Build-PluginSubmission.ps1

<# Build review-ready PyGuard plugin and skill ZIPs with SHA-256 checksums. #>
[CmdletBinding()]
param()

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'
$pluginRoot = Join-Path $PSScriptRoot 'plugin\pyguard'
$manifest = Get-Content -Raw -LiteralPath (Join-Path $pluginRoot '.codex-plugin\plugin.json') |
    ConvertFrom-Json
$version = $manifest.version
$buildRoot = [IO.Path]::GetFullPath((Join-Path $PSScriptRoot 'build\plugin-submission'))
$distRoot = [IO.Path]::GetFullPath((Join-Path $PSScriptRoot 'dist'))
$allowed = [IO.Path]::GetFullPath($PSScriptRoot).TrimEnd('\') + '\'
if (-not $buildRoot.StartsWith($allowed, [StringComparison]::OrdinalIgnoreCase)) {
    throw "Unsafe plugin build path: $buildRoot"
}
if (Test-Path -LiteralPath $buildRoot) {
    Remove-Item -LiteralPath $buildRoot -Recurse -Force
}
New-Item -ItemType Directory -Path $buildRoot -Force | Out-Null
New-Item -ItemType Directory -Path $distRoot -Force | Out-Null

$pluginStage = Join-Path $buildRoot 'pyguard'
Copy-Item -LiteralPath $pluginRoot -Destination $pluginStage -Recurse
$skillStage = Join-Path $buildRoot 'skill\pyguard'
New-Item -ItemType Directory -Path (Split-Path $skillStage -Parent) -Force | Out-Null
Copy-Item -LiteralPath (Join-Path $pluginRoot 'skills\pyguard') -Destination $skillStage -Recurse

$pluginZip = Join-Path $distRoot "PyGuard-Plugin-$version.zip"
$skillZip = Join-Path $distRoot "PyGuard-Skill-$version.zip"
Remove-Item -LiteralPath $pluginZip,$skillZip -Force -ErrorAction SilentlyContinue
Compress-Archive -LiteralPath $pluginStage -DestinationPath $pluginZip -CompressionLevel Optimal
Compress-Archive -LiteralPath $skillStage -DestinationPath $skillZip -CompressionLevel Optimal

$checksum = Join-Path $distRoot "PyGuard-Plugin-$version-SHA256SUMS.txt"
$lines = foreach ($artifact in $pluginZip,$skillZip) {
    $hash = Get-FileHash -LiteralPath $artifact -Algorithm SHA256
    '{0}  {1}' -f $hash.Hash.ToLowerInvariant(), (Split-Path $artifact -Leaf)
}
Set-Content -LiteralPath $checksum -Value $lines -Encoding ASCII
Write-Output "Built: $pluginZip"
Write-Output "Built: $skillZip"
Write-Output "Checksums: $checksum"