch-skia-artifact.sh` →
"no release tag pinned yet — Phase E will publish; dev builds use
skia-bindings from-source path" + exit 0.
---
 tools/fetch-skia-artifact.sh | 68 ++++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)
 create mode 100755 tools/fetch-skia-artifact.sh

diff --git a/tools/fetch-skia-artifact.sh b/tools/fetch-skia-artifact.sh
new file mode 100755
index 000000000..1d5cdcdb8
--- /dev/null
+++ b/tools/fetch-skia-artifact.sh
@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# tools/fetch-skia-artifact.sh — Variant A: GitHub release asset
+#
+# Fetches the Skia WASM static library selected by P0 §3.1 Artifact
+# Distribution Strategy (release asset hosting; rationale: <1 MB gzip,
+# free hosting, no extra git-lfs setup).
+#
+# The actual release asset is published in Phase E once the production
+# build pipeline lands; for Step 1b kickoff (Phase A onward) the dev
+# loop builds Skia from source via skia-bindings, so this script's
+# best-effort fetch is allowed to no-op when the release tag is absent.
+#
+# Exit semantics:
+#   0  vendor/skia-wasm/libskia-current.a is present and (when
+#      EXPECTED_SHA256 is set) matches the pinned hash; OR the artifact
+#      is absent and Phase A from-source build is the active path.
+#   1  artifact present but SHA mismatched, OR network/git-lfs failure
+#      after a download was attempted.
+#
+# Phase E will populate EXPECTED_SHA256 + RELEASE_TAG + RELEASE_FILE
+# constants below; until then the script logs and returns 0 so dev
+# builds keep working without a published release.
+
+set -euo pipefail
+
+DEST_DIR="vendor/skia-wasm"
+DEST="${DEST_DIR}/libskia-current.a"
+
+# Phase E will overwrite the next three constants with the published
+# release asset metadata. Empty string = "no release yet, fall through
+# to from-source build".
+RELEASE_TAG=""
+RELEASE_FILE=""
+EXPECTED_SHA256=""
+
+mkdir -p "$DEST_DIR"
+
+if [ -f "$DEST" ]; then
+  if [ -n "$EXPECTED_SHA256" ]; then
+    actual="$(shasum -a 256 "$DEST" | awk '{print $1}')"
+    if [ "$actual" = "$EXPECTED_SHA256" ]; then
+      echo "skia artifact present and SHA matches: $DEST"
+      exit 0
+    fi
+    echo "skia artifact SHA mismatch (have=$actual want=$EXPECTED_SHA256), re-fetching" >&2
+  else
+    echo "skia artifact present at $DEST (no SHA pin yet — Phase E will pin)"
+    exit 0
+  fi
+fi
+
+if [ -z "$RELEASE_TAG" ] || [ -z "$RELEASE_FILE" ]; then
+  echo "no release tag pinned yet — Phase E will publish; dev builds use skia-bindings from-source path"
+  exit 0
+fi
+
+RELEASE_URL="https://github.com/ZSeven-W/openpencil/releases/download/${RELEASE_TAG}/${RELEASE_FILE}"
+echo "fetching skia artifact: $RELEASE_URL"
+curl -fL "$RELEASE_URL" -o "$DEST"
+
+if [ -n "$EXPECTED_SHA256" ]; then
+  actual="$(shasum -a 256 "$DEST" | awk '{print $1}')"
+  if [ "$actual" != "$EXPECTED_SHA256" ]; then
+    echo "skia artifact SHA still mismatched after fetch: have=$actual want=$EXPECTED_SHA256" >&2
+    exit 1
+  fi
+fi
+echo "skia artifact fetched: $DEST"