@rightkit/git 0.2.1 → 0.2.2

package/README.md

@@ -38,4 +38,4 @@ Node builtins only; no runtime dependencies.
 
 ## Profiles
 
-`profile` defaults to `node`. `rust-hybrid` accepts only `ci`, requires safe relative `gate.path`, installs pinned Node plus `rustup stable`, then runs that gate. It never adds release, signing, publishing, or approval steps.
+`profile` defaults to `node`. `rust-hybrid` requires `ci`, accepts optional `release-candidate`, installs pinned Node plus `rustup stable`, then runs product-owned package scripts. Candidate configuration is `{ buildScript, checkScript, artifactRoot }`; RightGit passes an isolated `RIGHT_GIT_ARTIFACT_ROOT`, checks it, & uploads it as an unsigned handoff. It never signs, finalizes, publishes releases, or receives signing credentials.

package/manifest.mjs

@@ -57,8 +57,10 @@ const TOP_LEVEL_KEYS = new Set([
   "templateVersion",
   "profile",
   "gate",
+  "candidate",
 ]);
 const GATE_PATH_RE = /^(?!.*\.\.)(?!.*\s)[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+const PACKAGE_SCRIPT_RE = /^[A-Za-z0-9][A-Za-z0-9:_-]*$/;
 
 /**
  * Validate a parsed manifest object against the right-git manifest contract.
@@ -123,7 +125,9 @@ export function validateManifest(manifest) {
   const profile = manifest.profile === undefined ? "node" : manifest.profile;
   if (profile !== "node" && profile !== "rust-hybrid") errors.push("profile must be 'node' or 'rust-hybrid'");
   if (profile === "rust-hybrid") {
-    if (lanes.length !== 1 || lanes[0] !== "ci") errors.push("profile 'rust-hybrid' supports only lane 'ci'");
+    if (lanes.some((lane) => lane !== "ci" && lane !== "release-candidate") || !lanes.includes("ci")) {
+      errors.push("profile 'rust-hybrid' requires lane 'ci' and supports optional lane 'release-candidate'");
+    }
     if (!manifest.gate || typeof manifest.gate !== "object" || Array.isArray(manifest.gate) || Object.keys(manifest.gate).some((key) => key !== "path") || typeof manifest.gate.path !== "string" || !GATE_PATH_RE.test(manifest.gate.path)) {
       errors.push("profile 'rust-hybrid' requires gate.path with a safe relative path");
     }
@@ -131,6 +135,31 @@ export function validateManifest(manifest) {
     errors.push("gate is only valid for profile 'rust-hybrid'");
   }
 
+  const candidate = manifest.candidate;
+  if (candidate !== undefined) {
+    if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) {
+      errors.push("candidate must be an object");
+    } else {
+      for (const key of Object.keys(candidate)) {
+        if (!["buildScript", "checkScript", "artifactRoot"].includes(key)) errors.push(`unknown candidate field: ${key}`);
+      }
+      for (const key of ["buildScript", "checkScript"]) {
+        if (typeof candidate[key] !== "string" || !PACKAGE_SCRIPT_RE.test(candidate[key])) {
+          errors.push(`candidate.${key} must be one safe package script name`);
+        }
+      }
+      if (typeof candidate.artifactRoot !== "string" || !GATE_PATH_RE.test(candidate.artifactRoot)) {
+        errors.push("candidate.artifactRoot must be one safe relative path");
+      }
+    }
+  }
+  if (profile === "rust-hybrid" && lanes.includes("release-candidate") && candidate === undefined) {
+    errors.push("rust-hybrid release-candidate lane requires candidate { buildScript, checkScript, artifactRoot }");
+  }
+  if (profile !== "rust-hybrid" && candidate !== undefined) {
+    errors.push("candidate is only valid for profile 'rust-hybrid'");
+  }
+
   const publish = manifest.publish;
   if (publish !== undefined) {
     if (publish === null || typeof publish !== "object" || Array.isArray(publish)) {
@@ -283,6 +312,9 @@ export function buildRenderContext(manifest, repoPath) {
     ARTIFACT_PREFIX: artifactPrefix,
     TEMPLATE_VERSION: manifest.templateVersion,
     GATE_PATH: manifest.gate?.path,
+    CANDIDATE_BUILD_SCRIPT: manifest.candidate?.buildScript,
+    CANDIDATE_CHECK_SCRIPT: manifest.candidate?.checkScript,
+    CANDIDATE_ARTIFACT_ROOT: manifest.candidate?.artifactRoot,
   };
 
   if (manifest.publish?.npm) {

package/manifest.schema.json

@@ -85,6 +85,16 @@
     "gate": {
       "type": "object", "required": ["path"], "additionalProperties": false,
       "properties": { "path": { "type": "string", "pattern": "^(?!.*\\.\\.)(?!.*\\s)[A-Za-z0-9][A-Za-z0-9._/-]*$" } }
+    },
+    "candidate": {
+      "type": "object",
+      "required": ["buildScript", "checkScript", "artifactRoot"],
+      "additionalProperties": false,
+      "properties": {
+        "buildScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
+        "checkScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
+        "artifactRoot": { "type": "string", "pattern": "^(?!.*\\.\\.)(?!.*\\s)[A-Za-z0-9][A-Za-z0-9._/-]*$" }
+      }
     }
   }
 }

package/manifest.test.mjs

@@ -16,13 +16,21 @@ test("accepts a minimal valid manifest", () => {
   assert.deepEqual(errors, []);
 });
 
-test("rust-hybrid requires only ci and a safe gate path", () => {
+test("rust-hybrid supports ci plus a configured unsigned release-candidate lane", () => {
   const valid = { ...VALID_MINIMAL, profile: "rust-hybrid", gate: { path: "scripts/gate.sh" } };
   assert.equal(validateManifest(valid).valid, true);
   for (const path of ["/tmp/gate.sh", "../gate.sh", "scripts/gate sh", "${{ secrets.X }}", "scripts/gate;sh"]) {
     assert.equal(validateManifest({ ...valid, gate: { path } }).valid, false, path);
   }
   assert.equal(validateManifest({ ...valid, lanes: ["ci", "qualification"] }).valid, false);
+  const candidate = {
+    ...valid,
+    lanes: ["ci", "release-candidate"],
+    candidate: { buildScript: "ci:candidate", checkScript: "ci:candidate-check", artifactRoot: "legion-unsigned" },
+  };
+  assert.equal(validateManifest(candidate).valid, true);
+  assert.equal(validateManifest({ ...candidate, candidate: { ...candidate.candidate, buildScript: "echo unsafe" } }).valid, false);
+  assert.equal(validateManifest({ ...candidate, candidate: { ...candidate.candidate, artifactRoot: "../escape" } }).valid, false);
 });
 
 test("rejects non-object input", () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/git",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/render.test.mjs

@@ -51,6 +51,26 @@ test("rust-hybrid ci renders its pinned package manager and gate", () => {
   assert.match(content, /bash \.\/scripts\/gate\.sh/);
 });
 
+test("rust-hybrid release candidate renders product scripts, artifact handoff, and no signing secret", () => {
+  const manifest = {
+    ...FULL_MANIFEST,
+    lanes: ["ci", "release-candidate"],
+    profile: "rust-hybrid",
+    gate: { path: "scripts/gate.sh" },
+    candidate: { buildScript: "ci:candidate", checkScript: "ci:candidate-check", artifactRoot: "widgets-unsigned" },
+    templateVersion: "1.2.0",
+  };
+  const content = renderTemplate(
+    fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
+    buildRenderContext(manifest, "/repos/widgets"),
+  );
+  assert.match(content, /pnpm run ci:candidate/);
+  assert.match(content, /pnpm run ci:candidate-check/);
+  assert.match(content, /RIGHT_GIT_ARTIFACT_ROOT/);
+  assert.match(content, /actions\/upload-artifact@v4/);
+  assert.doesNotMatch(content, /secrets\.|AZURE_|APPLE_|certificate|private.key/i);
+});
+
 test("render determinism: same manifest renders byte-identical output every time", () => {
   const first = renderAllLanes(FULL_MANIFEST, "/repos/widgets");
   const second = renderAllLanes(FULL_MANIFEST, "/repos/widgets");

package/templates/profiles/rust-hybrid/release-candidate.yml

@@ -0,0 +1,49 @@
+# Managed by right-git — do not hand-edit. Run `right-git sync` to update.
+# Template: profiles/rust-hybrid/release-candidate.yml | Template version: ${TEMPLATE_VERSION}
+# Public CI produces unsigned candidates only. Signing credentials, finalization,
+# release publication, & stable bootstrap publication remain protected-host work.
+name: release-candidate
+on:
+  workflow_dispatch:
+  push:
+    tags: ['v*']
+permissions:
+  contents: read
+jobs:
+  private-repo-guard:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Refuse private repository
+        if: ${{ github.event.repository.private }}
+        run: exit 1
+  candidate:
+    needs: [private-repo-guard]
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${OS_MATRIX}
+        node: ${NODE_MATRIX}
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: ${{ matrix.node }}
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
+      - run: rustup toolchain install stable --profile minimal
+      - run: ${INSTALL_COMMAND}
+      - name: Build unsigned release candidate
+        run: ${PM_RUN} ${CANDIDATE_BUILD_SCRIPT}
+        env:
+          RIGHT_GIT_ARTIFACT_ROOT: ${{ runner.temp }}/${CANDIDATE_ARTIFACT_ROOT}
+      - name: Check unsigned release candidate
+        run: ${PM_RUN} ${CANDIDATE_CHECK_SCRIPT}
+        env:
+          RIGHT_GIT_ARTIFACT_ROOT: ${{ runner.temp }}/${CANDIDATE_ARTIFACT_ROOT}
+      - name: Upload unsigned candidate handoff
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${ARTIFACT_PREFIX}-unsigned-${{ matrix.os }}-${{ matrix.node }}
+          path: ${{ runner.temp }}/${CANDIDATE_ARTIFACT_ROOT}/**
+          if-no-files-found: error