fix: load schema via require() for pkg/esbuild compat (#2396)

* fix: load schema via require() for pkg/esbuild compat

The release binary failed because pkg couldn't find awf-config-schema.json
at runtime — the fs.readFileSync approach didn't work in pkg's snapshot
filesystem. Switch to require() which both esbuild (inlines into bundle)
and pkg (includes in snapshot via static analysis) handle natively.

Also add dist/awf-config-schema.json to pkg.assets as a fallback.

Fixes: Release workflow 'Smoke test binary (x64)' failure

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Potential fix for pull request finding 'CodeQL / Assignment to constant'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Potential fix for pull request finding 'CodeQL / Unused variable, import, function or class'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* fix: remove unused schemaJson import causing CodeQL alerts

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/f2ea8212-e983-4cfc-9d6f-8bee57e01657

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Author: 5 people

package.json

@@ -89,7 +89,8 @@
     "scripts": "dist/**/*.js",
     "assets": [
       "node_modules/chalk/**/*",
-      "containers/agent/seccomp-profile.json"
+      "containers/agent/seccomp-profile.json",
+      "dist/awf-config-schema.json"
     ],
     "targets": [
       "node18-linux-x64",

src/schema-validator.ts

@@ -1,39 +1,21 @@
 /**
  * Runtime config validation using the published JSON Schema.
  *
- * The schema JSON is loaded from disk so the emitted JS does not contain a
- * fragile runtime `require('./awf-config-schema.json')`. The canonical source
- * is generated by `scripts/generate-schema.mjs` and kept in sync via CI.
+ * The schema is loaded via a static `import` so tsc emits the JSON to
+ * dist/, esbuild inlines it in the bundle, and pkg includes it in the snapshot.
+ * The canonical source is generated by `scripts/generate-schema.mjs`.
  */
 
 import Ajv2020, { ErrorObject } from 'ajv/dist/2020';
-import { existsSync, readFileSync } from 'fs';
-import { join } from 'path';
-
-function loadSchema(): Record<string, unknown> {
-  const candidatePaths = [
-    join(__dirname, 'awf-config-schema.json'),
-    join(__dirname, '../src/awf-config-schema.json'),
-  ];
-
-  for (const candidatePath of candidatePaths) {
-    if (existsSync(candidatePath)) {
-      return JSON.parse(readFileSync(candidatePath, 'utf8')) as Record<string, unknown>;
-    }
-  }
+import schemaJson from './awf-config-schema.json';
 
-  throw new Error(
-    `Unable to locate awf-config-schema.json. Checked: ${candidatePaths.join(', ')}`,
-  );
-}
+const schema = schemaJson as Record<string, unknown>;
 
-// Compile once (module-level singleton). allErrors collects every violation.
-// verbose=true provides parentSchema on errors for richer formatting.
 const ajv = new Ajv2020({ allErrors: true, verbose: true });
 // 'version' is a metadata keyword (not a standard JSON Schema keyword); register
 // it so Ajv strict mode does not reject the schema.
 ajv.addKeyword({ keyword: 'version' });
-const validate = ajv.compile(loadSchema());
+const validate = ajv.compile(schema);
 
 /**
  * Check if a schema path points to an array-of-strings field by inspecting