@rightkit/git 0.2.12 → 0.2.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/git",
-  "version": "0.2.12",
+  "version": "0.2.14",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/render.test.mjs

@@ -69,7 +69,7 @@ test("rust-hybrid release candidate renders product scripts, artifact handoff, a
   );
   assert.match(content, /pnpm run ci:candidate/);
   assert.match(content, /pnpm run ci:candidate-check/);
-  assert.ok(content.indexOf("bash ./scripts/gate.sh") < content.indexOf("Build unsigned release candidate"));
+  assert.doesNotMatch(content, /bash \.\/scripts\/gate\.sh/);
   assert.match(content, /RIGHT_GIT_ARTIFACT_ROOT/);
   assert.match(content, /os: "macos-latest"/);
   assert.match(content, /platform: "windows"/);
@@ -165,8 +165,7 @@ test("rust-hybrid multi-architecture candidates bind every native target to exac
     assert.match(content, new RegExp(`targetTriple: ${JSON.stringify(triple).replace(/[.*+?^${}()|[\\]\\]/g, "\\$&")}`));
   }
   assert.match(content, /targets: \$\{\{ matrix\.targetTriple \}\}/);
-  assert.equal((content.match(/bash \.\/scripts\/gate\.sh/g) ?? []).length, 1);
-  assert.ok(content.indexOf("bash ./scripts/gate.sh") < content.indexOf("Build unsigned release candidate"));
+  assert.doesNotMatch(content, /bash \.\/scripts\/gate\.sh/);
   assert.match(content, /windows-sign:[\s\S]*matrix:[\s\S]*windows-11-arm/);
   assert.match(content, /macos-sign:[\s\S]*matrix:[\s\S]*macos-15-intel/);
   assert.match(content, /name: widgets-unsigned-\$\{\{ matrix\.platform \}\}-\$\{\{ matrix\.architecture \}\}-22\.23\.2/);

package/sync.mjs

@@ -12,6 +12,22 @@ import { renderTemplate, MANAGED_MARKER } from "./render.mjs";
 const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)));
 const TEMPLATES_DIR = path.join(packageRoot, "templates");
 const WORKFLOWS_SUBDIR = path.join(".github", "workflows");
+const PUBLISHED_NPM_VERSION = /^\d+\.\d+\.\d+$/;
+
+function releaseChainDependencyError(repoPath, manifest) {
+  if (!manifest.candidate?.releaseChain) return null;
+  let pkg;
+  try {
+    pkg = JSON.parse(fs.readFileSync(path.join(repoPath, "package.json"), "utf8"));
+  } catch {
+    return "release-candidate releaseChain requires a readable package.json with direct devDependency @rightkit/release";
+  }
+  const version = pkg.devDependencies?.["@rightkit/release"];
+  if (typeof version !== "string" || !PUBLISHED_NPM_VERSION.test(version)) {
+    return "release-candidate releaseChain requires direct devDependency @rightkit/release pinned to a published npm version";
+  }
+  return null;
+}
 
 /** Render every lane declared in the manifest. Returns { lane, filename, content }[]. */
 export function renderLanes(manifest, repoPath) {
@@ -82,6 +98,10 @@ export async function planSync(repoPath, deps = {}, manifestOverride = null) {
   if (!loaded.ok) {
     return { ok: false, stage: "manifest", errors: loaded.errors, changes: [] };
   }
+  const dependencyError = releaseChainDependencyError(repoPath, loaded.manifest);
+  if (dependencyError) {
+    return { ok: false, stage: "dependency", errors: [dependencyError], changes: [] };
+  }
 
   const rendered = renderLanes(loaded.manifest, repoPath);
   const wantedFilenames = new Set(rendered.map((r) => r.filename));

package/sync.test.mjs

@@ -54,6 +54,44 @@ test("sync reports manifest errors instead of writing files", async () => {
   assert.equal(result.stage, "manifest");
 });
 
+test("sync rejects a Membrane-like release chain without root @rightkit/release", async () => {
+  const manifest = {
+    schemaVersion: 1,
+    lanes: ["ci", "release-candidate"],
+    matrix: { os: ["windows-2025", "macos-15"], node: ["22.23.2"] },
+    packageManager: "pnpm@11.24.0",
+    templateVersion: "1.5.0",
+    profile: "rust-hybrid",
+    gate: { path: "scripts/ci/run-ci.sh" },
+    candidate: {
+      buildScript: "release:candidate:build",
+      checkScript: "release:candidate:check",
+      artifactRoot: "membrane-release-candidate",
+      os: ["windows-2025", "macos-15"],
+      signWindows: true,
+      signMacos: true,
+      releaseChain: {
+        windowsFinalizeScript: "release:finalize:windows",
+        macosFinalizeScript: "release:finalize:macos",
+        installedQualificationScript: "release:qualify:installed",
+        publishScript: "release:publish:qualified",
+        qualificationRunnerVariable: "MEMBRANE_QUALIFICATION_RUNNER_LABEL",
+      },
+    },
+  };
+  const dir = makeTempRepo(manifest, { packageJson: { name: "membrane", devDependencies: { "@rightkit/git": "0.2.13" } } });
+  const missing = await syncCommand(dir, { deps: PUBLIC_DEPS });
+  assert.equal(missing.ok, false);
+  assert.equal(missing.stage, "dependency");
+  assert.match(missing.errors[0], /direct devDependency @rightkit\/release/);
+  assert.equal(fs.existsSync(path.join(dir, ".github", "workflows")), false);
+
+  fs.writeFileSync(path.join(dir, "package.json"), JSON.stringify({ name: "membrane", devDependencies: { "@rightkit/git": "0.2.13", "@rightkit/release": "0.2.84" } }), "utf8");
+  const present = await syncCommand(dir, { deps: PUBLIC_DEPS });
+  assert.equal(present.ok, true);
+  assert.ok(fs.existsSync(path.join(dir, ".github", "workflows", "release-candidate.yml")));
+});
+
 test("sync refuses an unmanaged same-name workflow", async () => {
   const dir = makeTempRepo(SAMPLE_MANIFEST);
   const target = path.join(dir, ".github", "workflows", "ci.yml");

package/templates/profiles/rust-hybrid/release-candidate.yml

@@ -38,8 +38,6 @@ ${PACKAGE_MANAGER_SETUP}
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           workspaces: engine
-      - name: Run full CI validation
-        run: bash ./${GATE_PATH}
       - run: ${INSTALL_COMMAND}
       - name: Build unsigned release candidate
         run: ${PM_RUN} ${CANDIDATE_BUILD_SCRIPT}