@rightkit/git 0.2.0 → 0.2.1

package/README.md

@@ -19,6 +19,8 @@ GitHub Actions minutes are free and unlimited on public repos, and billed on pri
 
 Workflows are thin callers over the repo's own scripts, so a private repo running the same gates locally executes identical checks.
 
+Sync records exact prior bytes, refuses unmanaged same-name workflows, & preflights every target before any write. Qualification preserves schema logs with a unique required artifact.
+
 ## Credential posture (read before enabling package-manager publishing)
 
 - **No code-signing credential ever reaches CI.** Signing and notarization stay local in `@rightkit/release`. The only publish credential in the npm lane is short-lived OIDC (trusted publishing, no long-lived token).

package/guard-coverage.test.mjs

@@ -54,7 +54,7 @@ const FULL_MANIFEST = {
   schemaVersion: 1,
   lanes: [...KNOWN_LANES],
   matrix: { os: ["ubuntu-latest", "macos-latest", "windows-latest"], node: ["22.13", "24"] },
-  packageManager: "pnpm@11.18.0",
+  packageManager: "pnpm@11.24.0",
   publish: {
     npm: { oidc: true, provenance: true },
     homebrew: { tap: "acme/homebrew-tap", formulaName: "widgets" },
@@ -219,6 +219,13 @@ test("F5: private-repo-guard job has no job-level `if` (always runs) and fails o
   }
 });
 
+test("qualification preserves failing schema evidence as a unique required artifact", () => {
+  const template = fs.readFileSync(path.join(templatesDir, "qualification.yml"), "utf8");
+  assert.doesNotMatch(template, /\|\| true/);
+  assert.match(template, /set -o pipefail[\s\S]*tee qualification-schema\.log/);
+  assert.match(template, /uses: actions\/upload-artifact@v4[\s\S]*github\.run_id[\s\S]*github\.run_attempt[\s\S]*if-no-files-found: error/);
+});
+
 test("rust-hybrid ci keeps its work behind the public-repository guard", () => {
   const manifest = { ...FULL_MANIFEST, lanes: ["ci"], profile: "rust-hybrid", gate: { path: "scripts/gate.sh" } };
   const template = fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/ci.yml"), "utf8");

package/install.mjs

@@ -9,10 +9,10 @@ import fs from "node:fs";
 import path from "node:path";
 import { assertPublic } from "./policy/visibility-gate.mjs";
 import { MANIFEST_FILENAME, validateManifest } from "./manifest.mjs";
-import { syncCommand } from "./sync.mjs";
+import { applyPlan, planSync } from "./sync.mjs";
 
 export const DEFAULT_MATRIX = { os: ["ubuntu-latest", "macos-latest", "windows-latest"], node: ["22.13", "24"] };
-export const DEFAULT_PACKAGE_MANAGER = "pnpm@11.18.0";
+export const DEFAULT_PACKAGE_MANAGER = "pnpm@11.24.0";
 export const DEFAULT_TEMPLATE_VERSION = "1.1.0";
 
 /**
@@ -67,8 +67,14 @@ export async function installCommand(repoPath, opts = {}, deps = {}) {
   const { valid, errors } = validateManifest(manifest);
   if (!valid) return { ok: false, stage: "manifest-invalid", errors };
 
-  fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
-
-  const plan = await syncCommand(repoPath, { dryRun: false, deps });
-  return { ok: plan.ok, stage: "synced", errors: plan.errors || [], manifestPath, plan };
+  const manifestBytes = `${JSON.stringify(manifest, null, 2)}\n`;
+  const plan = await planSync(repoPath, deps, manifest);
+  if (!plan.ok) return { ok: false, stage: plan.stage, errors: plan.errors, plan };
+  fs.writeFileSync(manifestPath, manifestBytes, "utf8");
+  const applied = applyPlan(repoPath, plan);
+  if (!applied.ok) {
+    if (fs.readFileSync(manifestPath, "utf8") === manifestBytes) fs.rmSync(manifestPath);
+    return { ok: false, stage: applied.stage, errors: applied.errors, plan };
+  }
+  return { ok: true, stage: "synced", errors: [], manifestPath, plan };
 }

package/manifest.mjs

@@ -232,7 +232,12 @@ function parsePackageManager(spec) {
     yarn: "yarn install --frozen-lockfile",
   }[name];
   const runPrefix = { pnpm: "pnpm run", npm: "npm run", yarn: "yarn run" }[name];
-  return { name, version, installCommand, runPrefix };
+  const setup = {
+    pnpm: `      - uses: pnpm/action-setup@v4\n        with:\n          version: ${version}`,
+    npm: "",
+    yarn: `      - run: corepack enable && corepack prepare yarn@${version} --activate`,
+  }[name];
+  return { name, version, installCommand, runPrefix, setup };
 }
 
 function yamlFlowStringList(values) {
@@ -274,6 +279,7 @@ export function buildRenderContext(manifest, repoPath) {
     PM_CACHE: pm.name,
     INSTALL_COMMAND: pm.installCommand,
     PM_RUN: pm.runPrefix,
+    PACKAGE_MANAGER_SETUP: pm.setup,
     ARTIFACT_PREFIX: artifactPrefix,
     TEMPLATE_VERSION: manifest.templateVersion,
     GATE_PATH: manifest.gate?.path,

package/manifest.test.mjs

@@ -6,7 +6,7 @@ const VALID_MINIMAL = {
   schemaVersion: 1,
   lanes: ["ci"],
   matrix: { os: ["ubuntu-latest"], node: ["22.13"] },
-  packageManager: "pnpm@11.18.0",
+  packageManager: "pnpm@11.24.0",
   templateVersion: "1.0.0",
 };
 

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@rightkit/git",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
+  "license": "MIT OR Apache-2.0",
   "type": "module",
   "bin": {
     "right-git": "cli/right-git.mjs"
@@ -20,7 +21,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/adrdsouza/claude.git",
+    "url": "git+https://github.com/bogusyogi/claude.git",
     "directory": "tools/rightkit/packages/git"
   },
   "scripts": {

package/render.test.mjs

@@ -13,7 +13,7 @@ const FULL_MANIFEST = {
   schemaVersion: 1,
   lanes: [...KNOWN_LANES],
   matrix: { os: ["ubuntu-latest", "macos-latest", "windows-latest"], node: ["22.13", "24"] },
-  packageManager: "pnpm@11.18.0",
+  packageManager: "pnpm@11.24.0",
   publish: {
     npm: { oidc: true, provenance: true },
     homebrew: { tap: "acme/homebrew-tap", formulaName: "widgets" },
@@ -45,7 +45,8 @@ test("every known lane has a template file and renders without an unresolved pla
 test("rust-hybrid ci renders its pinned package manager and gate", () => {
   const manifest = { ...FULL_MANIFEST, lanes: ["ci"], profile: "rust-hybrid", gate: { path: "scripts/gate.sh" }, templateVersion: "1.1.0" };
   const content = renderTemplate(fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/ci.yml"), "utf8"), buildRenderContext(manifest, "/repos/widgets"));
-  assert.match(content, /corepack prepare pnpm@11\.18\.0 --activate/);
+  assert.match(content, /uses: pnpm\/action-setup@v4/);
+  assert.match(content, /version: 11\.24\.0/);
   assert.match(content, /rustup toolchain install stable/);
   assert.match(content, /bash \.\/scripts\/gate\.sh/);
 });
@@ -59,7 +60,7 @@ test("render determinism: same manifest renders byte-identical output every time
 });
 
 test("rendered workflows never request pnpm or yarn setup-node caching before package-manager activation", () => {
-  for (const packageManager of ["pnpm@11.18.0", "yarn@4.6.0"]) {
+  for (const packageManager of ["pnpm@11.24.0", "yarn@4.6.0"]) {
     const rendered = renderAllLanes({ ...FULL_MANIFEST, packageManager }, "/repos/widgets");
     for (const [lane, content] of Object.entries(rendered)) {
       assert.doesNotMatch(
@@ -71,6 +72,26 @@ test("rendered workflows never request pnpm or yarn setup-node caching before pa
   }
 });
 
+test("rendered workflows bootstrap each declared package manager safely", () => {
+  const pnpm = renderAllLanes({ ...FULL_MANIFEST, packageManager: "pnpm@11.24.0" }, "/repos/widgets");
+  for (const content of Object.values(pnpm)) {
+    assert.match(content, /uses: pnpm\/action-setup@v4/);
+    assert.match(content, /version: 11\.24\.0/);
+    assert.doesNotMatch(content, /corepack enable/);
+  }
+
+  const npm = renderAllLanes({ ...FULL_MANIFEST, packageManager: "npm@11.0.0" }, "/repos/widgets");
+  for (const content of Object.values(npm)) {
+    assert.doesNotMatch(content, /pnpm\/action-setup|corepack enable/);
+  }
+
+  const yarn = renderAllLanes({ ...FULL_MANIFEST, packageManager: "yarn@4.6.0" }, "/repos/widgets");
+  for (const content of Object.values(yarn)) {
+    assert.match(content, /corepack prepare yarn@4\.6\.0 --activate/);
+    assert.doesNotMatch(content, /pnpm\/action-setup/);
+  }
+});
+
 // F5 fix: a job-level `if: !private` on the real work job means GitHub
 // SKIPS that job entirely for a private repo — the nested "refuse" step
 // inside it is then unreachable and never runs, so nothing fails and the

package/sync.mjs

@@ -70,13 +70,15 @@ export function lineDiff(oldText, newText) {
  * managed file whose lane fell out of the manifest.
  * Returns a typed result — never throws.
  */
-export async function planSync(repoPath, deps = {}) {
+export async function planSync(repoPath, deps = {}, manifestOverride = null) {
   const visibility = await assertPublic(repoPath, deps);
   if (!visibility.allowed) {
     return { ok: false, stage: "visibility", errors: [visibility.reason], changes: [] };
   }
 
-  const loaded = loadManifest(repoPath);
+  const loaded = manifestOverride === null
+    ? loadManifest(repoPath)
+    : { ok: true, manifest: manifestOverride };
   if (!loaded.ok) {
     return { ok: false, stage: "manifest", errors: loaded.errors, changes: [] };
   }
@@ -94,24 +96,38 @@ export async function planSync(repoPath, deps = {}) {
       // not installed yet
     }
     if (existing === content) {
-      changes.push({ lane, filename, action: "unchanged", diff: [] });
+      changes.push({ lane, filename, action: "unchanged", before: existing, diff: [] });
+    } else if (existing !== null && !existing.startsWith(MANAGED_MARKER)) {
+      changes.push({ lane, filename, action: "managed-conflict", before: existing, diff: [] });
     } else {
-      changes.push({ lane, filename, action: existing === null ? "create" : "update", diff: lineDiff(existing, content), content });
+      changes.push({ lane, filename, action: existing === null ? "create" : "update", before: existing, diff: lineDiff(existing, content), content });
     }
   }
 
   for (const managedFilename of listManagedFiles(repoPath)) {
     if (!wantedFilenames.has(managedFilename)) {
-      changes.push({ lane: null, filename: managedFilename, action: "remove", diff: [] });
+      changes.push({ lane: null, filename: managedFilename, action: "remove", before: fs.readFileSync(path.join(repoPath, WORKFLOWS_SUBDIR, managedFilename), "utf8"), diff: [] });
     }
   }
 
-  return { ok: true, stage: "planned", errors: [], changes };
+  const conflicts = changes.filter((change) => change.action === "managed-conflict");
+  return conflicts.length
+    ? { ok: false, stage: "managed-conflict", errors: conflicts.map((change) => `${change.filename} is unmanaged`), changes }
+    : { ok: true, stage: "planned", errors: [], changes };
 }
 
 /** Apply a plan produced by planSync: write/update/remove files on disk. */
 export function applyPlan(repoPath, plan) {
   const dir = path.join(repoPath, WORKFLOWS_SUBDIR);
+  for (const change of plan.changes) {
+    if (change.action === "unchanged") continue;
+    const target = path.join(dir, change.filename);
+    let current = null;
+    try { current = fs.readFileSync(target, "utf8"); } catch {}
+    if (current !== change.before) {
+      return { ok: false, stage: "apply-conflict", errors: [`${change.filename} changed after planning`] };
+    }
+  }
   fs.mkdirSync(dir, { recursive: true });
   for (const change of plan.changes) {
     const target = path.join(dir, change.filename);
@@ -121,6 +137,7 @@ export function applyPlan(repoPath, plan) {
       fs.rmSync(target, { force: true });
     }
   }
+  return { ok: true, stage: "applied", errors: [] };
 }
 
 /** Full sync: plan, print diff, apply unless dryRun. Returns the plan. */
@@ -135,7 +152,8 @@ export async function syncCommand(repoPath, { dryRun = false, deps = {} } = {})
   }
 
   if (!dryRun) {
-    applyPlan(repoPath, plan);
+    const applied = applyPlan(repoPath, plan);
+    if (!applied.ok) return { ...plan, ...applied };
   }
   return plan;
 }

package/sync.test.mjs

@@ -2,7 +2,7 @@ import test from "node:test";
 import assert from "node:assert/strict";
 import fs from "node:fs";
 import path from "node:path";
-import { syncCommand } from "./sync.mjs";
+import { applyPlan, planSync, syncCommand } from "./sync.mjs";
 import { makeTempRepo, PUBLIC_DEPS, PRIVATE_DEPS, SAMPLE_MANIFEST } from "./test-support.mjs";
 
 test("sync refuses a private repo and writes nothing", async () => {
@@ -54,6 +54,27 @@ test("sync reports manifest errors instead of writing files", async () => {
   assert.equal(result.stage, "manifest");
 });
 
+test("sync refuses an unmanaged same-name workflow", async () => {
+  const dir = makeTempRepo(SAMPLE_MANIFEST);
+  const target = path.join(dir, ".github", "workflows", "ci.yml");
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.writeFileSync(target, "name: handwritten\n", "utf8");
+  const result = await syncCommand(dir, { deps: PUBLIC_DEPS });
+  assert.equal(result.stage, "managed-conflict");
+  assert.equal(fs.readFileSync(target, "utf8"), "name: handwritten\n");
+});
+
+test("apply preflights every planned byte before writing", async () => {
+  const dir = makeTempRepo(SAMPLE_MANIFEST);
+  const plan = await planSync(dir, PUBLIC_DEPS);
+  const target = path.join(dir, ".github", "workflows", "ci.yml");
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.writeFileSync(target, "raced\n", "utf8");
+  const applied = applyPlan(dir, plan);
+  assert.equal(applied.stage, "apply-conflict");
+  assert.equal(fs.existsSync(path.join(dir, ".github", "workflows", "package-smoke.yml")), false);
+});
+
 // F15 end-to-end: a hostile `.rightgit.json` on disk — the real attack
 // surface, not just the in-memory validateManifest() unit — must be refused
 // at the manifest stage, before renderLanes() (and therefore render.mjs's

package/templates/ci.yml

@@ -37,7 +37,8 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ matrix.node }}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: ${PM_RUN} test
       - run: ${PM_RUN} test:random

package/templates/package-smoke.yml

@@ -31,6 +31,7 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: node scripts/test-package.mjs

package/templates/profiles/rust-hybrid/ci.yml

@@ -24,6 +24,7 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ matrix.node }}
-      - run: corepack enable && corepack prepare ${PM_NAME}@${PM_VERSION} --activate
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: rustup toolchain install stable --profile minimal
       - run: bash ./${GATE_PATH}

package/templates/publish-npm.yml

@@ -1,7 +1,6 @@
 # Managed by right-git — do not hand-edit. Run `right-git sync` to update.
 # Template: publish-npm.yml | Template version: ${TEMPLATE_VERSION}
-# Extracted from Cortex's immutable-release.yml publish-npm job only
-# (DESIGN.md §6). OIDC trusted publishing is the sole publish credential —
+# OIDC trusted publishing is the sole publish credential —
 # no long-lived npm token, no signing material (invariant I2). Runs after
 # right-release has already built/signed/notarized locally and attached
 # artifacts to the GitHub Release (DESIGN.md §7); this job publishes the
@@ -38,7 +37,8 @@ jobs:
         with:
           node-version: ${NODE_PUBLISH_VERSION}
           registry-url: https://registry.npmjs.org
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: node scripts/release/build-candidate.mjs --version "${{ github.event.release.tag_name }}" --platform current --out "release/candidates/publish"
       - run: node scripts/release/check-release.mjs release/candidates/publish

package/templates/publish-package-managers.yml

@@ -76,7 +76,8 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: ruby -c release/homebrew/${HOMEBREW_FORMULA_NAME}.rb
       - name: Checkout Homebrew tap

package/templates/qualification.yml

@@ -26,7 +26,8 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: ${PM_RUN} test:all
   schema:
@@ -37,9 +38,21 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
-      - run: node scripts/ci/check-schema.mjs || true
+      - name: Check schema with evidence log
+        shell: bash
+        run: |
+          set -o pipefail
+          node scripts/ci/check-schema.mjs 2>&1 | tee qualification-schema.log
+      - name: Upload schema evidence
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: qualification-schema-${{ github.run_id }}-${{ github.run_attempt }}
+          path: qualification-schema.log
+          if-no-files-found: error
   security:
     needs: [qualification]
     runs-on: ubuntu-latest
@@ -48,7 +61,8 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: node scripts/ci/check-network-boundary.mjs
       - name: Hostile-repository and secret-egress suite
@@ -61,7 +75,8 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: ${PM_RUN} test:hardening
   conformance:
@@ -72,6 +87,7 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: ${PM_RUN} test:conformance

package/templates/release-candidate.yml

@@ -32,7 +32,8 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: ${{ fromJSON('${NODE_MATRIX}')[0] }}
-      - run: corepack enable
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
       - run: node --test tests/release-candidate.test.mjs
       - run: node scripts/release/build-candidate.mjs --platform current --out "${{ runner.temp }}/${ARTIFACT_PREFIX}-rc"

package/test-support.mjs

@@ -28,6 +28,6 @@ export const SAMPLE_MANIFEST = {
   schemaVersion: 1,
   lanes: ["ci", "package-smoke"],
   matrix: { os: ["ubuntu-latest"], node: ["22.13"] },
-  packageManager: "pnpm@11.18.0",
+  packageManager: "pnpm@11.24.0",
   templateVersion: "1.0.0",
 };

package/uninstall.test.mjs

@@ -33,7 +33,7 @@ test("uninstall removes every managed file, leaving zero behind — including th
 // only ever looked at marker-bearing workflow files, so it reported success
 // while leaving the manifest behind. Reproduces the QA report's
 // "interruptedInstall" probe.
-test("F6: uninstall removes the manifest left behind by an install interrupted after the visibility check", async () => {
+test("install rolls back precisely when visibility changes after preflight", async () => {
   const dir = makeTempRepo(null);
   let calls = 0;
   const flakyDeps = {
@@ -47,13 +47,8 @@ test("F6: uninstall removes the manifest left behind by an install interrupted a
 
   const installResult = await installCommand(dir, { lanes: ["ci"] }, flakyDeps);
   assert.equal(installResult.ok, false);
-  assert.equal(installResult.stage, "synced");
-  assert.ok(fs.existsSync(path.join(dir, MANIFEST_FILENAME)), "setup: interrupted install must still leave the manifest on disk");
-
-  const uninstallResult = uninstallCommand(dir);
-  assert.equal(uninstallResult.ok, true);
-  assert.ok(uninstallResult.removed.includes(MANIFEST_FILENAME));
-  assert.equal(fs.existsSync(path.join(dir, MANIFEST_FILENAME)), false, "F6: manifest must not survive uninstall after an interrupted install");
+  assert.equal(installResult.stage, "visibility");
+  assert.equal(fs.existsSync(path.join(dir, MANIFEST_FILENAME)), false);
 });
 
 test("uninstall never touches an unmanaged file in the same directory", async () => {
@@ -75,3 +70,10 @@ test("uninstall on a repo with no managed files is a no-op, not an error", () =>
   assert.equal(result.ok, true);
   assert.deepEqual(result.removed, []);
 });
+
+test("install validates before it creates a manifest", async () => {
+  const dir = makeTempRepo(null);
+  const result = await installCommand(dir, { lanes: ["not-a-lane"] }, PUBLIC_DEPS);
+  assert.equal(result.stage, "manifest-invalid");
+  assert.equal(fs.existsSync(path.join(dir, MANIFEST_FILENAME)), false);
+});