Latest Results
feat(bindings): gate native npm releases on verified carriers (#12292)
**Description:**
The native release workflow currently uploads raw stripped addons. This
change integrates the checked-in private carrier/packer interface after
the final strip steps: it builds a temporary carrier, verifies its
target, payload, SHA-512, exports, and size, then atomically replaces
only the selected `.node` file.
A shared gate covers all four native products and twelve targets before
npm or native GitHub asset publication. It requires 32 valid carriers,
16 unchanged raw addons, smaller individual carriers, at least 50%
aggregate selected-addon reduction, and complete runtime evidence.
Assembly inspects npm tarballs and publication consumes those exact
verified bytes with lifecycle scripts disabled. Package names,
filenames, optional dependencies, JS loaders, Node engine ranges, and
sibling CLI bytes retain their existing contracts.
The workflow reports raw, payload, carrier, and tarball sizes plus
cold/warm load timings, and exercises existing product paths, npm
layouts, minimum Node boundaries, and native filesystem lifecycle
checks. Documentation covers materialization,
`SWC_NATIVE_BINDING_CACHE`, and the supported-target boundary. No
napi-rs changes or upstream fork are introduced; PR #12000 was not
reused.
**Validation:**
- Passed: 9 script/workflow tests, 30 private Rust tests, Rust 1.73 MSRV
checks, `cargo fmt --all`, private-crate clippy, Actionlint, and Rust
checks for the seven additional selected targets. Cross-target checks do
not establish native execution.
- Passed through actual Linux GNU x64 carriers: core's 117 tests,
minifier's 2 tests, React Compiler's 8 tests, and an HTML product smoke.
The required core development build and integration suite also passed.
- Passed local and packed-package loading at core Node 10.0.0, HTML Node
14.0.0, minifier Node 12.0.0/14.0.0, and React Compiler Node 20.0.0,
alongside Node 20/22 checks.
- The four locally built Linux GNU x64 carriers reduced combined addon
bytes by 65.30%; extracted and materialized raw bytes matched their
stripped inputs by SHA-512.
**Outstanding release acceptance:**
Core exceeded the 100 ms cold / 25 ms warm overhead budgets on this
host: approximately 205/63 ms on Node 20 and 209/63 ms on Node 22. The
gate rejects these results. Full 48-artifact native validation has not
run locally, and no complete release-acceptance claim is made.
`git submodule update --init --recursive` was attempted before testing
and rejected by the runner because each submodule requires an
independently bound repository credential. Consequently, workspace-wide
clippy fails on the empty HTML5 fixture submodule. Docker startup and
btrfs mounting failed with `sudo: a password is required`; this Linux VM
cannot execute macOS/APFS or Windows/NTFS checks. Hosted CodSpeed
comparison remains unverified.
Exact commands, measurements, and limitations are recorded in [the
verification
report](https://github.com/swc-project/swc/blob/labor0/native-carrier-release-12273/docs/native-addon-carriers-verification.md).
The `add-changeset` audit found no changed publishable Rust crates; all
three affected Rust crates are private. Npm changesets and synchronized
versioning are externally managed per the accepted task decision.
**Related issue (if exists):**
Refs #12273. Release acceptance remains outstanding, so this PR does not
claim to close the issue.
---------
Co-authored-by: Labor0 Bot <279936132+labor0-bot[bot]@users.noreply.github.com> Latest Branches
-2%
codex/remove-export-default-from-benchmark -9%
0%
Dev-next-gen:fix/es-parser-declare-line-break © 2026 CodSpeed Technology