@rightkit/git 0.2.2 → 0.2.4

package/README.md

@@ -38,4 +38,4 @@ Node builtins only; no runtime dependencies.
 
 ## Profiles
 
-`profile` defaults to `node`. `rust-hybrid` requires `ci`, accepts optional `release-candidate`, installs pinned Node plus `rustup stable`, then runs product-owned package scripts. Candidate configuration is `{ buildScript, checkScript, artifactRoot }`; RightGit passes an isolated `RIGHT_GIT_ARTIFACT_ROOT`, checks it, & uploads it as an unsigned handoff. It never signs, finalizes, publishes releases, or receives signing credentials.
+`profile` defaults to `node`. `rust-hybrid` requires `ci`, accepts optional `release-candidate`, installs pinned Node plus Rust, then runs product-owned package scripts. Candidate configuration is `{ buildScript, checkScript, artifactRoot, os }`; `os` selects supported release hosts from main matrix. RightGit passes isolated `RIGHT_GIT_ARTIFACT_ROOT`, checks it, & uploads it as an unsigned handoff. It never signs, finalizes, publishes releases, or receives signing credentials.

package/manifest.mjs

@@ -141,7 +141,7 @@ export function validateManifest(manifest) {
       errors.push("candidate must be an object");
     } else {
       for (const key of Object.keys(candidate)) {
-        if (!["buildScript", "checkScript", "artifactRoot"].includes(key)) errors.push(`unknown candidate field: ${key}`);
+        if (!["buildScript", "checkScript", "artifactRoot", "os"].includes(key)) errors.push(`unknown candidate field: ${key}`);
       }
       for (const key of ["buildScript", "checkScript"]) {
         if (typeof candidate[key] !== "string" || !PACKAGE_SCRIPT_RE.test(candidate[key])) {
@@ -151,6 +151,11 @@ export function validateManifest(manifest) {
       if (typeof candidate.artifactRoot !== "string" || !GATE_PATH_RE.test(candidate.artifactRoot)) {
         errors.push("candidate.artifactRoot must be one safe relative path");
       }
+      if (!Array.isArray(candidate.os) || candidate.os.length === 0 || candidate.os.some((value) => typeof value !== "string" || !SAFE_MATRIX_VALUE_RE.test(value))) {
+        errors.push("candidate.os must be a non-empty array of safe runner labels");
+      } else if (candidate.os.some((value) => !manifest.matrix?.os?.includes(value))) {
+        errors.push("candidate.os entries must also exist in matrix.os");
+      }
     }
   }
   if (profile === "rust-hybrid" && lanes.includes("release-candidate") && candidate === undefined) {
@@ -262,7 +267,7 @@ function parsePackageManager(spec) {
   }[name];
   const runPrefix = { pnpm: "pnpm run", npm: "npm run", yarn: "yarn run" }[name];
   const setup = {
-    pnpm: `      - uses: pnpm/action-setup@v4\n        with:\n          version: ${version}`,
+    pnpm: `      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10\n        with:\n          version: ${version}`,
     npm: "",
     yarn: `      - run: corepack enable && corepack prepare yarn@${version} --activate`,
   }[name];
@@ -315,6 +320,7 @@ export function buildRenderContext(manifest, repoPath) {
     CANDIDATE_BUILD_SCRIPT: manifest.candidate?.buildScript,
     CANDIDATE_CHECK_SCRIPT: manifest.candidate?.checkScript,
     CANDIDATE_ARTIFACT_ROOT: manifest.candidate?.artifactRoot,
+    CANDIDATE_OS_MATRIX: yamlFlowStringList(manifest.candidate?.os ?? manifest.matrix.os),
   };
 
   if (manifest.publish?.npm) {

package/manifest.schema.json

@@ -88,12 +88,13 @@
     },
     "candidate": {
       "type": "object",
-      "required": ["buildScript", "checkScript", "artifactRoot"],
+      "required": ["buildScript", "checkScript", "artifactRoot", "os"],
       "additionalProperties": false,
       "properties": {
         "buildScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
         "checkScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
-        "artifactRoot": { "type": "string", "pattern": "^(?!.*\\.\\.)(?!.*\\s)[A-Za-z0-9][A-Za-z0-9._/-]*$" }
+        "artifactRoot": { "type": "string", "pattern": "^(?!.*\\.\\.)(?!.*\\s)[A-Za-z0-9][A-Za-z0-9._/-]*$" },
+        "os": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } }
       }
     }
   }

package/manifest.test.mjs

@@ -26,11 +26,12 @@ test("rust-hybrid supports ci plus a configured unsigned release-candidate lane"
   const candidate = {
     ...valid,
     lanes: ["ci", "release-candidate"],
-    candidate: { buildScript: "ci:candidate", checkScript: "ci:candidate-check", artifactRoot: "legion-unsigned" },
+    candidate: { buildScript: "ci:candidate", checkScript: "ci:candidate-check", artifactRoot: "legion-unsigned", os: ["ubuntu-latest"] },
   };
   assert.equal(validateManifest(candidate).valid, true);
   assert.equal(validateManifest({ ...candidate, candidate: { ...candidate.candidate, buildScript: "echo unsafe" } }).valid, false);
   assert.equal(validateManifest({ ...candidate, candidate: { ...candidate.candidate, artifactRoot: "../escape" } }).valid, false);
+  assert.equal(validateManifest({ ...candidate, candidate: { ...candidate.candidate, os: ["windows-latest"] } }).valid, false);
 });
 
 test("rejects non-object input", () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/git",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/render.test.mjs

@@ -45,9 +45,9 @@ test("every known lane has a template file and renders without an unresolved pla
 test("rust-hybrid ci renders its pinned package manager and gate", () => {
   const manifest = { ...FULL_MANIFEST, lanes: ["ci"], profile: "rust-hybrid", gate: { path: "scripts/gate.sh" }, templateVersion: "1.1.0" };
   const content = renderTemplate(fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/ci.yml"), "utf8"), buildRenderContext(manifest, "/repos/widgets"));
-  assert.match(content, /uses: pnpm\/action-setup@v4/);
+  assert.match(content, /uses: pnpm\/action-setup@[a-f0-9]{40}/);
   assert.match(content, /version: 11\.24\.0/);
-  assert.match(content, /rustup toolchain install stable/);
+  assert.match(content, /toolchain: 1\.98\.0/);
   assert.match(content, /bash \.\/scripts\/gate\.sh/);
 });
 
@@ -57,7 +57,7 @@ test("rust-hybrid release candidate renders product scripts, artifact handoff, a
     lanes: ["ci", "release-candidate"],
     profile: "rust-hybrid",
     gate: { path: "scripts/gate.sh" },
-    candidate: { buildScript: "ci:candidate", checkScript: "ci:candidate-check", artifactRoot: "widgets-unsigned" },
+    candidate: { buildScript: "ci:candidate", checkScript: "ci:candidate-check", artifactRoot: "widgets-unsigned", os: ["macos-latest", "windows-latest"] },
     templateVersion: "1.2.0",
   };
   const content = renderTemplate(
@@ -67,7 +67,8 @@ test("rust-hybrid release candidate renders product scripts, artifact handoff, a
   assert.match(content, /pnpm run ci:candidate/);
   assert.match(content, /pnpm run ci:candidate-check/);
   assert.match(content, /RIGHT_GIT_ARTIFACT_ROOT/);
-  assert.match(content, /actions\/upload-artifact@v4/);
+  assert.match(content, /os: \["macos-latest", "windows-latest"\]/);
+  assert.match(content, /actions\/upload-artifact@[a-f0-9]{40}/);
   assert.doesNotMatch(content, /secrets\.|AZURE_|APPLE_|certificate|private.key/i);
 });
 
@@ -95,7 +96,7 @@ test("rendered workflows never request pnpm or yarn setup-node caching before pa
 test("rendered workflows bootstrap each declared package manager safely", () => {
   const pnpm = renderAllLanes({ ...FULL_MANIFEST, packageManager: "pnpm@11.24.0" }, "/repos/widgets");
   for (const content of Object.values(pnpm)) {
-    assert.match(content, /uses: pnpm\/action-setup@v4/);
+    assert.match(content, /uses: pnpm\/action-setup@[a-f0-9]{40}/);
     assert.match(content, /version: 11\.24\.0/);
     assert.doesNotMatch(content, /corepack enable/);
   }

package/templates/profiles/rust-hybrid/ci.yml

@@ -1,12 +1,15 @@
 # Managed by right-git — do not hand-edit. Run `right-git sync` to update.
 # Template: profiles/rust-hybrid/ci.yml | Template version: ${TEMPLATE_VERSION}
-name: ci
-on: [push, pull_request]
+name: legion-ci
+on:
+  pull_request:
+  push:
+    branches: [main]
 permissions:
   contents: read
 jobs:
   private-repo-guard:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Refuse private repository
         if: ${{ github.event.repository.private }}
@@ -20,11 +23,17 @@ jobs:
         node: ${NODE_MATRIX}
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node }}
           package-manager-cache: false
 ${PACKAGE_MANAGER_SETUP}
-      - run: rustup toolchain install stable --profile minimal
+      - uses: dtolnay/rust-toolchain@f8be11a05b1d4f3fcebe6410cc16743212b999b0
+        with:
+          toolchain: 1.98.0
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          workspaces: engine
       - run: bash ./${GATE_PATH}

package/templates/profiles/rust-hybrid/release-candidate.yml

@@ -11,7 +11,7 @@ permissions:
   contents: read
 jobs:
   private-repo-guard:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Refuse private repository
         if: ${{ github.event.repository.private }}
@@ -21,17 +21,23 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: ${OS_MATRIX}
+        os: ${CANDIDATE_OS_MATRIX}
         node: ${NODE_MATRIX}
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node }}
           package-manager-cache: false
 ${PACKAGE_MANAGER_SETUP}
-      - run: rustup toolchain install stable --profile minimal
+      - uses: dtolnay/rust-toolchain@f8be11a05b1d4f3fcebe6410cc16743212b999b0
+        with:
+          toolchain: 1.98.0
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          workspaces: engine
       - run: ${INSTALL_COMMAND}
       - name: Build unsigned release candidate
         run: ${PM_RUN} ${CANDIDATE_BUILD_SCRIPT}
@@ -42,7 +48,7 @@ ${PACKAGE_MANAGER_SETUP}
         env:
           RIGHT_GIT_ARTIFACT_ROOT: ${{ runner.temp }}/${CANDIDATE_ARTIFACT_ROOT}
       - name: Upload unsigned candidate handoff
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: ${ARTIFACT_PREFIX}-unsigned-${{ matrix.os }}-${{ matrix.node }}
           path: ${{ runner.temp }}/${CANDIDATE_ARTIFACT_ROOT}/**