@rightkit/git 0.1.0 → 0.2.0

package/README.md

@@ -33,3 +33,7 @@ npm install -g @rightkit/git   # or: npx @rightkit/git --help
 ```
 
 Node builtins only; no runtime dependencies.
+
+## Profiles
+
+`profile` defaults to `node`. `rust-hybrid` accepts only `ci`, requires safe relative `gate.path`, installs pinned Node plus `rustup stable`, then runs that gate. It never adds release, signing, publishing, or approval steps.

package/cli/right-git.mjs

@@ -79,7 +79,7 @@ async function runInstall(argv) {
   const { positional, flags } = parseFlags(argv);
   const repoPath = positional[0];
   if (!repoPath) {
-    console.error("right-git install <repo-path> --lanes ci,qualification,...");
+    console.error("right-git install <repo-path> --lanes ci,qualification,... [--profile node|rust-hybrid --gate-path scripts/gate.sh]");
     return 2;
   }
   const opts = {
@@ -88,6 +88,8 @@ async function runInstall(argv) {
     homebrewFormula: flags["homebrew-formula"],
     wingetId: flags["winget-id"],
     provenance: flags["no-provenance"] ? false : undefined,
+    profile: flags.profile,
+    gatePath: flags["gate-path"],
   };
   const result = await installCommand(path.resolve(repoPath), opts);
   if (!result.ok) {
@@ -196,7 +198,7 @@ function printHelp() {
   console.log(`right-git <command> [options]
 
 Commands:
-  install <repo-path> --lanes ci,qualification,...   Write .rightgit.json and render workflows; refuses private repos
+  install <repo-path> --lanes ci,... [--profile rust-hybrid --gate-path scripts/gate.sh]  Write .rightgit.json and render workflows; refuses private repos
   sync <repo-path> [--dry-run]                        Re-render templates from .rightgit.json, show diff, apply
   drift <repo-path>                                   CI-safe check: installed workflows == rendered templates?
   drift --all [workspace-root]                        Drift-check + re-check visibility for every managed repo found

package/guard-coverage.test.mjs

@@ -218,3 +218,11 @@ test("F5: private-repo-guard job has no job-level `if` (always runs) and fails o
     );
   }
 });
+
+test("rust-hybrid ci keeps its work behind the public-repository guard", () => {
+  const manifest = { ...FULL_MANIFEST, lanes: ["ci"], profile: "rust-hybrid", gate: { path: "scripts/gate.sh" } };
+  const template = fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/ci.yml"), "utf8");
+  const jobs = parseJobs(renderTemplate(template, buildRenderContext(manifest, "/repos/widgets")));
+  assert.ok(isGuarded(jobs, "private-repo-guard"));
+  assert.ok(isGuarded(jobs, "ci"));
+});

package/install.mjs

@@ -13,7 +13,7 @@ import { syncCommand } from "./sync.mjs";
 
 export const DEFAULT_MATRIX = { os: ["ubuntu-latest", "macos-latest", "windows-latest"], node: ["22.13", "24"] };
 export const DEFAULT_PACKAGE_MANAGER = "pnpm@11.18.0";
-export const DEFAULT_TEMPLATE_VERSION = "1.0.0";
+export const DEFAULT_TEMPLATE_VERSION = "1.1.0";
 
 /**
  * opts: { lanes: string[], matrix?, packageManager?, templateVersion?,
@@ -43,6 +43,8 @@ export async function installCommand(repoPath, opts = {}, deps = {}) {
     packageManager: opts.packageManager || DEFAULT_PACKAGE_MANAGER,
     templateVersion: opts.templateVersion || DEFAULT_TEMPLATE_VERSION,
   };
+  if (opts.profile) manifest.profile = opts.profile;
+  if (opts.gatePath) manifest.gate = { path: opts.gatePath };
 
   if (lanes.includes("publish-npm")) {
     manifest.publish = { ...manifest.publish, npm: { oidc: true, provenance: opts.provenance !== false } };

package/manifest.mjs

@@ -55,7 +55,10 @@ const TOP_LEVEL_KEYS = new Set([
   "packageManager",
   "publish",
   "templateVersion",
+  "profile",
+  "gate",
 ]);
+const GATE_PATH_RE = /^(?!.*\.\.)(?!.*\s)[A-Za-z0-9][A-Za-z0-9._/-]*$/;
 
 /**
  * Validate a parsed manifest object against the right-git manifest contract.
@@ -117,6 +120,17 @@ export function validateManifest(manifest) {
     errors.push("templateVersion must be a semver string 'X.Y.Z'");
   }
 
+  const profile = manifest.profile === undefined ? "node" : manifest.profile;
+  if (profile !== "node" && profile !== "rust-hybrid") errors.push("profile must be 'node' or 'rust-hybrid'");
+  if (profile === "rust-hybrid") {
+    if (lanes.length !== 1 || lanes[0] !== "ci") errors.push("profile 'rust-hybrid' supports only lane 'ci'");
+    if (!manifest.gate || typeof manifest.gate !== "object" || Array.isArray(manifest.gate) || Object.keys(manifest.gate).some((key) => key !== "path") || typeof manifest.gate.path !== "string" || !GATE_PATH_RE.test(manifest.gate.path)) {
+      errors.push("profile 'rust-hybrid' requires gate.path with a safe relative path");
+    }
+  } else if (manifest.gate !== undefined) {
+    errors.push("gate is only valid for profile 'rust-hybrid'");
+  }
+
   const publish = manifest.publish;
   if (publish !== undefined) {
     if (publish === null || typeof publish !== "object" || Array.isArray(publish)) {
@@ -256,11 +270,13 @@ export function buildRenderContext(manifest, repoPath) {
     NODE_MATRIX: yamlFlowStringList(manifest.matrix.node),
     NODE_PUBLISH_VERSION: JSON.stringify(String(manifest.matrix.node[0])),
     PM_NAME: pm.name,
+    PM_VERSION: pm.version,
     PM_CACHE: pm.name,
     INSTALL_COMMAND: pm.installCommand,
     PM_RUN: pm.runPrefix,
     ARTIFACT_PREFIX: artifactPrefix,
     TEMPLATE_VERSION: manifest.templateVersion,
+    GATE_PATH: manifest.gate?.path,
   };
 
   if (manifest.publish?.npm) {

package/manifest.schema.json

@@ -81,5 +81,10 @@
       "type": "string",
       "pattern": "^\\d+\\.\\d+\\.\\d+$"
     }
+    ,"profile": { "enum": ["node", "rust-hybrid"] },
+    "gate": {
+      "type": "object", "required": ["path"], "additionalProperties": false,
+      "properties": { "path": { "type": "string", "pattern": "^(?!.*\\.\\.)(?!.*\\s)[A-Za-z0-9][A-Za-z0-9._/-]*$" } }
+    }
   }
 }

package/manifest.test.mjs

@@ -16,6 +16,15 @@ test("accepts a minimal valid manifest", () => {
   assert.deepEqual(errors, []);
 });
 
+test("rust-hybrid requires only ci and a safe gate path", () => {
+  const valid = { ...VALID_MINIMAL, profile: "rust-hybrid", gate: { path: "scripts/gate.sh" } };
+  assert.equal(validateManifest(valid).valid, true);
+  for (const path of ["/tmp/gate.sh", "../gate.sh", "scripts/gate sh", "${{ secrets.X }}", "scripts/gate;sh"]) {
+    assert.equal(validateManifest({ ...valid, gate: { path } }).valid, false, path);
+  }
+  assert.equal(validateManifest({ ...valid, lanes: ["ci", "qualification"] }).valid, false);
+});
+
 test("rejects non-object input", () => {
   for (const bad of [null, undefined, "not an object", 42, ["array"]]) {
     const { valid, errors } = validateManifest(bad);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/git",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
   "type": "module",
   "bin": {
@@ -14,9 +14,6 @@
     "*.json"
   ],
   "sideEffects": false,
-  "scripts": {
-    "test": "node --test *.test.mjs"
-  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
@@ -26,5 +23,7 @@
     "url": "git+https://github.com/adrdsouza/claude.git",
     "directory": "tools/rightkit/packages/git"
   },
-  "packageManager": "pnpm@11.18.0"
-}
+  "scripts": {
+    "test": "node --test *.test.mjs"
+  }
+}

package/render.test.mjs

@@ -42,6 +42,14 @@ test("every known lane has a template file and renders without an unresolved pla
   assert.equal(Object.keys(rendered).length, KNOWN_LANES.length);
 });
 
+test("rust-hybrid ci renders its pinned package manager and gate", () => {
+  const manifest = { ...FULL_MANIFEST, lanes: ["ci"], profile: "rust-hybrid", gate: { path: "scripts/gate.sh" }, templateVersion: "1.1.0" };
+  const content = renderTemplate(fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/ci.yml"), "utf8"), buildRenderContext(manifest, "/repos/widgets"));
+  assert.match(content, /corepack prepare pnpm@11\.18\.0 --activate/);
+  assert.match(content, /rustup toolchain install stable/);
+  assert.match(content, /bash \.\/scripts\/gate\.sh/);
+});
+
 test("render determinism: same manifest renders byte-identical output every time", () => {
   const first = renderAllLanes(FULL_MANIFEST, "/repos/widgets");
   const second = renderAllLanes(FULL_MANIFEST, "/repos/widgets");
@@ -50,6 +58,19 @@ test("render determinism: same manifest renders byte-identical output every time
   }
 });
 
+test("rendered workflows never request pnpm or yarn setup-node caching before package-manager activation", () => {
+  for (const packageManager of ["pnpm@11.18.0", "yarn@4.6.0"]) {
+    const rendered = renderAllLanes({ ...FULL_MANIFEST, packageManager }, "/repos/widgets");
+    for (const [lane, content] of Object.entries(rendered)) {
+      assert.doesNotMatch(
+        content,
+        /^\s*cache:\s*(?:pnpm|yarn)\s*$/m,
+        `lane ${lane} must not ask actions/setup-node for ${packageManager.split("@")[0]} caching before corepack activation`,
+      );
+    }
+  }
+});
+
 // F5 fix: a job-level `if: !private` on the real work job means GitHub
 // SKIPS that job entirely for a private repo — the nested "refuse" step
 // inside it is then unreachable and never runs, so nothing fails and the

package/sync.mjs

@@ -18,7 +18,9 @@ export function renderLanes(manifest, repoPath) {
   const context = buildRenderContext(manifest, repoPath);
   return manifest.lanes.map((lane) => {
     const filename = LANE_FILENAMES[lane];
-    const templatePath = path.join(TEMPLATES_DIR, filename);
+    const templatePath = manifest.profile === "rust-hybrid"
+      ? path.join(TEMPLATES_DIR, "profiles", "rust-hybrid", filename)
+      : path.join(TEMPLATES_DIR, filename);
     const templateText = fs.readFileSync(templatePath, "utf8");
     return { lane, filename, content: renderTemplate(templateText, context) };
   });

package/templates/ci.yml

@@ -37,7 +37,6 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ matrix.node }}
-          cache: ${PM_CACHE}
       - run: corepack enable
       - run: ${INSTALL_COMMAND}
       - run: ${PM_RUN} test

package/templates/package-smoke.yml

@@ -31,7 +31,6 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-          cache: ${PM_CACHE}
       - run: corepack enable
       - run: ${INSTALL_COMMAND}
       - run: node scripts/test-package.mjs

package/templates/profiles/rust-hybrid/ci.yml

@@ -0,0 +1,29 @@
+# Managed by right-git — do not hand-edit. Run `right-git sync` to update.
+# Template: profiles/rust-hybrid/ci.yml | Template version: ${TEMPLATE_VERSION}
+name: ci
+on: [push, pull_request]
+permissions:
+  contents: read
+jobs:
+  private-repo-guard:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Refuse private repository
+        if: ${{ github.event.repository.private }}
+        run: exit 1
+  ci:
+    needs: [private-repo-guard]
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${OS_MATRIX}
+        node: ${NODE_MATRIX}
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: ${{ matrix.node }}
+      - run: corepack enable && corepack prepare ${PM_NAME}@${PM_VERSION} --activate
+      - run: rustup toolchain install stable --profile minimal
+      - run: bash ./${GATE_PATH}

package/templates/publish-npm.yml

@@ -37,7 +37,6 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${NODE_PUBLISH_VERSION}
-          cache: ${PM_CACHE}
           registry-url: https://registry.npmjs.org
       - run: corepack enable
       - run: ${INSTALL_COMMAND}

package/templates/publish-package-managers.yml

@@ -76,7 +76,6 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-          cache: ${PM_CACHE}
       - run: corepack enable
       - run: ${INSTALL_COMMAND}
       - run: ruby -c release/homebrew/${HOMEBREW_FORMULA_NAME}.rb

package/templates/qualification.yml

@@ -26,7 +26,6 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-          cache: ${PM_CACHE}
       - run: corepack enable
       - run: ${INSTALL_COMMAND}
       - run: ${PM_RUN} test:all
@@ -38,7 +37,6 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-          cache: ${PM_CACHE}
       - run: corepack enable
       - run: ${INSTALL_COMMAND}
       - run: node scripts/ci/check-schema.mjs || true
@@ -50,7 +48,6 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-          cache: ${PM_CACHE}
       - run: corepack enable
       - run: ${INSTALL_COMMAND}
       - run: node scripts/ci/check-network-boundary.mjs
@@ -64,7 +61,6 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-          cache: ${PM_CACHE}
       - run: corepack enable
       - run: ${INSTALL_COMMAND}
       - run: ${PM_RUN} test:hardening
@@ -76,7 +72,6 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-          cache: ${PM_CACHE}
       - run: corepack enable
       - run: ${INSTALL_COMMAND}
       - run: ${PM_RUN} test:conformance

package/templates/release-candidate.yml

@@ -32,7 +32,6 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-          cache: ${PM_CACHE}
       - run: corepack enable
       - run: ${INSTALL_COMMAND}
       - run: node --test tests/release-candidate.test.mjs