@rightkit/git 0.2.13 → 0.2.15

package/manifest.mjs

@@ -442,7 +442,7 @@ function windowsSigningJob(manifest, pm, artifactPrefix) {
   return `
   windows-sign:
     needs: [candidate]
-    if: \${{ startsWith(github.ref, 'refs/tags/v') }}
+    if: \${{ startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.signed_qualification == true) }}
     environment: release
     strategy:
       fail-fast: false
@@ -532,7 +532,7 @@ function macosSigningJob(manifest, pm, artifactPrefix) {
   return `
   macos-sign:
     needs: [candidate]
-    if: \${{ startsWith(github.ref, 'refs/tags/v') }}
+    if: \${{ startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.signed_qualification == true) }}
     environment: release
     strategy:
       fail-fast: false
@@ -630,7 +630,7 @@ function releaseChainJobs(manifest, pm, artifactPrefix) {
   return `
   installed-qualification:
     needs: [candidate, windows-sign]
-    if: \${{ always() && startsWith(github.ref, 'refs/tags/v') && needs.candidate.result == 'success' }}
+    if: \${{ always() && (startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.signed_qualification == true)) && needs.candidate.result == 'success' }}
     environment: release
     runs-on: \${{ vars.${chain.qualificationRunnerVariable} || '${windowsRunner}' }}
     steps:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/git",
-  "version": "0.2.13",
+  "version": "0.2.15",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -15,9 +15,6 @@
     "*.json"
   ],
   "sideEffects": false,
-  "scripts": {
-    "test": "node --test *.test.mjs"
-  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
@@ -27,5 +24,7 @@
     "url": "git+https://github.com/bogusyogi/claude.git",
     "directory": "tools/rightkit/packages/git"
   },
-  "packageManager": "pnpm@11.24.0"
-}
+  "scripts": {
+    "test": "node --test *.test.mjs"
+  }
+}

package/render.test.mjs

@@ -93,7 +93,7 @@ test("rust-hybrid release candidate can opt into OIDC Windows signing without lo
     buildRenderContext(manifest, "/repos/widgets"),
   );
   assert.match(content, /environment: release/);
-  assert.match(content, /windows-sign:\n    needs: \[candidate\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\) \}\}/);
+  assert.match(content, /windows-sign:\n    needs: \[candidate\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\) \|\| \(github\.event_name == 'workflow_dispatch' && inputs\.signed_qualification == true\) \}\}/);
   assert.match(content, /id-token: write/);
   assert.match(content, /azure\/login@[a-f0-9]{40}/);
   assert.match(content, /vars\.AZURE_CLIENT_ID/);
@@ -120,7 +120,7 @@ test("rust-hybrid release candidate can opt into protected macOS signing & notar
     buildRenderContext(manifest, "/repos/widgets"),
   );
   assert.match(content, /macos-sign:/);
-  assert.match(content, /macos-sign:\n    needs: \[candidate\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\) \}\}/);
+  assert.match(content, /macos-sign:\n    needs: \[candidate\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\) \|\| \(github\.event_name == 'workflow_dispatch' && inputs\.signed_qualification == true\) \}\}/);
   assert.match(content, /environment: release/);
   assert.match(content, /secrets\.APPLE_CERTIFICATE_BASE64/);
   assert.match(content, /temporary keychain/i);
@@ -205,12 +205,18 @@ test("rust-hybrid release chain preserves signed candidate, installed qualificat
   );
   assert.match(content, /windows-sign:[\s\S]*pnpm run release:finalize:win/);
   assert.match(content, /macos-sign:[\s\S]*pnpm run release:finalize:mac/);
+  assert.match(content, /signed_qualification:\n        description: Run protected signing & installed qualification without publishing/);
+  assert.match(content, /windows-sign:[\s\S]*inputs\.signed_qualification == true/);
+  assert.match(content, /macos-sign:[\s\S]*inputs\.signed_qualification == true/);
   assert.match(content, /installed-qualification:\n    needs: \[candidate, windows-sign\]/);
+  assert.match(content, /installed-qualification:[\s\S]*inputs\.signed_qualification == true/);
   assert.match(content, /installed_qualification_failed/);
   assert.match(content, /shell: pwsh\n        run: \|\n          throw 'installed_qualification_failed \{ reason: prerequisites_absent, detail: "same-run Windows signing\/finalization did not succeed" \}'/);
   assert.doesNotMatch(content, /^        run: throw 'installed_qualification_failed .*detail: /m);
   assert.match(content, /pnpm run release:qualify:installed/);
   assert.match(content, /publish:\n    needs: \[installed-qualification, macos-sign\]/);
+  assert.match(content, /publish:[\s\S]*startsWith\(github\.ref, 'refs\/tags\/v'\)/);
+  assert.doesNotMatch(content.slice(content.indexOf("  publish:")), /inputs\.signed_qualification/);
   assert.match(content, /needs\.macos-sign\.result == 'success'/);
   assert.match(content, /contents: write/);
   assert.match(content, /pnpm run release:publish:qualified/);

package/sync.mjs

@@ -12,6 +12,22 @@ import { renderTemplate, MANAGED_MARKER } from "./render.mjs";
 const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)));
 const TEMPLATES_DIR = path.join(packageRoot, "templates");
 const WORKFLOWS_SUBDIR = path.join(".github", "workflows");
+const PUBLISHED_NPM_VERSION = /^\d+\.\d+\.\d+$/;
+
+function releaseChainDependencyError(repoPath, manifest) {
+  if (!manifest.candidate?.releaseChain) return null;
+  let pkg;
+  try {
+    pkg = JSON.parse(fs.readFileSync(path.join(repoPath, "package.json"), "utf8"));
+  } catch {
+    return "release-candidate releaseChain requires a readable package.json with direct devDependency @rightkit/release";
+  }
+  const version = pkg.devDependencies?.["@rightkit/release"];
+  if (typeof version !== "string" || !PUBLISHED_NPM_VERSION.test(version)) {
+    return "release-candidate releaseChain requires direct devDependency @rightkit/release pinned to a published npm version";
+  }
+  return null;
+}
 
 /** Render every lane declared in the manifest. Returns { lane, filename, content }[]. */
 export function renderLanes(manifest, repoPath) {
@@ -82,6 +98,10 @@ export async function planSync(repoPath, deps = {}, manifestOverride = null) {
   if (!loaded.ok) {
     return { ok: false, stage: "manifest", errors: loaded.errors, changes: [] };
   }
+  const dependencyError = releaseChainDependencyError(repoPath, loaded.manifest);
+  if (dependencyError) {
+    return { ok: false, stage: "dependency", errors: [dependencyError], changes: [] };
+  }
 
   const rendered = renderLanes(loaded.manifest, repoPath);
   const wantedFilenames = new Set(rendered.map((r) => r.filename));

package/sync.test.mjs

@@ -54,6 +54,44 @@ test("sync reports manifest errors instead of writing files", async () => {
   assert.equal(result.stage, "manifest");
 });
 
+test("sync rejects a Membrane-like release chain without root @rightkit/release", async () => {
+  const manifest = {
+    schemaVersion: 1,
+    lanes: ["ci", "release-candidate"],
+    matrix: { os: ["windows-2025", "macos-15"], node: ["22.23.2"] },
+    packageManager: "pnpm@11.24.0",
+    templateVersion: "1.5.0",
+    profile: "rust-hybrid",
+    gate: { path: "scripts/ci/run-ci.sh" },
+    candidate: {
+      buildScript: "release:candidate:build",
+      checkScript: "release:candidate:check",
+      artifactRoot: "membrane-release-candidate",
+      os: ["windows-2025", "macos-15"],
+      signWindows: true,
+      signMacos: true,
+      releaseChain: {
+        windowsFinalizeScript: "release:finalize:windows",
+        macosFinalizeScript: "release:finalize:macos",
+        installedQualificationScript: "release:qualify:installed",
+        publishScript: "release:publish:qualified",
+        qualificationRunnerVariable: "MEMBRANE_QUALIFICATION_RUNNER_LABEL",
+      },
+    },
+  };
+  const dir = makeTempRepo(manifest, { packageJson: { name: "membrane", devDependencies: { "@rightkit/git": "0.2.13" } } });
+  const missing = await syncCommand(dir, { deps: PUBLIC_DEPS });
+  assert.equal(missing.ok, false);
+  assert.equal(missing.stage, "dependency");
+  assert.match(missing.errors[0], /direct devDependency @rightkit\/release/);
+  assert.equal(fs.existsSync(path.join(dir, ".github", "workflows")), false);
+
+  fs.writeFileSync(path.join(dir, "package.json"), JSON.stringify({ name: "membrane", devDependencies: { "@rightkit/git": "0.2.13", "@rightkit/release": "0.2.84" } }), "utf8");
+  const present = await syncCommand(dir, { deps: PUBLIC_DEPS });
+  assert.equal(present.ok, true);
+  assert.ok(fs.existsSync(path.join(dir, ".github", "workflows", "release-candidate.yml")));
+});
+
 test("sync refuses an unmanaged same-name workflow", async () => {
   const dir = makeTempRepo(SAMPLE_MANIFEST);
   const target = path.join(dir, ".github", "workflows", "ci.yml");

package/templates/profiles/rust-hybrid/release-candidate.yml

@@ -5,6 +5,12 @@
 name: release-candidate
 on:
   workflow_dispatch:
+    inputs:
+      signed_qualification:
+        description: Run protected signing & installed qualification without publishing
+        required: false
+        type: boolean
+        default: false
   push:
     tags: ['v*']
 permissions: