@rightkit/git 0.2.2 → 0.2.3

package/manifest.mjs

@@ -262,7 +262,7 @@ function parsePackageManager(spec) {
   }[name];
   const runPrefix = { pnpm: "pnpm run", npm: "npm run", yarn: "yarn run" }[name];
   const setup = {
-    pnpm: `      - uses: pnpm/action-setup@v4\n        with:\n          version: ${version}`,
+    pnpm: `      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10\n        with:\n          version: ${version}`,
     npm: "",
     yarn: `      - run: corepack enable && corepack prepare yarn@${version} --activate`,
   }[name];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/git",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/render.test.mjs

@@ -45,9 +45,9 @@ test("every known lane has a template file and renders without an unresolved pla
 test("rust-hybrid ci renders its pinned package manager and gate", () => {
   const manifest = { ...FULL_MANIFEST, lanes: ["ci"], profile: "rust-hybrid", gate: { path: "scripts/gate.sh" }, templateVersion: "1.1.0" };
   const content = renderTemplate(fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/ci.yml"), "utf8"), buildRenderContext(manifest, "/repos/widgets"));
-  assert.match(content, /uses: pnpm\/action-setup@v4/);
+  assert.match(content, /uses: pnpm\/action-setup@[a-f0-9]{40}/);
   assert.match(content, /version: 11\.24\.0/);
-  assert.match(content, /rustup toolchain install stable/);
+  assert.match(content, /toolchain: 1\.98\.0/);
   assert.match(content, /bash \.\/scripts\/gate\.sh/);
 });
 
@@ -67,7 +67,7 @@ test("rust-hybrid release candidate renders product scripts, artifact handoff, a
   assert.match(content, /pnpm run ci:candidate/);
   assert.match(content, /pnpm run ci:candidate-check/);
   assert.match(content, /RIGHT_GIT_ARTIFACT_ROOT/);
-  assert.match(content, /actions\/upload-artifact@v4/);
+  assert.match(content, /actions\/upload-artifact@[a-f0-9]{40}/);
   assert.doesNotMatch(content, /secrets\.|AZURE_|APPLE_|certificate|private.key/i);
 });
 
@@ -95,7 +95,7 @@ test("rendered workflows never request pnpm or yarn setup-node caching before pa
 test("rendered workflows bootstrap each declared package manager safely", () => {
   const pnpm = renderAllLanes({ ...FULL_MANIFEST, packageManager: "pnpm@11.24.0" }, "/repos/widgets");
   for (const content of Object.values(pnpm)) {
-    assert.match(content, /uses: pnpm\/action-setup@v4/);
+    assert.match(content, /uses: pnpm\/action-setup@[a-f0-9]{40}/);
     assert.match(content, /version: 11\.24\.0/);
     assert.doesNotMatch(content, /corepack enable/);
   }

package/templates/profiles/rust-hybrid/ci.yml

@@ -1,12 +1,15 @@
 # Managed by right-git — do not hand-edit. Run `right-git sync` to update.
 # Template: profiles/rust-hybrid/ci.yml | Template version: ${TEMPLATE_VERSION}
-name: ci
-on: [push, pull_request]
+name: legion-ci
+on:
+  pull_request:
+  push:
+    branches: [main]
 permissions:
   contents: read
 jobs:
   private-repo-guard:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Refuse private repository
         if: ${{ github.event.repository.private }}
@@ -20,11 +23,17 @@ jobs:
         node: ${NODE_MATRIX}
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node }}
           package-manager-cache: false
 ${PACKAGE_MANAGER_SETUP}
-      - run: rustup toolchain install stable --profile minimal
+      - uses: dtolnay/rust-toolchain@f8be11a05b1d4f3fcebe6410cc16743212b999b0
+        with:
+          toolchain: 1.98.0
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          workspaces: engine
       - run: bash ./${GATE_PATH}

package/templates/profiles/rust-hybrid/release-candidate.yml

@@ -11,7 +11,7 @@ permissions:
   contents: read
 jobs:
   private-repo-guard:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Refuse private repository
         if: ${{ github.event.repository.private }}
@@ -25,13 +25,19 @@ jobs:
         node: ${NODE_MATRIX}
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node }}
           package-manager-cache: false
 ${PACKAGE_MANAGER_SETUP}
-      - run: rustup toolchain install stable --profile minimal
+      - uses: dtolnay/rust-toolchain@f8be11a05b1d4f3fcebe6410cc16743212b999b0
+        with:
+          toolchain: 1.98.0
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          workspaces: engine
       - run: ${INSTALL_COMMAND}
       - name: Build unsigned release candidate
         run: ${PM_RUN} ${CANDIDATE_BUILD_SCRIPT}
@@ -42,7 +48,7 @@ ${PACKAGE_MANAGER_SETUP}
         env:
           RIGHT_GIT_ARTIFACT_ROOT: ${{ runner.temp }}/${CANDIDATE_ARTIFACT_ROOT}
       - name: Upload unsigned candidate handoff
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: ${ARTIFACT_PREFIX}-unsigned-${{ matrix.os }}-${{ matrix.node }}
           path: ${{ runner.temp }}/${CANDIDATE_ARTIFACT_ROOT}/**