@rightkit/git 0.2.15 → 0.2.17

package/README.md

@@ -38,6 +38,6 @@ Node builtins only; no runtime dependencies.
 
 ## Profiles
 
-`profile` defaults to `node`. `rust-hybrid` requires `ci`, accepts optional `release-candidate`, installs pinned Node plus Rust, then runs product-owned package scripts. Candidate configuration is `{ buildScript, checkScript, artifactRoot, os, targets?, signWindows?, signMacos?, releaseChain? }`. Legacy `os` remains supported & derives one target per runner; explicit `targets` is `{ os, platform, architecture }[]`, independent of main CI matrix. Each target maps to native runner, Rust target triple, exact unsigned artifact, & platform signing matrix. Supported platform values are `windows`, `macos`, `linux`; architectures are `x86_64`, `arm64`. RightGit always uploads an unsigned handoff. `signWindows: true` adds Azure OIDC signing. `signMacos: true` adds Developer ID signing plus notarization from protected environment secrets.
+`profile` defaults to `node`. `rust-hybrid` requires `ci`, accepts optional `release-candidate`, installs pinned Node plus Rust, then runs product-owned package scripts. `rustCache.workspaces` declares every independent Cargo workspace whose `target` directory participates in dependency caching. Rust-hybrid workflows also enable source-aware sccache compilation caching, reuse one stable cache namespace across CI & candidate jobs, & keep workspace-crate artifacts out of rust-cache to prevent stale exact hits. Candidate configuration is `{ buildScript, checkScript, artifactRoot, os, targets?, signWindows?, signMacos?, releaseChain? }`. Legacy `os` remains supported & derives one target per runner; explicit `targets` is `{ os, platform, architecture }[]`, independent of main CI matrix. Each target maps to native runner, Rust target triple, exact unsigned artifact, & platform signing matrix. Supported platform values are `windows`, `macos`, `linux`; architectures are `x86_64`, `arm64`. RightGit always uploads an unsigned handoff. `signWindows: true` adds Azure OIDC signing. `signMacos: true` adds Developer ID signing plus notarization from protected environment secrets.
 
 `releaseChain` lets RightGit own full protected DAG while product scripts own artifact semantics: `{ windowsFinalizeScript, macosFinalizeScript?, installedQualificationScript, publishScript, qualificationRunnerVariable, publishSecrets? }`. Generated ordering is unsigned candidate → platform signing/finalization → installed qualification → publication. It deliberately rejects more than one Windows target or more than one macOS target because its installed-qualification/publish handoff has one canonical signed artifact per platform. Every protected job is tag-gated, publication needs successful installed qualification plus macOS finalization when enabled, & only publish job receives declared publication secrets plus `contents: write`.

package/manifest.mjs

@@ -57,9 +57,11 @@ const TOP_LEVEL_KEYS = new Set([
   "templateVersion",
   "profile",
   "gate",
+  "rustCache",
   "candidate",
 ]);
 const GATE_PATH_RE = /^(?!.*\.\.)(?!.*\s)[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+const RUST_WORKSPACE_PATH_RE = /^(?:\.|(?!.*\.\.)(?!.*\s)[A-Za-z0-9][A-Za-z0-9._/-]*)$/;
 const PACKAGE_SCRIPT_RE = /^[A-Za-z0-9][A-Za-z0-9:_-]*$/;
 const GITHUB_VARIABLE_RE = /^[A-Z][A-Z0-9_]*$/;
 const RELEASE_PLATFORMS = new Set(["windows", "macos", "linux"]);
@@ -153,6 +155,26 @@ export function validateManifest(manifest) {
     errors.push("gate is only valid for profile 'rust-hybrid'");
   }
 
+  const rustCache = manifest.rustCache;
+  if (rustCache !== undefined) {
+    if (profile !== "rust-hybrid") {
+      errors.push("rustCache is only valid for profile 'rust-hybrid'");
+    } else if (rustCache === null || typeof rustCache !== "object" || Array.isArray(rustCache)) {
+      errors.push("rustCache must be an object");
+    } else {
+      for (const key of Object.keys(rustCache)) {
+        if (key !== "workspaces") errors.push(`unknown rustCache field: ${key}`);
+      }
+      if (!Array.isArray(rustCache.workspaces) || rustCache.workspaces.length === 0) {
+        errors.push("rustCache.workspaces must be a non-empty array");
+      } else if (rustCache.workspaces.some((value) => typeof value !== "string" || !RUST_WORKSPACE_PATH_RE.test(value))) {
+        errors.push("rustCache.workspaces entries must be safe relative paths");
+      } else if (new Set(rustCache.workspaces).size !== rustCache.workspaces.length) {
+        errors.push("rustCache.workspaces entries must be unique");
+      }
+    }
+  }
+
   const candidate = manifest.candidate;
   if (candidate !== undefined) {
     if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) {
@@ -657,6 +679,7 @@ ${pm.setup}
       - name: Run installed-artifact qualification
         run: ${pm.runPrefix} ${chain.installedQualificationScript}
         env:
+          GH_TOKEN: \${{ github.token }}
           RIGHT_GIT_FINALIZED_WINDOWS_ROOT: \${{ runner.temp }}/right-git-release/windows
           RIGHT_GIT_QUALIFICATION_EVIDENCE_ROOT: \${{ runner.temp }}/right-git-release/qualification
           RIGHT_GIT_SOURCE_REVISION: \${{ env.RIGHT_GIT_SOURCE_REVISION }}
@@ -732,6 +755,7 @@ export function buildRenderContext(manifest, repoPath) {
   const pm = parsePackageManager(manifest.packageManager);
   const projectName = deriveProjectName(repoPath);
   const artifactPrefix = projectName.toLowerCase().replace(/[^a-z0-9-]+/g, "-");
+  const rustWorkspaces = manifest.rustCache?.workspaces ?? ["engine"];
 
   const context = {
     OS_MATRIX: yamlFlowStringList(manifest.matrix.os),
@@ -746,6 +770,7 @@ export function buildRenderContext(manifest, repoPath) {
     ARTIFACT_PREFIX: artifactPrefix,
     TEMPLATE_VERSION: manifest.templateVersion,
     GATE_PATH: manifest.gate?.path,
+    RUST_CACHE_WORKSPACES: rustWorkspaces.map((workspace) => `            ${workspace} -> target`).join("\n"),
     CANDIDATE_BUILD_SCRIPT: manifest.candidate?.buildScript,
     CANDIDATE_CHECK_SCRIPT: manifest.candidate?.checkScript,
     CANDIDATE_ARTIFACT_ROOT: manifest.candidate?.artifactRoot,

package/manifest.schema.json

@@ -82,6 +82,19 @@
       "pattern": "^\\d+\\.\\d+\\.\\d+$"
     }
     ,"profile": { "enum": ["node", "rust-hybrid"] },
+    "rustCache": {
+      "type": "object",
+      "required": ["workspaces"],
+      "additionalProperties": false,
+      "properties": {
+        "workspaces": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": { "type": "string", "pattern": "^(?:\\.|(?!.*\\.\\.)(?!.*\\s)[A-Za-z0-9][A-Za-z0-9._/-]*)$" }
+        }
+      }
+    },
     "gate": {
       "type": "object", "required": ["path"], "additionalProperties": false,
       "properties": { "path": { "type": "string", "pattern": "^(?!.*\\.\\.)(?!.*\\s)[A-Za-z0-9][A-Za-z0-9._/-]*$" } }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/git",
-  "version": "0.2.15",
+  "version": "0.2.17",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/render.test.mjs

@@ -69,6 +69,8 @@ test("rust-hybrid release candidate renders product scripts, artifact handoff, a
   );
   assert.match(content, /pnpm run ci:candidate/);
   assert.match(content, /pnpm run ci:candidate-check/);
+  assert.match(content, /Mozilla-Actions\/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba/);
+  assert.match(content, /shared-key: widgets-rust/);
   assert.doesNotMatch(content, /bash \.\/scripts\/gate\.sh/);
   assert.match(content, /RIGHT_GIT_ARTIFACT_ROOT/);
   assert.match(content, /os: "macos-latest"/);
@@ -78,6 +80,25 @@ test("rust-hybrid release candidate renders product scripts, artifact handoff, a
   assert.doesNotMatch(content, /secrets\.|AZURE_|APPLE_|certificate|private.key/i);
 });
 
+test("rust-hybrid cache contract renders every declared Cargo workspace", () => {
+  const manifest = {
+    ...FULL_MANIFEST,
+    lanes: ["ci"],
+    profile: "rust-hybrid",
+    gate: { path: "scripts/gate.sh" },
+    rustCache: { workspaces: [".", "apps/studio/src-tauri"] },
+    matrix: { os: ["windows-2025"], node: ["22.23.2"] },
+  };
+  const content = renderTemplate(
+    fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/ci.yml"), "utf8"),
+    buildRenderContext(manifest, "/repos/widgets"),
+  );
+  assert.match(content, /workspaces: \|\n            \. -> target\n            apps\/studio\/src-tauri -> target/);
+  assert.match(content, /add-job-id-key: false/);
+  assert.match(content, /cache-workspace-crates: false/);
+  assert.match(content, /RUSTC_WRAPPER: "sccache"/);
+});
+
 test("rust-hybrid release candidate can opt into OIDC Windows signing without long-lived secrets", () => {
   const manifest = {
     ...FULL_MANIFEST,
@@ -214,6 +235,7 @@ test("rust-hybrid release chain preserves signed candidate, installed qualificat
   assert.match(content, /shell: pwsh\n        run: \|\n          throw 'installed_qualification_failed \{ reason: prerequisites_absent, detail: "same-run Windows signing\/finalization did not succeed" \}'/);
   assert.doesNotMatch(content, /^        run: throw 'installed_qualification_failed .*detail: /m);
   assert.match(content, /pnpm run release:qualify:installed/);
+  assert.match(content, /installed-qualification:[\s\S]*GH_TOKEN: \$\{\{ github\.token \}\}/);
   assert.match(content, /publish:\n    needs: \[installed-qualification, macos-sign\]/);
   assert.match(content, /publish:[\s\S]*startsWith\(github\.ref, 'refs\/tags\/v'\)/);
   assert.doesNotMatch(content.slice(content.indexOf("  publish:")), /inputs\.signed_qualification/);

package/templates/profiles/rust-hybrid/ci.yml

@@ -16,6 +16,9 @@ jobs:
         run: exit 1
   ci:
     needs: [private-repo-guard]
+    env:
+      SCCACHE_GHA_ENABLED: "true"
+      RUSTC_WRAPPER: "sccache"
     strategy:
       fail-fast: false
       matrix:
@@ -37,5 +40,13 @@ ${PACKAGE_MANAGER_SETUP}
           components: rustfmt, clippy
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
-          workspaces: engine
+          workspaces: |
+${RUST_CACHE_WORKSPACES}
+          shared-key: ${ARTIFACT_PREFIX}-rust
+          add-job-id-key: false
+          cache-workspace-crates: false
+          save-if: ${{ github.event_name != 'pull_request' }}
+      - uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
+        with:
+          version: "v0.16.0"
       - run: bash ./${GATE_PATH}

package/templates/profiles/rust-hybrid/release-candidate.yml

@@ -24,6 +24,9 @@ jobs:
         run: exit 1
   candidate:
     needs: [private-repo-guard]
+    env:
+      SCCACHE_GHA_ENABLED: "true"
+      RUSTC_WRAPPER: "sccache"
     strategy:
       fail-fast: false
       matrix:
@@ -43,7 +46,15 @@ ${PACKAGE_MANAGER_SETUP}
           targets: ${{ matrix.targetTriple }}
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
-          workspaces: engine
+          workspaces: |
+${RUST_CACHE_WORKSPACES}
+          shared-key: ${ARTIFACT_PREFIX}-rust
+          add-job-id-key: false
+          cache-workspace-crates: false
+          save-if: true
+      - uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
+        with:
+          version: "v0.16.0"
       - run: ${INSTALL_COMMAND}
       - name: Build unsigned release candidate
         run: ${PM_RUN} ${CANDIDATE_BUILD_SCRIPT}