fix: preserve artifact writer failures

scripts/check-registries.ts

@@ -15,7 +15,10 @@ import {
   verifyRegistryBaselineApproval,
 } from "./lib/registry-compatibility.ts";
 import { assertMatchesJsonSchema } from "./lib/json-schema.ts";
-import { registrySnapshotArtifactSchema } from "./contracts/release-artifacts.ts";
+import {
+  registryGovernanceRunArtifactSchema,
+  registrySnapshotArtifactSchema,
+} from "./contracts/release-artifacts.ts";
 import { writeValidatedJsonArtifact } from "./lib/validated-json-artifact.ts";
 
 type RegistryRow = Record<string, unknown>;
@@ -79,8 +82,9 @@ const governancePath =
 const artifactPath =
   argumentValue("--artifact", "artifacts/quality/registries.json") ??
   "artifacts/quality/registries.json";
+const usesRepositoryGovernance = governancePath === defaultGovernancePath;
 const usesRepositoryBaseline =
-  governancePath === defaultGovernancePath &&
+  usesRepositoryGovernance &&
   !process.argv.includes("--no-baseline");
 const baselinePath = argumentValue(
   "--baseline",
@@ -678,7 +682,9 @@ if (usesRepositoryBaseline && failures.length === 0) {
 await mkdir(path.dirname(artifactPath), { recursive: true });
 await writeValidatedJsonArtifact({
   path: artifactPath,
-  schema: registrySnapshotArtifactSchema,
+  schema: usesRepositoryGovernance
+    ? registrySnapshotArtifactSchema
+    : registryGovernanceRunArtifactSchema,
   value: report,
 });
 

scripts/contracts/release-artifacts.ts

@@ -45,9 +45,9 @@ export const dependencyInventoryArtifactSchema = z
     schemaVersion: z.literal(2),
     packageManager: nonEmptyString,
     lockfileSha256: sha256,
-    dependencyCount: z.int().nonnegative(),
-    directDependencyCount: z.int().nonnegative(),
-    dependencies: z.array(dependencyInventoryRowSchema),
+    dependencyCount: z.int().positive(),
+    directDependencyCount: z.int().positive(),
+    dependencies: z.array(dependencyInventoryRowSchema).min(1),
   })
   .strict()
   .superRefine((inventory, context) => {
@@ -128,7 +128,7 @@ const registryArtifactRowSchema = z
   })
   .strict();
 
-export const registrySnapshotArtifactSchema = z
+const registrySnapshotBaseArtifactSchema = z
   .object({
     schemaVersion: z.literal(2),
     generatedAt: timestamp,
@@ -146,11 +146,34 @@ export const registrySnapshotArtifactSchema = z
         changes: z.array(registryChangeSchema),
       })
       .strict(),
-    failures: z.array(z.string()),
-    registries: z.array(registryArtifactRowSchema),
   })
   .strict();
 
+const successfulRegistrySnapshotArtifactSchema =
+  registrySnapshotBaseArtifactSchema.extend({
+    failures: z.array(z.string()).max(0),
+    registries: z.array(registryArtifactRowSchema).length(11),
+  });
+
+const failedRegistrySnapshotArtifactSchema =
+  registrySnapshotBaseArtifactSchema.extend({
+    failures: z.array(z.string()).min(1),
+    registries: z.array(registryArtifactRowSchema),
+  });
+
+export const registrySnapshotArtifactSchema = z.union([
+  successfulRegistrySnapshotArtifactSchema,
+  failedRegistrySnapshotArtifactSchema,
+]);
+
+export const registryGovernanceRunArtifactSchema = z.union([
+  registrySnapshotBaseArtifactSchema.extend({
+    failures: z.array(z.string()).max(0),
+    registries: z.array(registryArtifactRowSchema).min(1),
+  }),
+  failedRegistrySnapshotArtifactSchema,
+]);
+
 const outputDigestSchema = z
   .object({
     path: nonEmptyString,

scripts/lib/validated-json-artifact.ts

@@ -62,11 +62,24 @@ export function createValidatedJsonArtifactWriter(
     try {
       const handle = await fileSystem.open(temporaryPath, "wx");
       ownsTemporaryFile = true;
+      let writeFailed = false;
+      let writeFailure: unknown;
       try {
         await handle.writeFile(`${serialized}\n`, "utf8");
-      } finally {
-        await handle.close();
+      } catch (error) {
+        writeFailed = true;
+        writeFailure = error;
       }
+      let closeFailed = false;
+      let closeFailure: unknown;
+      try {
+        await handle.close();
+      } catch (error) {
+        closeFailed = true;
+        closeFailure = error;
+      }
+      if (writeFailed) throw writeFailure;
+      if (closeFailed) throw closeFailure;
       await fileSystem.rename(temporaryPath, input.path);
     } catch (error) {
       if (ownsTemporaryFile) {