@rightkit/git 0.2.20 → 0.2.22

package/guard-coverage.test.mjs

@@ -52,6 +52,7 @@ const templatesDir = path.join(packageRoot, "templates");
 
 const FULL_MANIFEST = {
   schemaVersion: 1,
+  compile: "github-actions-only",
   lanes: [...KNOWN_LANES],
   matrix: { os: ["ubuntu-latest", "macos-latest", "windows-latest"], node: ["22.13", "24"] },
   packageManager: "pnpm@11.24.0",

package/install.mjs

@@ -13,7 +13,7 @@ import { applyPlan, planSync } from "./sync.mjs";
 
 export const DEFAULT_MATRIX = { os: ["ubuntu-latest", "macos-latest", "windows-latest"], node: ["22.13", "24"] };
 export const DEFAULT_PACKAGE_MANAGER = "pnpm@11.24.0";
-export const DEFAULT_TEMPLATE_VERSION = "1.1.0";
+export const DEFAULT_TEMPLATE_VERSION = "1.7.0";
 
 /**
  * opts: { lanes: string[], matrix?, packageManager?, templateVersion?,
@@ -38,6 +38,7 @@ export async function installCommand(repoPath, opts = {}, deps = {}) {
 
   const manifest = {
     schemaVersion: 1,
+    compile: "github-actions-only",
     lanes,
     matrix: opts.matrix || DEFAULT_MATRIX,
     packageManager: opts.packageManager || DEFAULT_PACKAGE_MANAGER,

package/manifest.mjs

@@ -50,6 +50,7 @@ const WINGET_PACKAGE_IDENTIFIER_RE = /^[A-Za-z0-9][A-Za-z0-9-]*(?:\.[A-Za-z0-9][
 
 const TOP_LEVEL_KEYS = new Set([
   "schemaVersion",
+  "compile",
   "lanes",
   "matrix",
   "packageManager",
@@ -100,6 +101,9 @@ export function validateManifest(manifest) {
   if (manifest.schemaVersion !== 1) {
     errors.push("schemaVersion must be exactly 1");
   }
+  if (manifest.compile !== "github-actions-only") {
+    errors.push("compile must be exactly 'github-actions-only' for public repositories");
+  }
 
   let lanes = [];
   if (!Array.isArray(manifest.lanes) || manifest.lanes.length === 0) {

package/manifest.schema.json

@@ -4,12 +4,15 @@
   "title": "right-git per-repo manifest (.rightgit.json)",
   "description": "Declares which right-git lanes a public repo installs and how templates should be parameterized. Hand-validated by manifest.mjs — this file documents the contract, it is not fed to a JSON Schema validator at runtime.",
   "type": "object",
-  "required": ["schemaVersion", "lanes", "matrix", "packageManager", "templateVersion"],
+  "required": ["schemaVersion", "compile", "lanes", "matrix", "packageManager", "templateVersion"],
   "additionalProperties": false,
   "properties": {
     "schemaVersion": {
       "const": 1
     },
+    "compile": {
+      "const": "github-actions-only"
+    },
     "lanes": {
       "type": "array",
       "minItems": 1,

package/manifest.test.mjs

@@ -4,12 +4,18 @@ import { validateManifest } from "./manifest.mjs";
 
 const VALID_MINIMAL = {
   schemaVersion: 1,
+  compile: "github-actions-only",
   lanes: ["ci"],
   matrix: { os: ["ubuntu-latest"], node: ["22.13"] },
   packageManager: "pnpm@11.24.0",
   templateVersion: "1.0.0",
 };
 
+test("requires GitHub Actions only compilation", () => {
+  assert.equal(validateManifest({ ...VALID_MINIMAL, compile: undefined }).valid, false);
+  assert.equal(validateManifest({ ...VALID_MINIMAL, compile: "local" }).valid, false);
+});
+
 test("accepts a minimal valid manifest", () => {
   const { valid, errors } = validateManifest(VALID_MINIMAL);
   assert.equal(valid, true);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/git",
-  "version": "0.2.20",
+  "version": "0.2.22",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/render.test.mjs

@@ -11,6 +11,7 @@ const templatesDir = path.join(packageRoot, "templates");
 
 const FULL_MANIFEST = {
   schemaVersion: 1,
+  compile: "github-actions-only",
   lanes: [...KNOWN_LANES],
   matrix: { os: ["ubuntu-latest", "macos-latest", "windows-latest"], node: ["22.13", "24"] },
   packageManager: "pnpm@11.24.0",
@@ -51,11 +52,32 @@ test("rust-hybrid ci renders its pinned package manager and gate", () => {
   assert.match(content, /version: 11\.24\.0/);
   assert.match(content, /components: rustfmt, clippy/);
   assert.doesNotMatch(content, /toolchain:/);
+  assert.match(content, /group: \$\{\{ github\.workflow \}\}-\$\{\{ github\.ref \}\}/);
+  assert.match(content, /cancel-in-progress: true/);
   assert.match(content, /bash \.\/scripts\/gate\.sh/);
+  assert.match(content, /name: Detect Rust-affecting changes\n        id: rust-changes/);
+  assert.match(content, /RIGHT_GIT_DIFF_BASE: \$\{\{ github\.event_name == 'pull_request' && github\.event\.pull_request\.base\.sha \|\| github\.event\.before \}\}/);
+  assert.match(content, /changed=true[\s\S]*\^0\{40\}\$[\s\S]*git cat-file -e[\s\S]*git diff --name-only --diff-filter=ACDMRTUXB/);
+  assert.match(content, /--diff-filter=ACDMRTUXB/, "deleted Rust inputs must trigger Rust setup");
+  assert.match(content, /\*\.rs\|Cargo\.toml[\s\S]*scripts\/gate\.sh/);
+  assert.match(content, /\.rightgit\.json\|\.github\/workflows\/\*\.yml\|\.github\/workflows\/\*\.yaml/);
+  assert.equal((content.match(/if: steps\.rust-changes\.outputs\.changed == 'true'/g) ?? []).length, 3);
+  assert.match(content, /RIGHT_GIT_RUST_CHANGED: \$\{\{ steps\.rust-changes\.outputs\.changed \}\}/);
+  assert.match(content, /RUSTC_WRAPPER: \$\{\{ steps\.rust-changes\.outputs\.changed == 'true' && 'sccache' \|\| '' \}\}/);
+  assert.match(content, /CARGO_INCREMENTAL: "0"/);
+  assert.match(content, /CARGO_PROFILE_DEV_DEBUG: "0"/);
+  assert.match(content, /CARGO_PROFILE_TEST_DEBUG: "0"/);
+  assert.doesNotMatch(content, /opt-level|codegen-units|\blto\b|strip\s*=/i);
   assert.match(content, /os: \["windows-latest"\]/);
   assert.doesNotMatch(content, /ubuntu-latest|macos-latest/);
 });
 
+test("ordinary CI templates cancel superseded runs on the same ref", () => {
+  const generic = renderAllLanes(FULL_MANIFEST, "/repos/widgets").ci;
+  assert.match(generic, /group: \$\{\{ github\.workflow \}\}-\$\{\{ github\.ref \}\}/);
+  assert.match(generic, /cancel-in-progress: true/);
+});
+
 test("rust-hybrid ci preserves a declared macOS-only lane", () => {
   const manifest = {
     ...FULL_MANIFEST,
@@ -96,6 +118,9 @@ test("rust-hybrid release candidate renders product scripts, artifact handoff, a
   assert.match(content, /RIGHT_GIT_RELEASE_ARCHITECTURE: \$\{\{ matrix\.architecture \}\}/);
   assert.match(content, /actions\/upload-artifact@[a-f0-9]{40}/);
   assert.doesNotMatch(content, /secrets\.|AZURE_|APPLE_|certificate|private.key/i);
+  assert.doesNotMatch(content, /rust-changes|RIGHT_GIT_RUST_CHANGED/);
+  assert.doesNotMatch(content, /if: steps\.rust-changes/);
+  assert.match(content, /uses: dtolnay\/rust-toolchain@[a-f0-9]{40}\n        with:/);
 });
 
 test("rust-hybrid cache contract renders every declared Cargo workspace", () => {
@@ -115,7 +140,7 @@ test("rust-hybrid cache contract renders every declared Cargo workspace", () =>
   assert.match(content, /add-job-id-key: false/);
   assert.match(content, /cache-workspace-crates: false/);
   assert.match(content, /cache-on-failure: true/);
-  assert.match(content, /RUSTC_WRAPPER: "sccache"/);
+  assert.match(content, /RUSTC_WRAPPER: \$\{\{ steps\.rust-changes\.outputs\.changed == 'true' && 'sccache' \|\| '' \}\}/);
 });
 
 test("rust-hybrid release candidate can opt into OIDC Windows signing without long-lived secrets", () => {

package/sync.test.mjs

@@ -57,6 +57,7 @@ test("sync reports manifest errors instead of writing files", async () => {
 test("sync rejects a Membrane-like release chain without root @rightkit/release", async () => {
   const manifest = {
     schemaVersion: 1,
+    compile: "github-actions-only",
     lanes: ["ci", "release-candidate"],
     matrix: { os: ["windows-2025", "macos-15"], node: ["22.23.2"] },
     packageManager: "pnpm@11.24.0",

package/templates/ci.yml

@@ -7,6 +7,9 @@ on:
     branches: [main]
 permissions:
   contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 # F5 fix: `private-repo-guard` carries no job-level `if`, so it always runs.
 # Its one step's own `if` fires only when the repo is private, and `exit 1`
 # then fails the JOB (loud, visible, non-zero) rather than the previous

package/templates/profiles/rust-hybrid/ci.yml

@@ -7,6 +7,9 @@ on:
     branches: [main]
 permissions:
   contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 jobs:
   private-repo-guard:
     runs-on: ubuntu-24.04
@@ -16,9 +19,6 @@ jobs:
         run: exit 1
   ci:
     needs: [private-repo-guard]
-    env:
-      SCCACHE_GHA_ENABLED: "true"
-      RUSTC_WRAPPER: "sccache"
     strategy:
       fail-fast: false
       matrix:
@@ -31,15 +31,40 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+      - name: Detect Rust-affecting changes
+        id: rust-changes
+        shell: bash
+        env:
+          RIGHT_GIT_DIFF_BASE: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
+        run: |
+          set -euo pipefail
+          changed=true
+          base="$RIGHT_GIT_DIFF_BASE"
+          if [[ "$base" =~ ^[0-9a-fA-F]{40}$ ]] && [[ ! "$base" =~ ^0{40}$ ]] && git cat-file -e "$base^{commit}" 2>/dev/null; then
+            if changed_paths="$(git diff --name-only --diff-filter=ACDMRTUXB "$base" "$GITHUB_SHA")"; then
+              changed=false
+              while IFS= read -r changed_path; do
+                case "$changed_path" in
+                  *.rs|Cargo.toml|*/Cargo.toml|Cargo.lock|*/Cargo.lock|build.rs|*/build.rs|rust-toolchain|*/rust-toolchain|rust-toolchain.toml|*/rust-toolchain.toml|.cargo/*|*/.cargo/*|.rightgit.json|.github/workflows/*.yml|.github/workflows/*.yaml|${GATE_PATH})
+                    changed=true
+                    break
+                    ;;
+                esac
+              done <<< "$changed_paths"
+            fi
+          fi
+          printf 'changed=%s\n' "$changed" >> "$GITHUB_OUTPUT"
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node }}
           package-manager-cache: false
 ${PACKAGE_MANAGER_SETUP}
       - uses: dtolnay/rust-toolchain@f8be11a05b1d4f3fcebe6410cc16743212b999b0
+        if: steps.rust-changes.outputs.changed == 'true'
         with:
           components: rustfmt, clippy
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        if: steps.rust-changes.outputs.changed == 'true'
         with:
           workspaces: |
 ${RUST_CACHE_WORKSPACES}
@@ -49,6 +74,14 @@ ${RUST_CACHE_WORKSPACES}
           cache-on-failure: true
           save-if: ${{ github.event_name != 'pull_request' }}
       - uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
+        if: steps.rust-changes.outputs.changed == 'true'
         with:
           version: "v0.16.0"
       - run: bash ./${GATE_PATH}
+        env:
+          RIGHT_GIT_RUST_CHANGED: ${{ steps.rust-changes.outputs.changed }}
+          SCCACHE_GHA_ENABLED: "true"
+          RUSTC_WRAPPER: ${{ steps.rust-changes.outputs.changed == 'true' && 'sccache' || '' }}
+          CARGO_INCREMENTAL: "0"
+          CARGO_PROFILE_DEV_DEBUG: "0"
+          CARGO_PROFILE_TEST_DEBUG: "0"

package/test-support.mjs

@@ -26,6 +26,7 @@ export const PRIVATE_DEPS = ghDeps("PRIVATE");
 
 export const SAMPLE_MANIFEST = {
   schemaVersion: 1,
+  compile: "github-actions-only",
   lanes: ["ci", "package-smoke"],
   matrix: { os: ["ubuntu-latest"], node: ["22.13"] },
   packageManager: "pnpm@11.24.0",

package/uninstall.test.mjs

@@ -3,7 +3,7 @@ import assert from "node:assert/strict";
 import fs from "node:fs";
 import path from "node:path";
 import { syncCommand } from "./sync.mjs";
-import { installCommand } from "./install.mjs";
+import { DEFAULT_TEMPLATE_VERSION, installCommand } from "./install.mjs";
 import { uninstallCommand } from "./uninstall.mjs";
 import { listManagedFiles } from "./sync.mjs";
 import { MANIFEST_FILENAME } from "./manifest.mjs";
@@ -77,3 +77,13 @@ test("install validates before it creates a manifest", async () => {
   assert.equal(result.stage, "manifest-invalid");
   assert.equal(fs.existsSync(path.join(dir, MANIFEST_FILENAME)), false);
 });
+
+test("install emits GitHub-Actions-only policy at template 1.7.0", async () => {
+  const dir = makeTempRepo(null);
+  const result = await installCommand(dir, { lanes: ["ci"] }, PUBLIC_DEPS);
+  assert.equal(result.ok, true);
+  const manifest = JSON.parse(fs.readFileSync(path.join(dir, MANIFEST_FILENAME), "utf8"));
+  assert.equal(manifest.compile, "github-actions-only");
+  assert.equal(DEFAULT_TEMPLATE_VERSION, "1.7.0");
+  assert.equal(manifest.templateVersion, DEFAULT_TEMPLATE_VERSION);
+});