@rightkit/git 0.1.0

package/sync.mjs

@@ -0,0 +1,139 @@
+// Render templates for a target repo's manifest and install them into
+// <repo>/.github/workflows/, showing a diff before applying (DESIGN.md §4).
+// Refuses private/internal/unknown-visibility repos — no override (I1).
+
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { assertPublic } from "./policy/visibility-gate.mjs";
+import { loadManifest, LANE_FILENAMES, buildRenderContext } from "./manifest.mjs";
+import { renderTemplate, MANAGED_MARKER } from "./render.mjs";
+
+const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)));
+const TEMPLATES_DIR = path.join(packageRoot, "templates");
+const WORKFLOWS_SUBDIR = path.join(".github", "workflows");
+
+/** Render every lane declared in the manifest. Returns { lane, filename, content }[]. */
+export function renderLanes(manifest, repoPath) {
+  const context = buildRenderContext(manifest, repoPath);
+  return manifest.lanes.map((lane) => {
+    const filename = LANE_FILENAMES[lane];
+    const templatePath = path.join(TEMPLATES_DIR, filename);
+    const templateText = fs.readFileSync(templatePath, "utf8");
+    return { lane, filename, content: renderTemplate(templateText, context) };
+  });
+}
+
+/** List files in <repo>/.github/workflows that carry the right-git managed marker. */
+export function listManagedFiles(repoPath) {
+  const dir = path.join(repoPath, WORKFLOWS_SUBDIR);
+  let entries;
+  try {
+    entries = fs.readdirSync(dir);
+  } catch {
+    return [];
+  }
+  return entries.filter((name) => {
+    if (!name.endsWith(".yml") && !name.endsWith(".yaml")) return false;
+    try {
+      const content = fs.readFileSync(path.join(dir, name), "utf8");
+      return content.startsWith(MANAGED_MARKER);
+    } catch {
+      return false;
+    }
+  });
+}
+
+/** Minimal line-based diff: common prefix/suffix trimmed, middle shown as -/+ . */
+export function lineDiff(oldText, newText) {
+  const oldLines = oldText == null ? [] : oldText.split("\n");
+  const newLines = newText.split("\n");
+  let start = 0;
+  while (start < oldLines.length && start < newLines.length && oldLines[start] === newLines[start]) start++;
+  let oldEnd = oldLines.length;
+  let newEnd = newLines.length;
+  while (oldEnd > start && newEnd > start && oldLines[oldEnd - 1] === newLines[newEnd - 1]) {
+    oldEnd--;
+    newEnd--;
+  }
+  const out = [];
+  for (let i = start; i < oldEnd; i++) out.push(`-${oldLines[i]}`);
+  for (let i = start; i < newEnd; i++) out.push(`+${newLines[i]}`);
+  return out;
+}
+
+/**
+ * Compute the sync plan without writing anything: visibility check, manifest
+ * load, per-lane render, diff against what's on disk, plus removal of any
+ * managed file whose lane fell out of the manifest.
+ * Returns a typed result — never throws.
+ */
+export async function planSync(repoPath, deps = {}) {
+  const visibility = await assertPublic(repoPath, deps);
+  if (!visibility.allowed) {
+    return { ok: false, stage: "visibility", errors: [visibility.reason], changes: [] };
+  }
+
+  const loaded = loadManifest(repoPath);
+  if (!loaded.ok) {
+    return { ok: false, stage: "manifest", errors: loaded.errors, changes: [] };
+  }
+
+  const rendered = renderLanes(loaded.manifest, repoPath);
+  const wantedFilenames = new Set(rendered.map((r) => r.filename));
+  const changes = [];
+
+  for (const { lane, filename, content } of rendered) {
+    const target = path.join(repoPath, WORKFLOWS_SUBDIR, filename);
+    let existing = null;
+    try {
+      existing = fs.readFileSync(target, "utf8");
+    } catch {
+      // not installed yet
+    }
+    if (existing === content) {
+      changes.push({ lane, filename, action: "unchanged", diff: [] });
+    } else {
+      changes.push({ lane, filename, action: existing === null ? "create" : "update", diff: lineDiff(existing, content), content });
+    }
+  }
+
+  for (const managedFilename of listManagedFiles(repoPath)) {
+    if (!wantedFilenames.has(managedFilename)) {
+      changes.push({ lane: null, filename: managedFilename, action: "remove", diff: [] });
+    }
+  }
+
+  return { ok: true, stage: "planned", errors: [], changes };
+}
+
+/** Apply a plan produced by planSync: write/update/remove files on disk. */
+export function applyPlan(repoPath, plan) {
+  const dir = path.join(repoPath, WORKFLOWS_SUBDIR);
+  fs.mkdirSync(dir, { recursive: true });
+  for (const change of plan.changes) {
+    const target = path.join(dir, change.filename);
+    if (change.action === "create" || change.action === "update") {
+      fs.writeFileSync(target, change.content, "utf8");
+    } else if (change.action === "remove") {
+      fs.rmSync(target, { force: true });
+    }
+  }
+}
+
+/** Full sync: plan, print diff, apply unless dryRun. Returns the plan. */
+export async function syncCommand(repoPath, { dryRun = false, deps = {} } = {}) {
+  const plan = await planSync(repoPath, deps);
+  if (!plan.ok) return plan;
+
+  for (const change of plan.changes) {
+    if (change.action === "unchanged") continue;
+    console.log(`\n${change.action.toUpperCase()} ${change.filename}`);
+    for (const line of change.diff) console.log(line);
+  }
+
+  if (!dryRun) {
+    applyPlan(repoPath, plan);
+  }
+  return plan;
+}

package/sync.test.mjs

@@ -0,0 +1,84 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { syncCommand } from "./sync.mjs";
+import { makeTempRepo, PUBLIC_DEPS, PRIVATE_DEPS, SAMPLE_MANIFEST } from "./test-support.mjs";
+
+test("sync refuses a private repo and writes nothing", async () => {
+  const dir = makeTempRepo(SAMPLE_MANIFEST);
+  const result = await syncCommand(dir, { deps: PRIVATE_DEPS });
+  assert.equal(result.ok, false);
+  assert.equal(result.stage, "visibility");
+  assert.equal(fs.existsSync(path.join(dir, ".github", "workflows")), false);
+});
+
+test("sync writes one rendered file per lane for a public repo", async () => {
+  const dir = makeTempRepo(SAMPLE_MANIFEST);
+  const result = await syncCommand(dir, { deps: PUBLIC_DEPS });
+  assert.equal(result.ok, true);
+  for (const filename of ["ci.yml", "package-smoke.yml"]) {
+    assert.ok(fs.existsSync(path.join(dir, ".github", "workflows", filename)), `${filename} was not written`);
+  }
+});
+
+test("sync --dry-run plans changes without writing files", async () => {
+  const dir = makeTempRepo(SAMPLE_MANIFEST);
+  const result = await syncCommand(dir, { deps: PUBLIC_DEPS, dryRun: true });
+  assert.equal(result.ok, true);
+  assert.ok(result.changes.some((c) => c.action === "create"));
+  assert.equal(fs.existsSync(path.join(dir, ".github", "workflows")), false);
+});
+
+test("sync is idempotent: a second run reports no changes", async () => {
+  const dir = makeTempRepo(SAMPLE_MANIFEST);
+  await syncCommand(dir, { deps: PUBLIC_DEPS });
+  const second = await syncCommand(dir, { deps: PUBLIC_DEPS });
+  assert.ok(second.changes.every((c) => c.action === "unchanged"));
+});
+
+test("sync removes a workflow file for a lane dropped from the manifest", async () => {
+  const dir = makeTempRepo(SAMPLE_MANIFEST);
+  await syncCommand(dir, { deps: PUBLIC_DEPS });
+  fs.writeFileSync(path.join(dir, ".rightgit.json"), `${JSON.stringify({ ...SAMPLE_MANIFEST, lanes: ["ci"] }, null, 2)}\n`, "utf8");
+  const result = await syncCommand(dir, { deps: PUBLIC_DEPS });
+  assert.equal(result.ok, true);
+  assert.equal(fs.existsSync(path.join(dir, ".github", "workflows", "package-smoke.yml")), false);
+  assert.ok(fs.existsSync(path.join(dir, ".github", "workflows", "ci.yml")));
+});
+
+test("sync reports manifest errors instead of writing files", async () => {
+  const dir = makeTempRepo(null);
+  const result = await syncCommand(dir, { deps: PUBLIC_DEPS });
+  assert.equal(result.ok, false);
+  assert.equal(result.stage, "manifest");
+});
+
+// F15 end-to-end: a hostile `.rightgit.json` on disk — the real attack
+// surface, not just the in-memory validateManifest() unit — must be refused
+// at the manifest stage, before renderLanes() (and therefore render.mjs's
+// unescaped `${TOKEN}` substitution) ever sees the payload. This is the
+// concrete proof that "none survive into rendered output": nothing is
+// rendered or written at all when the manifest is hostile. Covers a family
+// of payloads across the fields that flow into the credential-bearing
+// publish-package-managers lane.
+const HOSTILE_MANIFESTS = [
+  { tap: "acme/tap", formulaName: "${{ secrets.APPLE_CERTIFICATE }}" },
+  { tap: "acme/tap", formulaName: "`whoami`" },
+  { tap: "acme/tap", formulaName: "widgets\nrun: exit 1" },
+  { tap: "acme/${{ secrets.X }}", formulaName: "widgets" },
+];
+
+for (const [i, homebrew] of HOSTILE_MANIFESTS.entries()) {
+  test(`F15: sync refuses a hostile manifest and writes nothing (payload ${i})`, async () => {
+    const dir = makeTempRepo({
+      ...SAMPLE_MANIFEST,
+      lanes: ["publish-package-managers"],
+      publish: { homebrew, winget: { packageIdentifier: "Acme.Widgets" } },
+    });
+    const result = await syncCommand(dir, { deps: PUBLIC_DEPS });
+    assert.equal(result.ok, false);
+    assert.equal(result.stage, "manifest");
+    assert.equal(fs.existsSync(path.join(dir, ".github", "workflows")), false, "no workflow file may be written for a hostile manifest");
+  });
+}

package/templates/ci.yml

@@ -0,0 +1,47 @@
+# Managed by right-git — do not hand-edit. Run `right-git sync` to update.
+# Template: ci.yml | Template version: ${TEMPLATE_VERSION}
+name: ci
+on:
+  pull_request:
+  push:
+    branches: [main]
+permissions:
+  contents: read
+# F5 fix: `private-repo-guard` carries no job-level `if`, so it always runs.
+# Its one step's own `if` fires only when the repo is private, and `exit 1`
+# then fails the JOB (loud, visible, non-zero) rather than the previous
+# design of gating the whole job with `if: !private`, which made the guard
+# step unreachable and left the run merely SKIPPED — indistinguishable from
+# "nothing to do" instead of a failure nobody can miss. Every other job below
+# depends on this one, so a skipped-by-failure guard blocks them too
+# (GitHub's default `needs` semantics require the needed job to succeed).
+jobs:
+  private-repo-guard:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Refuse private repository
+        if: ${{ github.event.repository.private }}
+        run: |
+          echo "::error::right-git: repository is private; managed public-only workflows must not run here."
+          exit 1
+  test:
+    needs: [private-repo-guard]
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${OS_MATRIX}
+        node: ${NODE_MATRIX}
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: ${{ matrix.node }}
+          cache: ${PM_CACHE}
+      - run: corepack enable
+      - run: ${INSTALL_COMMAND}
+      - run: ${PM_RUN} test
+      - run: ${PM_RUN} test:random
+      - run: ${PM_RUN} test:all
+      - run: node scripts/ci/check-generated.mjs
+      - run: node scripts/ci/check-network-boundary.mjs

package/templates/package-smoke.yml

@@ -0,0 +1,37 @@
+# Managed by right-git — do not hand-edit. Run `right-git sync` to update.
+# Template: package-smoke.yml | Template version: ${TEMPLATE_VERSION}
+# Adapted from Cortex's package.yml (DESIGN.md §6).
+name: package-smoke
+on:
+  pull_request:
+  push:
+    branches: [main]
+permissions:
+  contents: read
+# F5 fix: see ci.yml for why the guard is its own always-runs job rather
+# than a job-level `if: !private` (which only skipped instead of failing).
+jobs:
+  private-repo-guard:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Refuse private repository
+        if: ${{ github.event.repository.private }}
+        run: |
+          echo "::error::right-git: repository is private; managed public-only workflows must not run here."
+          exit 1
+  clean-tarball:
+    needs: [private-repo-guard]
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${OS_MATRIX}
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
+          cache: ${PM_CACHE}
+      - run: corepack enable
+      - run: ${INSTALL_COMMAND}
+      - run: node scripts/test-package.mjs

package/templates/publish-npm.yml

@@ -0,0 +1,52 @@
+# Managed by right-git — do not hand-edit. Run `right-git sync` to update.
+# Template: publish-npm.yml | Template version: ${TEMPLATE_VERSION}
+# Extracted from Cortex's immutable-release.yml publish-npm job only
+# (DESIGN.md §6). OIDC trusted publishing is the sole publish credential —
+# no long-lived npm token, no signing material (invariant I2). Runs after
+# right-release has already built/signed/notarized locally and attached
+# artifacts to the GitHub Release (DESIGN.md §7); this job publishes the
+# source npm package itself.
+name: publish-npm
+on:
+  release:
+    types: [published]
+permissions:
+  contents: read
+# F5 fix: see ci.yml for why the guard is its own always-runs job rather
+# than a job-level `if: !private` (which only skipped instead of failing).
+jobs:
+  private-repo-guard:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Refuse private repository
+        if: ${{ github.event.repository.private }}
+        run: |
+          echo "::error::right-git: repository is private; managed public-only workflows must not run here."
+          exit 1
+  publish-npm:
+    needs: [private-repo-guard]
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.release.tag_name }}
+      - uses: actions/setup-node@v5
+        with:
+          node-version: ${NODE_PUBLISH_VERSION}
+          cache: ${PM_CACHE}
+          registry-url: https://registry.npmjs.org
+      - run: corepack enable
+      - run: ${INSTALL_COMMAND}
+      - run: node scripts/release/build-candidate.mjs --version "${{ github.event.release.tag_name }}" --platform current --out "release/candidates/publish"
+      - run: node scripts/release/check-release.mjs release/candidates/publish
+      - id: tarball
+        shell: bash
+        run: |
+          TARBALL="release/candidates/publish/$(node -e 'const c=require("./release/candidates/publish/compatibility.json");process.stdout.write(c.packageName.replace(/^@/, "").replace("/", "-")+"-"+c.version+".tgz")')"
+          test -f "$TARBALL"
+          echo "path=$TARBALL" >> "$GITHUB_OUTPUT"
+      - run: npm publish "${{ steps.tarball.outputs.path }}"${NPM_PROVENANCE_FLAG} --access public

package/templates/publish-package-managers.yml

@@ -0,0 +1,157 @@
+# Managed by right-git — do not hand-edit. Run `right-git sync` to update.
+# Template: publish-package-managers.yml | Template version: ${TEMPLATE_VERSION}
+# Adapted from Cortex's publish-package-managers.yml (DESIGN.md §6). Consumes
+# artifacts already signed locally by right-release and attached to the
+# GitHub Release — never signs anything here. Invariant I2 ("no signing
+# credential is ever configured in Actions") is about *signing* material —
+# Apple/Azure/update-key credentials — and holds here: nothing in this file
+# signs, notarizes, or handles code-signing key material.
+#
+# CREDENTIAL BOUNDARY (read before enabling this lane): this is the one lane
+# in right-git that configures long-lived repository secrets, and it is
+# opt-in only — it is rendered only when a repo's .rightgit.json explicitly
+# lists the 'publish-package-managers' lane, and `right-git install`/
+# `validateManifest` (manifest.mjs) refuse that lane unless both
+# publish.homebrew and publish.winget are supplied (--homebrew-tap,
+# --homebrew-formula, --winget-id). No repo gets these secrets by default.
+#   - HOMEBREW_TAP_TOKEN: a GitHub PAT with write access to the Homebrew tap
+#     repo (${HOMEBREW_TAP}), used only to check out that repo and open a
+#     formula-update pull request. Scoped to one tap repo, not the org; the
+#     repo owner creates and stores it, right-git never generates it.
+#   - WINGET_CREATE_GITHUB_TOKEN: a classic PAT with `public_repo` scope,
+#     passed to `wingetcreate` only via env, used only to submit a manifest
+#     PR to microsoft/winget-pkgs when the manual `submit: true` dispatch
+#     input is set.
+# Both are package-manager PR-submission tokens, not signing credentials —
+# narrower than an npm publish token, but still long-lived secrets, which is
+# why this lane (unlike every other right-git lane) requires explicit,
+# per-target configuration rather than being available by just naming it.
+#
+# Trust-posture note (do not overstate): this lane's `secrets.*` posture
+# differs from publish-npm.yml's, which is OIDC-only and stores no
+# long-lived token at all. HOMEBREW_TAP_TOKEN and WINGET_CREATE_GITHUB_TOKEN
+# ARE real, owner-provisioned, long-lived GitHub tokens sitting in this
+# repo's Actions secrets for as long as the lane stays enabled. Invariant I1
+# (right-git installs into public repos only) makes that exposure
+# public-repo-scoped, never private-repo-scoped — but "public-repo-scoped"
+# is a narrower blast radius, not zero, and is a materially different trust
+# posture from "no credential in secrets.* at all."
+#
+# WinGet stays fail-closed on a missing token and defaults to validate-only;
+# a real microsoft/winget-pkgs PR requires the manual `submit: true` dispatch
+# input (OD-4 in DESIGN.md is left open — this preserves Cortex's existing
+# reviewed-by-default behavior rather than picking a side).
+name: publish-package-managers
+on:
+  workflow_dispatch:
+    inputs:
+      submit:
+        description: 'Submit WinGet PR to microsoft/winget-pkgs (true) or validate/output-only (false)'
+        required: false
+        default: 'false'
+  release:
+    types: [published]
+permissions:
+  contents: read
+# F5 fix: see ci.yml for why the guard is its own always-runs job rather
+# than a job-level `if: !private` (which only skipped instead of failing).
+# Both root jobs below (`homebrew`, `winget-token`) depend on it, so
+# `winget` (which itself only depends on `winget-token`) is guarded
+# transitively too.
+jobs:
+  private-repo-guard:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Refuse private repository
+        if: ${{ github.event.repository.private }}
+        run: |
+          echo "::error::right-git: repository is private; managed public-only workflows must not run here."
+          exit 1
+  homebrew:
+    needs: [private-repo-guard]
+    runs-on: ubuntu-latest
+    environment: release
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
+          cache: ${PM_CACHE}
+      - run: corepack enable
+      - run: ${INSTALL_COMMAND}
+      - run: ruby -c release/homebrew/${HOMEBREW_FORMULA_NAME}.rb
+      - name: Checkout Homebrew tap
+        uses: actions/checkout@v5
+        with:
+          repository: ${HOMEBREW_TAP}
+          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+          path: homebrew-tap
+      - run: |
+          mkdir -p homebrew-tap/Formula
+          cp release/homebrew/${HOMEBREW_FORMULA_NAME}.rb homebrew-tap/Formula/${HOMEBREW_FORMULA_NAME}.rb
+      # Downstream PR only — never rewrites an existing release.
+      - name: Open Homebrew tap PR
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+          path: homebrew-tap
+          branch: ${HOMEBREW_FORMULA_NAME}-${{ github.ref_name }}
+          title: "${HOMEBREW_FORMULA_NAME} ${{ github.ref_name }}"
+          delete-branch: true
+
+  # WinGet is fail-closed: no token, no job. The token is a classic PAT with
+  # public_repo scope, created by the repo owner as WINGET_CREATE_GITHUB_TOKEN,
+  # and is only ever passed to wingetcreate via env.
+  #
+  # F5 fix: this job depends on `private-repo-guard` rather than relying on
+  # `winget` (below) alone. It has no other `needs`, so without this
+  # dependency it would run unconditionally regardless of repository
+  # visibility — the probe step always exits 0, so a repo flipped private
+  # after install could still satisfy `winget`'s `needs.winget-token` success
+  # requirement and let `winget` run its real work in a private repo.
+  winget-token:
+    needs: [private-repo-guard]
+    runs-on: ubuntu-latest
+    environment: release
+    outputs:
+      available: ${{ steps.probe.outputs.available }}
+    steps:
+      - id: probe
+        env:
+          TOKEN: ${{ secrets.WINGET_CREATE_GITHUB_TOKEN }}
+        run: echo "available=${TOKEN:+true}" >> "$GITHUB_OUTPUT"
+
+  winget:
+    needs: [winget-token]
+    runs-on: windows-latest
+    environment: release
+    if: ${{ needs.winget-token.outputs.available == 'true' }}
+    steps:
+      - uses: actions/checkout@v5
+      - name: Install wingetcreate
+        run: dotnet tool install --global Microsoft.WingetCreate
+      - name: Validate WinGet manifests (output-only)
+        shell: pwsh
+        run: |
+          $catalog = Get-Content -Raw release/catalog.json | ConvertFrom-Json
+          $installer = $catalog.artifacts | Where-Object { $_.name -like '*-Setup.exe' } | Select-Object -First 1
+          if (-not $installer) { throw 'release/catalog.json missing a *-Setup.exe installer artifact' }
+          $version = [string]$catalog.version
+          if ($version -notmatch '^\d+\.\d+\.\d+') { throw "unresolved catalog version: $version" }
+          $url = "https://github.com/${{ github.repository }}/releases/download/v$version/$($installer.name)"
+          $out = "${{ runner.temp }}\winget"
+          wingetcreate update ${WINGET_PACKAGE_IDENTIFIER} --version $version --urls $url --output $out
+          Get-ChildItem $out -Filter '${WINGET_PACKAGE_IDENTIFIER}.*' | ForEach-Object { wingetcreate validate $_.FullName }
+      - name: Submit WinGet PR to microsoft/winget-pkgs
+        if: ${{ inputs.submit == 'true' }}
+        shell: pwsh
+        env:
+          WINGET_CREATE_GITHUB_TOKEN: ${{ secrets.WINGET_CREATE_GITHUB_TOKEN }}
+        run: |
+          $catalog = Get-Content -Raw release/catalog.json | ConvertFrom-Json
+          $installer = $catalog.artifacts | Where-Object { $_.name -like '*-Setup.exe' } | Select-Object -First 1
+          if (-not $installer) { throw 'release/catalog.json missing a *-Setup.exe installer artifact' }
+          $version = [string]$catalog.version
+          if ($version -notmatch '^\d+\.\d+\.\d+') { throw "unresolved catalog version: $version" }
+          $url = "https://github.com/${{ github.repository }}/releases/download/v$version/$($installer.name)"
+          wingetcreate update ${WINGET_PACKAGE_IDENTIFIER} --version $version --urls $url --submit --token $env:WINGET_CREATE_GITHUB_TOKEN

package/templates/qualification.yml

@@ -0,0 +1,82 @@
+# Managed by right-git — do not hand-edit. Run `right-git sync` to update.
+# Template: qualification.yml | Template version: ${TEMPLATE_VERSION}
+name: qualification
+on:
+  pull_request:
+  push:
+    branches: [main]
+permissions:
+  contents: read
+# F5 fix: see ci.yml for why the guard is its own always-runs job rather
+# than a job-level `if: !private` (which only skipped instead of failing).
+jobs:
+  private-repo-guard:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Refuse private repository
+        if: ${{ github.event.repository.private }}
+        run: |
+          echo "::error::right-git: repository is private; managed public-only workflows must not run here."
+          exit 1
+  qualification:
+    needs: [private-repo-guard]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
+          cache: ${PM_CACHE}
+      - run: corepack enable
+      - run: ${INSTALL_COMMAND}
+      - run: ${PM_RUN} test:all
+  schema:
+    needs: [qualification]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
+          cache: ${PM_CACHE}
+      - run: corepack enable
+      - run: ${INSTALL_COMMAND}
+      - run: node scripts/ci/check-schema.mjs || true
+  security:
+    needs: [qualification]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
+          cache: ${PM_CACHE}
+      - run: corepack enable
+      - run: ${INSTALL_COMMAND}
+      - run: node scripts/ci/check-network-boundary.mjs
+      - name: Hostile-repository and secret-egress suite
+        run: ${PM_RUN} test:security
+  hardening:
+    needs: [qualification]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
+          cache: ${PM_CACHE}
+      - run: corepack enable
+      - run: ${INSTALL_COMMAND}
+      - run: ${PM_RUN} test:hardening
+  conformance:
+    needs: [qualification]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
+          cache: ${PM_CACHE}
+      - run: corepack enable
+      - run: ${INSTALL_COMMAND}
+      - run: ${PM_RUN} test:conformance

package/templates/release-candidate.yml

@@ -0,0 +1,48 @@
+# Managed by right-git — do not hand-edit. Run `right-git sync` to update.
+# Template: release-candidate.yml | Template version: ${TEMPLATE_VERSION}
+# Adapted from Cortex's release-candidate.yml (DESIGN.md §6). No signing
+# credentials of any kind (invariant I2) — unsigned candidate build only.
+name: release-candidate
+on:
+  workflow_dispatch:
+  push:
+    tags: ['v*']
+permissions:
+  contents: read
+# F5 fix: see ci.yml for why the guard is its own always-runs job rather
+# than a job-level `if: !private` (which only skipped instead of failing).
+jobs:
+  private-repo-guard:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Refuse private repository
+        if: ${{ github.event.repository.private }}
+        run: |
+          echo "::error::right-git: repository is private; managed public-only workflows must not run here."
+          exit 1
+  candidate:
+    needs: [private-repo-guard]
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${OS_MATRIX}
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
+          cache: ${PM_CACHE}
+      - run: corepack enable
+      - run: ${INSTALL_COMMAND}
+      - run: node --test tests/release-candidate.test.mjs
+      - run: node scripts/release/build-candidate.mjs --platform current --out "${{ runner.temp }}/${ARTIFACT_PREFIX}-rc"
+      - run: node scripts/release/check-release.mjs "${{ runner.temp }}/${ARTIFACT_PREFIX}-rc"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ${ARTIFACT_PREFIX}-rc-${{ matrix.os }}
+          path: |
+            ${{ runner.temp }}/${ARTIFACT_PREFIX}-rc/**
+            ${{ runner.temp }}/${ARTIFACT_PREFIX}-*.tar.gz
+            ${{ runner.temp }}/${ARTIFACT_PREFIX}-*.zip
+            ${{ runner.temp }}/${ARTIFACT_PREFIX}-*.sha256