build: publish development stripped and minified artifacts

[wesley-dean]

Summary

Add a three-flavor Bootstrap build and release model:

• dist/bootstrap.dev.bash - fully assembled source with comments intact
• dist/bootstrap.bash - ordinary/default artifact with full-line comments stripped
• dist/bootstrap.min.bash - stripped artifact processed by Bash-Minifier
• one .256 SHA-256 checksum companion for each executable

A successful make build now produces all six files.

Bash-Minifier dependency

Bash-Minifier is managed through the existing ADR-051 bashdeps boundary rather than new direct Make download logic.

The manifest pins:

• repository: Zuzzuc/Bash-minifier
• commit: 9c824e20815a5bca2153ec25ecc02a4edea1430e
• upstream file: Minify.sh
• local destination: vendor/bash-minifier.bash
• SHA-256: 93cb422360db4cc410d19b068eb074da020a4a743f0eebc9c442d1e5acd90e9b

The upstream file is MIT licensed. The dependency is build-time tooling only and is not embedded as runtime tooling.

Build boundary

make build remains network-free and non-repairing. It now requires already-prepared vendor/bash-minifier.bash and fails with guidance when that dependency is absent.

A fresh checkout therefore uses either:

make all

or:

make deps
make build

make all retains explicit deps -> build ordering under ADR-051.

Artifact lineage

The build assembles the full ordered project source once as bootstrap.dev.bash. The ordinary bootstrap.bash is derived from that complete artifact by removing full-line comments while preserving the shebang. bootstrap.min.bash is then derived from the complete stripped artifact through the pinned Bash-Minifier.

This means source originating in every Bootstrap library follows the same comment-stripping and minification path as the entry point.

Testing

The Make test runner applies the complete Bats behavior suite to all three executable flavors. make test-report emits separate JUnit files for development, stripped, and minified output so CI can identify flavor-specific regressions.

Build/dependency regression coverage verifies:

• plain make build does not acquire a missing Bash-Minifier dependency;
• prepared minifier state produces all six expected files;
• all three scripts are executable;
• all three .256 files verify their corresponding bytes;
• the development artifact retains the generated comment header;
• the ordinary artifact removes that full-line comment;
• Bash-Minifier receives the stripped artifact as input;
• all three artifacts remain functional after vendor state is removed; and
• make all synchronizes dependencies before building every flavor.

The Test workflow additionally verifies the real commit-pinned Bash-Minifier dependency, byte-drift detection/convergence, checksum validity, and that the real minified output differs from the stripped output.

Releases

The release workflow now publishes and attests all six files:

bootstrap.dev.bash
bootstrap.bash
bootstrap.min.bash
bootstrap.dev.bash.256
bootstrap.bash.256
bootstrap.min.bash.256

bootstrap.bash remains the conventional/default filename so existing consumers and download URLs remain compatible.

Architecture and documentation

ADR-052 records the three-flavor build decision and partially supersedes the single-artifact portions of ADR-009 and ADR-010 plus the repository-specific ADR-051 statement that a clean make build needs no vendor state. The general ADR-051 network and dependency boundaries remain intact.

README, AGENTS.md, testing guidance, release-verification guidance, and the ADR index are updated accordingly.

CI also exposed an existing documentation-runner prerequisite: the current Doxyfile invokes Graphviz dot, while the Test and Pages workflows installed Doxygen without Graphviz. Both Doxygen runners now install Graphviz explicitly; this is the only change outside the requested build/minification surface.

Validation

On the current PR head:

• the network-free build boundary passes: a fresh make build fails clearly when Bash-Minifier is absent and does not create dependency state;
• real make deps and offline make deps-check pass with the commit-pinned Bash-Minifier bytes;
• fresh make all succeeds;
• all three executable artifacts and all three .256 files are created and their checksums verify;
• tampered Bash-Minifier bytes are rejected by deps-check and reconverged by explicit make deps;
• Doxygen generation and clean-tree validation pass after making the existing Graphviz dependency explicit;
• static checks pass;
• the complete Bats suite passes independently against development, stripped, and minified artifacts;
• all three artifacts execute successfully after deleting vendor/;
• APT, APK, and DNF end-to-end jobs pass, each after the new six-artifact make all build path;
• CodeQL passes; and
• final diff review confirms there are no src/ or lib/ runtime implementation changes.

MegaLinter is still running on the current head at the time of this update.

Scope

No src/ or lib/ runtime implementation files are changed. The PR is restricted to build/dependency machinery, artifact tests, CI/release behavior, and documentation of those processes, plus the Graphviz prerequisite correction described above.

[github-actions]

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ BASH	shellcheck	24		0	0	1.06s
✅ REPOSITORY	betterleaks	yes		no	no	1.71s
✅ REPOSITORY	checkov	yes		no	no	26.34s
✅ REPOSITORY	gitleaks	yes		no	no	0.39s
✅ REPOSITORY	grype	yes		no	no	71.26s
✅ REPOSITORY	kingfisher	yes		no	no	8.79s
✅ REPOSITORY	secretlint	yes		no	no	2.02s
✅ REPOSITORY	semgrep	yes		no	no	28.11s
✅ REPOSITORY	syft	yes		no	no	2.23s
✅ REPOSITORY	trivy	yes		no	no	10.88s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.21s
✅ REPOSITORY	trufflehog	yes		no	no	5.36s

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx mega-linter-runner@9.6.0 --custom-flavor-setup --custom-flavor-linters BASH_SHELLCHECK,REPOSITORY_CHECKOV,REPOSITORY_GITLEAKS,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_SECRETLINT,REPOSITORY_SEMGREP,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,REPOSITORY_KINGFISHER

Show us your support by starring ⭐ the repository