@rightkit/git 0.2.14 → 0.2.16

package/manifest.mjs

@@ -442,7 +442,7 @@ function windowsSigningJob(manifest, pm, artifactPrefix) {
   return `
   windows-sign:
     needs: [candidate]
-    if: \${{ startsWith(github.ref, 'refs/tags/v') }}
+    if: \${{ startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.signed_qualification == true) }}
     environment: release
     strategy:
       fail-fast: false
@@ -532,7 +532,7 @@ function macosSigningJob(manifest, pm, artifactPrefix) {
   return `
   macos-sign:
     needs: [candidate]
-    if: \${{ startsWith(github.ref, 'refs/tags/v') }}
+    if: \${{ startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.signed_qualification == true) }}
     environment: release
     strategy:
       fail-fast: false
@@ -630,7 +630,7 @@ function releaseChainJobs(manifest, pm, artifactPrefix) {
   return `
   installed-qualification:
     needs: [candidate, windows-sign]
-    if: \${{ always() && startsWith(github.ref, 'refs/tags/v') && needs.candidate.result == 'success' }}
+    if: \${{ always() && (startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.signed_qualification == true)) && needs.candidate.result == 'success' }}
     environment: release
     runs-on: \${{ vars.${chain.qualificationRunnerVariable} || '${windowsRunner}' }}
     steps:
@@ -657,6 +657,7 @@ ${pm.setup}
       - name: Run installed-artifact qualification
         run: ${pm.runPrefix} ${chain.installedQualificationScript}
         env:
+          GH_TOKEN: \${{ github.token }}
           RIGHT_GIT_FINALIZED_WINDOWS_ROOT: \${{ runner.temp }}/right-git-release/windows
           RIGHT_GIT_QUALIFICATION_EVIDENCE_ROOT: \${{ runner.temp }}/right-git-release/qualification
           RIGHT_GIT_SOURCE_REVISION: \${{ env.RIGHT_GIT_SOURCE_REVISION }}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/git",
-  "version": "0.2.14",
+  "version": "0.2.16",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -15,9 +15,6 @@
     "*.json"
   ],
   "sideEffects": false,
-  "scripts": {
-    "test": "node --test *.test.mjs"
-  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
@@ -27,5 +24,7 @@
     "url": "git+https://github.com/bogusyogi/claude.git",
     "directory": "tools/rightkit/packages/git"
   },
-  "packageManager": "pnpm@11.24.0"
-}
+  "scripts": {
+    "test": "node --test *.test.mjs"
+  }
+}

package/render.test.mjs

@@ -93,7 +93,7 @@ test("rust-hybrid release candidate can opt into OIDC Windows signing without lo
     buildRenderContext(manifest, "/repos/widgets"),
   );
   assert.match(content, /environment: release/);
-  assert.match(content, /windows-sign:\n    needs: \[candidate\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\) \}\}/);
+  assert.match(content, /windows-sign:\n    needs: \[candidate\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\) \|\| \(github\.event_name == 'workflow_dispatch' && inputs\.signed_qualification == true\) \}\}/);
   assert.match(content, /id-token: write/);
   assert.match(content, /azure\/login@[a-f0-9]{40}/);
   assert.match(content, /vars\.AZURE_CLIENT_ID/);
@@ -120,7 +120,7 @@ test("rust-hybrid release candidate can opt into protected macOS signing & notar
     buildRenderContext(manifest, "/repos/widgets"),
   );
   assert.match(content, /macos-sign:/);
-  assert.match(content, /macos-sign:\n    needs: \[candidate\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\) \}\}/);
+  assert.match(content, /macos-sign:\n    needs: \[candidate\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\) \|\| \(github\.event_name == 'workflow_dispatch' && inputs\.signed_qualification == true\) \}\}/);
   assert.match(content, /environment: release/);
   assert.match(content, /secrets\.APPLE_CERTIFICATE_BASE64/);
   assert.match(content, /temporary keychain/i);
@@ -205,12 +205,19 @@ test("rust-hybrid release chain preserves signed candidate, installed qualificat
   );
   assert.match(content, /windows-sign:[\s\S]*pnpm run release:finalize:win/);
   assert.match(content, /macos-sign:[\s\S]*pnpm run release:finalize:mac/);
+  assert.match(content, /signed_qualification:\n        description: Run protected signing & installed qualification without publishing/);
+  assert.match(content, /windows-sign:[\s\S]*inputs\.signed_qualification == true/);
+  assert.match(content, /macos-sign:[\s\S]*inputs\.signed_qualification == true/);
   assert.match(content, /installed-qualification:\n    needs: \[candidate, windows-sign\]/);
+  assert.match(content, /installed-qualification:[\s\S]*inputs\.signed_qualification == true/);
   assert.match(content, /installed_qualification_failed/);
   assert.match(content, /shell: pwsh\n        run: \|\n          throw 'installed_qualification_failed \{ reason: prerequisites_absent, detail: "same-run Windows signing\/finalization did not succeed" \}'/);
   assert.doesNotMatch(content, /^        run: throw 'installed_qualification_failed .*detail: /m);
   assert.match(content, /pnpm run release:qualify:installed/);
+  assert.match(content, /installed-qualification:[\s\S]*GH_TOKEN: \$\{\{ github\.token \}\}/);
   assert.match(content, /publish:\n    needs: \[installed-qualification, macos-sign\]/);
+  assert.match(content, /publish:[\s\S]*startsWith\(github\.ref, 'refs\/tags\/v'\)/);
+  assert.doesNotMatch(content.slice(content.indexOf("  publish:")), /inputs\.signed_qualification/);
   assert.match(content, /needs\.macos-sign\.result == 'success'/);
   assert.match(content, /contents: write/);
   assert.match(content, /pnpm run release:publish:qualified/);

package/templates/profiles/rust-hybrid/release-candidate.yml

@@ -5,6 +5,12 @@
 name: release-candidate
 on:
   workflow_dispatch:
+    inputs:
+      signed_qualification:
+        description: Run protected signing & installed qualification without publishing
+        required: false
+        type: boolean
+        default: false
   push:
     tags: ['v*']
 permissions: