Move release mechanics behind the public facade

internal/build/candidate.go

@@ -0,0 +1,45 @@
+package build
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"gitea.maximumdirect.net/eric/ReleaseKit/internal/candidate"
+)
+
+func CandidateCallback(spec *Spec, output io.Writer) func(context.Context, candidate.Candidate) error {
+	if spec == nil || len(spec.Targets) == 0 {
+		return nil
+	}
+	selected := *spec
+	selected.Targets = append([]Target(nil), spec.Targets...)
+	return func(ctx context.Context, captured candidate.Candidate) error {
+		temporaryDir, err := os.MkdirTemp(filepath.Dir(captured.RepositoryDir), ".releasekit-candidate-build-")
+		if err != nil {
+			return fmt.Errorf("create temporary candidate build output: %w", err)
+		}
+		defer os.RemoveAll(temporaryDir)
+		relative, err := filepath.Rel(captured.RepositoryDir, temporaryDir)
+		if err != nil {
+			return fmt.Errorf("verify temporary candidate build output: %w", err)
+		}
+		if relative == "." || relative != ".." && !strings.HasPrefix(relative, ".."+string(filepath.Separator)) {
+			return fmt.Errorf("temporary candidate build output %q is inside the repository", temporaryDir)
+		}
+		_, err = Build(ctx, Request{
+			RepositoryDir: captured.RepositoryDir,
+			Version:       captured.Version,
+			Spec:          selected,
+			OutputDir:     temporaryDir,
+			Output:        output,
+		})
+		if err != nil {
+			return fmt.Errorf("build candidate: %w", err)
+		}
+		return nil
+	}
+}