@rightkit/git 0.2.10 → 0.2.12

package/manifest.mjs

@@ -641,7 +641,8 @@ function releaseChainJobs(manifest, pm, artifactPrefix) {
       - name: Fail closed when protected finalization is absent
         if: \${{ needs.windows-sign.result != 'success' }}
         shell: pwsh
-        run: throw 'installed_qualification_failed { reason: prerequisites_absent, detail: "same-run Windows signing/finalization did not succeed" }'
+        run: |
+          throw 'installed_qualification_failed { reason: prerequisites_absent, detail: "same-run Windows signing/finalization did not succeed" }'
       - name: Download same-run finalized Windows release
         uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
         with:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/git",
-  "version": "0.2.10",
+  "version": "0.2.12",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -15,6 +15,9 @@
     "*.json"
   ],
   "sideEffects": false,
+  "scripts": {
+    "test": "node --test *.test.mjs"
+  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
@@ -24,7 +27,5 @@
     "url": "git+https://github.com/bogusyogi/claude.git",
     "directory": "tools/rightkit/packages/git"
   },
-  "scripts": {
-    "test": "node --test *.test.mjs"
-  }
-}
+  "packageManager": "pnpm@11.24.0"
+}

package/render.test.mjs

@@ -50,6 +50,8 @@ test("rust-hybrid ci renders its pinned package manager and gate", () => {
   assert.match(content, /version: 11\.24\.0/);
   assert.match(content, /toolchain: 1\.98\.0/);
   assert.match(content, /bash \.\/scripts\/gate\.sh/);
+  assert.match(content, /os: \["windows-2025"\]/);
+  assert.doesNotMatch(content, /ubuntu-latest|macos-latest/);
 });
 
 test("rust-hybrid release candidate renders product scripts, artifact handoff, and no signing secret", () => {
@@ -67,6 +69,7 @@ test("rust-hybrid release candidate renders product scripts, artifact handoff, a
   );
   assert.match(content, /pnpm run ci:candidate/);
   assert.match(content, /pnpm run ci:candidate-check/);
+  assert.ok(content.indexOf("bash ./scripts/gate.sh") < content.indexOf("Build unsigned release candidate"));
   assert.match(content, /RIGHT_GIT_ARTIFACT_ROOT/);
   assert.match(content, /os: "macos-latest"/);
   assert.match(content, /platform: "windows"/);
@@ -162,6 +165,8 @@ test("rust-hybrid multi-architecture candidates bind every native target to exac
     assert.match(content, new RegExp(`targetTriple: ${JSON.stringify(triple).replace(/[.*+?^${}()|[\\]\\]/g, "\\$&")}`));
   }
   assert.match(content, /targets: \$\{\{ matrix\.targetTriple \}\}/);
+  assert.equal((content.match(/bash \.\/scripts\/gate\.sh/g) ?? []).length, 1);
+  assert.ok(content.indexOf("bash ./scripts/gate.sh") < content.indexOf("Build unsigned release candidate"));
   assert.match(content, /windows-sign:[\s\S]*matrix:[\s\S]*windows-11-arm/);
   assert.match(content, /macos-sign:[\s\S]*matrix:[\s\S]*macos-15-intel/);
   assert.match(content, /name: widgets-unsigned-\$\{\{ matrix\.platform \}\}-\$\{\{ matrix\.architecture \}\}-22\.23\.2/);
@@ -203,6 +208,8 @@ test("rust-hybrid release chain preserves signed candidate, installed qualificat
   assert.match(content, /macos-sign:[\s\S]*pnpm run release:finalize:mac/);
   assert.match(content, /installed-qualification:\n    needs: \[candidate, windows-sign\]/);
   assert.match(content, /installed_qualification_failed/);
+  assert.match(content, /shell: pwsh\n        run: \|\n          throw 'installed_qualification_failed \{ reason: prerequisites_absent, detail: "same-run Windows signing\/finalization did not succeed" \}'/);
+  assert.doesNotMatch(content, /^        run: throw 'installed_qualification_failed .*detail: /m);
   assert.match(content, /pnpm run release:qualify:installed/);
   assert.match(content, /publish:\n    needs: \[installed-qualification, macos-sign\]/);
   assert.match(content, /needs\.macos-sign\.result == 'success'/);

package/templates/profiles/rust-hybrid/ci.yml

@@ -19,7 +19,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: ${OS_MATRIX}
+        # Full validation stays on one Windows runner; release-candidate
+        # validates every native target before it builds that target.
+        os: ["windows-2025"]
         node: ${NODE_MATRIX}
     runs-on: ${{ matrix.os }}
     steps:

package/templates/profiles/rust-hybrid/release-candidate.yml

@@ -38,6 +38,8 @@ ${PACKAGE_MANAGER_SETUP}
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           workspaces: engine
+      - name: Run full CI validation
+        run: bash ./${GATE_PATH}
       - run: ${INSTALL_COMMAND}
       - name: Build unsigned release candidate
         run: ${PM_RUN} ${CANDIDATE_BUILD_SCRIPT}