@rightkit/git 0.2.1 → 0.2.3

package/README.md

@@ -38,4 +38,4 @@ Node builtins only; no runtime dependencies.
 
 ## Profiles
 
-`profile` defaults to `node`. `rust-hybrid` accepts only `ci`, requires safe relative `gate.path`, installs pinned Node plus `rustup stable`, then runs that gate. It never adds release, signing, publishing, or approval steps.
+`profile` defaults to `node`. `rust-hybrid` requires `ci`, accepts optional `release-candidate`, installs pinned Node plus `rustup stable`, then runs product-owned package scripts. Candidate configuration is `{ buildScript, checkScript, artifactRoot }`; RightGit passes an isolated `RIGHT_GIT_ARTIFACT_ROOT`, checks it, & uploads it as an unsigned handoff. It never signs, finalizes, publishes releases, or receives signing credentials.

package/manifest.mjs

@@ -57,8 +57,10 @@ const TOP_LEVEL_KEYS = new Set([
   "templateVersion",
   "profile",
   "gate",
+  "candidate",
 ]);
 const GATE_PATH_RE = /^(?!.*\.\.)(?!.*\s)[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+const PACKAGE_SCRIPT_RE = /^[A-Za-z0-9][A-Za-z0-9:_-]*$/;
 
 /**
  * Validate a parsed manifest object against the right-git manifest contract.
@@ -123,7 +125,9 @@ export function validateManifest(manifest) {
   const profile = manifest.profile === undefined ? "node" : manifest.profile;
   if (profile !== "node" && profile !== "rust-hybrid") errors.push("profile must be 'node' or 'rust-hybrid'");
   if (profile === "rust-hybrid") {
-    if (lanes.length !== 1 || lanes[0] !== "ci") errors.push("profile 'rust-hybrid' supports only lane 'ci'");
+    if (lanes.some((lane) => lane !== "ci" && lane !== "release-candidate") || !lanes.includes("ci")) {
+      errors.push("profile 'rust-hybrid' requires lane 'ci' and supports optional lane 'release-candidate'");
+    }
     if (!manifest.gate || typeof manifest.gate !== "object" || Array.isArray(manifest.gate) || Object.keys(manifest.gate).some((key) => key !== "path") || typeof manifest.gate.path !== "string" || !GATE_PATH_RE.test(manifest.gate.path)) {
       errors.push("profile 'rust-hybrid' requires gate.path with a safe relative path");
     }
@@ -131,6 +135,31 @@ export function validateManifest(manifest) {
     errors.push("gate is only valid for profile 'rust-hybrid'");
   }
 
+  const candidate = manifest.candidate;
+  if (candidate !== undefined) {
+    if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) {
+      errors.push("candidate must be an object");
+    } else {
+      for (const key of Object.keys(candidate)) {
+        if (!["buildScript", "checkScript", "artifactRoot"].includes(key)) errors.push(`unknown candidate field: ${key}`);
+      }
+      for (const key of ["buildScript", "checkScript"]) {
+        if (typeof candidate[key] !== "string" || !PACKAGE_SCRIPT_RE.test(candidate[key])) {
+          errors.push(`candidate.${key} must be one safe package script name`);
+        }
+      }
+      if (typeof candidate.artifactRoot !== "string" || !GATE_PATH_RE.test(candidate.artifactRoot)) {
+        errors.push("candidate.artifactRoot must be one safe relative path");
+      }
+    }
+  }
+  if (profile === "rust-hybrid" && lanes.includes("release-candidate") && candidate === undefined) {
+    errors.push("rust-hybrid release-candidate lane requires candidate { buildScript, checkScript, artifactRoot }");
+  }
+  if (profile !== "rust-hybrid" && candidate !== undefined) {
+    errors.push("candidate is only valid for profile 'rust-hybrid'");
+  }
+
   const publish = manifest.publish;
   if (publish !== undefined) {
     if (publish === null || typeof publish !== "object" || Array.isArray(publish)) {
@@ -233,7 +262,7 @@ function parsePackageManager(spec) {
   }[name];
   const runPrefix = { pnpm: "pnpm run", npm: "npm run", yarn: "yarn run" }[name];
   const setup = {
-    pnpm: `      - uses: pnpm/action-setup@v4\n        with:\n          version: ${version}`,
+    pnpm: `      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10\n        with:\n          version: ${version}`,
     npm: "",
     yarn: `      - run: corepack enable && corepack prepare yarn@${version} --activate`,
   }[name];
@@ -283,6 +312,9 @@ export function buildRenderContext(manifest, repoPath) {
     ARTIFACT_PREFIX: artifactPrefix,
     TEMPLATE_VERSION: manifest.templateVersion,
     GATE_PATH: manifest.gate?.path,
+    CANDIDATE_BUILD_SCRIPT: manifest.candidate?.buildScript,
+    CANDIDATE_CHECK_SCRIPT: manifest.candidate?.checkScript,
+    CANDIDATE_ARTIFACT_ROOT: manifest.candidate?.artifactRoot,
   };
 
   if (manifest.publish?.npm) {

package/manifest.schema.json

@@ -85,6 +85,16 @@
     "gate": {
       "type": "object", "required": ["path"], "additionalProperties": false,
       "properties": { "path": { "type": "string", "pattern": "^(?!.*\\.\\.)(?!.*\\s)[A-Za-z0-9][A-Za-z0-9._/-]*$" } }
+    },
+    "candidate": {
+      "type": "object",
+      "required": ["buildScript", "checkScript", "artifactRoot"],
+      "additionalProperties": false,
+      "properties": {
+        "buildScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
+        "checkScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
+        "artifactRoot": { "type": "string", "pattern": "^(?!.*\\.\\.)(?!.*\\s)[A-Za-z0-9][A-Za-z0-9._/-]*$" }
+      }
     }
   }
 }

package/manifest.test.mjs

@@ -16,13 +16,21 @@ test("accepts a minimal valid manifest", () => {
   assert.deepEqual(errors, []);
 });
 
-test("rust-hybrid requires only ci and a safe gate path", () => {
+test("rust-hybrid supports ci plus a configured unsigned release-candidate lane", () => {
   const valid = { ...VALID_MINIMAL, profile: "rust-hybrid", gate: { path: "scripts/gate.sh" } };
   assert.equal(validateManifest(valid).valid, true);
   for (const path of ["/tmp/gate.sh", "../gate.sh", "scripts/gate sh", "${{ secrets.X }}", "scripts/gate;sh"]) {
     assert.equal(validateManifest({ ...valid, gate: { path } }).valid, false, path);
   }
   assert.equal(validateManifest({ ...valid, lanes: ["ci", "qualification"] }).valid, false);
+  const candidate = {
+    ...valid,
+    lanes: ["ci", "release-candidate"],
+    candidate: { buildScript: "ci:candidate", checkScript: "ci:candidate-check", artifactRoot: "legion-unsigned" },
+  };
+  assert.equal(validateManifest(candidate).valid, true);
+  assert.equal(validateManifest({ ...candidate, candidate: { ...candidate.candidate, buildScript: "echo unsafe" } }).valid, false);
+  assert.equal(validateManifest({ ...candidate, candidate: { ...candidate.candidate, artifactRoot: "../escape" } }).valid, false);
 });
 
 test("rejects non-object input", () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/git",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/render.test.mjs

@@ -45,12 +45,32 @@ test("every known lane has a template file and renders without an unresolved pla
 test("rust-hybrid ci renders its pinned package manager and gate", () => {
   const manifest = { ...FULL_MANIFEST, lanes: ["ci"], profile: "rust-hybrid", gate: { path: "scripts/gate.sh" }, templateVersion: "1.1.0" };
   const content = renderTemplate(fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/ci.yml"), "utf8"), buildRenderContext(manifest, "/repos/widgets"));
-  assert.match(content, /uses: pnpm\/action-setup@v4/);
+  assert.match(content, /uses: pnpm\/action-setup@[a-f0-9]{40}/);
   assert.match(content, /version: 11\.24\.0/);
-  assert.match(content, /rustup toolchain install stable/);
+  assert.match(content, /toolchain: 1\.98\.0/);
   assert.match(content, /bash \.\/scripts\/gate\.sh/);
 });
 
+test("rust-hybrid release candidate renders product scripts, artifact handoff, and no signing secret", () => {
+  const manifest = {
+    ...FULL_MANIFEST,
+    lanes: ["ci", "release-candidate"],
+    profile: "rust-hybrid",
+    gate: { path: "scripts/gate.sh" },
+    candidate: { buildScript: "ci:candidate", checkScript: "ci:candidate-check", artifactRoot: "widgets-unsigned" },
+    templateVersion: "1.2.0",
+  };
+  const content = renderTemplate(
+    fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
+    buildRenderContext(manifest, "/repos/widgets"),
+  );
+  assert.match(content, /pnpm run ci:candidate/);
+  assert.match(content, /pnpm run ci:candidate-check/);
+  assert.match(content, /RIGHT_GIT_ARTIFACT_ROOT/);
+  assert.match(content, /actions\/upload-artifact@[a-f0-9]{40}/);
+  assert.doesNotMatch(content, /secrets\.|AZURE_|APPLE_|certificate|private.key/i);
+});
+
 test("render determinism: same manifest renders byte-identical output every time", () => {
   const first = renderAllLanes(FULL_MANIFEST, "/repos/widgets");
   const second = renderAllLanes(FULL_MANIFEST, "/repos/widgets");
@@ -75,7 +95,7 @@ test("rendered workflows never request pnpm or yarn setup-node caching before pa
 test("rendered workflows bootstrap each declared package manager safely", () => {
   const pnpm = renderAllLanes({ ...FULL_MANIFEST, packageManager: "pnpm@11.24.0" }, "/repos/widgets");
   for (const content of Object.values(pnpm)) {
-    assert.match(content, /uses: pnpm\/action-setup@v4/);
+    assert.match(content, /uses: pnpm\/action-setup@[a-f0-9]{40}/);
     assert.match(content, /version: 11\.24\.0/);
     assert.doesNotMatch(content, /corepack enable/);
   }

package/templates/profiles/rust-hybrid/ci.yml

@@ -1,12 +1,15 @@
 # Managed by right-git — do not hand-edit. Run `right-git sync` to update.
 # Template: profiles/rust-hybrid/ci.yml | Template version: ${TEMPLATE_VERSION}
-name: ci
-on: [push, pull_request]
+name: legion-ci
+on:
+  pull_request:
+  push:
+    branches: [main]
 permissions:
   contents: read
 jobs:
   private-repo-guard:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Refuse private repository
         if: ${{ github.event.repository.private }}
@@ -20,11 +23,17 @@ jobs:
         node: ${NODE_MATRIX}
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node }}
           package-manager-cache: false
 ${PACKAGE_MANAGER_SETUP}
-      - run: rustup toolchain install stable --profile minimal
+      - uses: dtolnay/rust-toolchain@f8be11a05b1d4f3fcebe6410cc16743212b999b0
+        with:
+          toolchain: 1.98.0
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          workspaces: engine
       - run: bash ./${GATE_PATH}

package/templates/profiles/rust-hybrid/release-candidate.yml

@@ -0,0 +1,55 @@
+# Managed by right-git — do not hand-edit. Run `right-git sync` to update.
+# Template: profiles/rust-hybrid/release-candidate.yml | Template version: ${TEMPLATE_VERSION}
+# Public CI produces unsigned candidates only. Signing credentials, finalization,
+# release publication, & stable bootstrap publication remain protected-host work.
+name: release-candidate
+on:
+  workflow_dispatch:
+  push:
+    tags: ['v*']
+permissions:
+  contents: read
+jobs:
+  private-repo-guard:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Refuse private repository
+        if: ${{ github.event.repository.private }}
+        run: exit 1
+  candidate:
+    needs: [private-repo-guard]
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${OS_MATRIX}
+        node: ${NODE_MATRIX}
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ matrix.node }}
+          package-manager-cache: false
+${PACKAGE_MANAGER_SETUP}
+      - uses: dtolnay/rust-toolchain@f8be11a05b1d4f3fcebe6410cc16743212b999b0
+        with:
+          toolchain: 1.98.0
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          workspaces: engine
+      - run: ${INSTALL_COMMAND}
+      - name: Build unsigned release candidate
+        run: ${PM_RUN} ${CANDIDATE_BUILD_SCRIPT}
+        env:
+          RIGHT_GIT_ARTIFACT_ROOT: ${{ runner.temp }}/${CANDIDATE_ARTIFACT_ROOT}
+      - name: Check unsigned release candidate
+        run: ${PM_RUN} ${CANDIDATE_CHECK_SCRIPT}
+        env:
+          RIGHT_GIT_ARTIFACT_ROOT: ${{ runner.temp }}/${CANDIDATE_ARTIFACT_ROOT}
+      - name: Upload unsigned candidate handoff
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: ${ARTIFACT_PREFIX}-unsigned-${{ matrix.os }}-${{ matrix.node }}
+          path: ${{ runner.temp }}/${CANDIDATE_ARTIFACT_ROOT}/**
+          if-no-files-found: error