@rightkit/git 0.2.23 → 0.2.25

package/manifest.schema.json

@@ -84,6 +84,19 @@
       "type": "string",
       "pattern": "^\\d+\\.\\d+\\.\\d+$"
     }
+    ,"ownership": {
+      "type": "object",
+      "required": ["roots"],
+      "additionalProperties": false,
+      "properties": {
+        "roots": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": { "type": "string", "pattern": "^(?:\\.|(?!.*\\.\\.)(?!.*\\\\)(?!.*\\s)[A-Za-z0-9][A-Za-z0-9._/-]*)$" }
+        }
+      }
+    }
     ,"profile": { "enum": ["node", "rust-hybrid"] },
     "rustCache": {
       "type": "object",
@@ -105,11 +118,21 @@
     },
     "candidate": {
       "type": "object",
-      "required": ["buildScript", "checkScript", "artifactRoot", "os"],
+      "required": ["buildScript", "checkScript", "admissionScript", "stageSummaryScript", "artifactRoot", "os"],
       "additionalProperties": false,
       "properties": {
         "buildScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
         "checkScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
+        "admissionScript": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$",
+          "description": "Runs in the unconditional `admission` job (workflow_dispatch envelope validation). Required for every release-candidate lane, signed or not."
+        },
+        "stageSummaryScript": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$",
+          "description": "Runs (init/finalize) in the `candidate` job and, when configured, the windows-sign/macos-sign jobs. Required for every release-candidate lane, signed or not."
+        },
         "artifactRoot": { "type": "string", "pattern": "^(?!.*\\.\\.)(?!.*\\s)[A-Za-z0-9][A-Za-z0-9._/-]*$" },
         "os": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } },
         "targets": {
@@ -130,9 +153,14 @@
         "signMacos": { "type": "boolean" },
         "releaseChain": {
           "type": "object",
-          "required": ["windowsFinalizeScript", "installedQualificationScript", "publishScript", "qualificationRunnerVariable"],
+          "required": ["evidenceVerificationScript", "windowsFinalizeScript", "installedQualificationScript", "publishScript", "qualificationRunnerVariable"],
           "additionalProperties": false,
           "properties": {
+            "evidenceVerificationScript": {
+              "type": "string",
+              "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$",
+              "description": "Runs in the `publish` job before the publish step, verifying the aggregated same-run signed/qualification evidence."
+            },
             "windowsFinalizeScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
             "macosFinalizeScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
             "installedQualificationScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },

package/manifest.test.mjs

@@ -22,6 +22,13 @@ test("accepts a minimal valid manifest", () => {
   assert.deepEqual(errors, []);
 });
 
+test("ownership scan registration is explicit and supports nested package roots", () => {
+  assert.equal(validateManifest({ ...VALID_MINIMAL, ownership: { roots: ["engine", "apps/client"] } }).valid, true);
+  for (const roots of [[], ["../outside"], ["src\\escape"], [""], ["engine", "engine"]]) {
+    assert.equal(validateManifest({ ...VALID_MINIMAL, ownership: { roots } }).valid, false, JSON.stringify(roots));
+  }
+});
+
 test("rust-hybrid supports ci plus a configured unsigned release-candidate lane", () => {
   const valid = { ...VALID_MINIMAL, profile: "rust-hybrid", gate: { path: "scripts/gate.sh" } };
   assert.equal(validateManifest(valid).valid, true);
@@ -32,7 +39,14 @@ test("rust-hybrid supports ci plus a configured unsigned release-candidate lane"
   const candidate = {
     ...valid,
     lanes: ["ci", "release-candidate"],
-    candidate: { buildScript: "ci:candidate", checkScript: "ci:candidate-check", artifactRoot: "legion-unsigned", os: ["ubuntu-latest"] },
+    candidate: {
+      buildScript: "ci:candidate",
+      checkScript: "ci:candidate-check",
+      admissionScript: "release:admit",
+      stageSummaryScript: "release:stage-summary",
+      artifactRoot: "legion-unsigned",
+      os: ["ubuntu-latest"],
+    },
   };
   assert.equal(validateManifest(candidate).valid, true);
   assert.equal(validateManifest({ ...candidate, candidate: { ...candidate.candidate, signWindows: true } }).valid, false);
@@ -53,6 +67,7 @@ test("rust-hybrid supports ci plus a configured unsigned release-candidate lane"
     candidate: {
       ...windowsCandidate.candidate,
       releaseChain: {
+        evidenceVerificationScript: "release:verify-evidence",
         windowsFinalizeScript: "release:finalize:win",
         installedQualificationScript: "release:qualify:installed",
         publishScript: "release:publish:qualified",
@@ -68,6 +83,103 @@ test("rust-hybrid supports ci plus a configured unsigned release-candidate lane"
   assert.equal(validateManifest({ ...releaseChain, candidate: { ...releaseChain.candidate, releaseChain: { ...releaseChain.candidate.releaseChain, publishSecrets: ["TOKEN", "TOKEN"] } } }).valid, false);
 });
 
+// Part B fix: admissionScript & stageSummaryScript were moved OUT of the
+// optional candidate.releaseChain object and onto candidate directly,
+// because the admission job and the candidate job's stage-summary
+// init/finalize steps are unconditional parts of the rendered
+// release-candidate template — present for every release-candidate lane,
+// signed or not. This test proves each is independently required with a
+// specific, actionable error, and that the full releaseChain contract
+// (now minus those two promoted fields) is validated key-by-key.
+test("rust-hybrid release-candidate requires admissionScript & stageSummaryScript independent of signing", () => {
+  const base = {
+    ...VALID_MINIMAL,
+    profile: "rust-hybrid",
+    gate: { path: "scripts/gate.sh" },
+    lanes: ["ci", "release-candidate"],
+    candidate: {
+      buildScript: "ci:candidate",
+      checkScript: "ci:candidate-check",
+      admissionScript: "release:admit",
+      stageSummaryScript: "release:stage-summary",
+      artifactRoot: "widgets-unsigned",
+      os: ["ubuntu-latest"],
+    },
+  };
+  assert.equal(validateManifest(base).valid, true, JSON.stringify(validateManifest(base).errors));
+
+  const { admissionScript, ...withoutAdmission } = base.candidate;
+  const missingAdmission = validateManifest({ ...base, candidate: withoutAdmission });
+  assert.equal(missingAdmission.valid, false);
+  assert.ok(missingAdmission.errors.includes("candidate.admissionScript must be one safe package script name"));
+
+  const { stageSummaryScript, ...withoutStageSummary } = base.candidate;
+  const missingStageSummary = validateManifest({ ...base, candidate: withoutStageSummary });
+  assert.equal(missingStageSummary.valid, false);
+  assert.ok(missingStageSummary.errors.includes("candidate.stageSummaryScript must be one safe package script name"));
+
+  // Neither field is accepted inside releaseChain any more.
+  const windows = {
+    ...base,
+    matrix: { ...base.matrix, os: ["ubuntu-latest", "windows-2025"] },
+    candidate: { ...base.candidate, os: ["windows-2025"], signWindows: true },
+  };
+  const misplaced = validateManifest({
+    ...windows,
+    candidate: {
+      ...windows.candidate,
+      releaseChain: {
+        admissionScript: "release:admit",
+        evidenceVerificationScript: "release:verify-evidence",
+        windowsFinalizeScript: "release:finalize:win",
+        installedQualificationScript: "release:qualify:installed",
+        publishScript: "release:publish:qualified",
+        qualificationRunnerVariable: "QUALIFICATION_RUNNER_LABEL",
+      },
+    },
+  });
+  assert.equal(misplaced.valid, false);
+  assert.ok(misplaced.errors.includes("unknown candidate.releaseChain field: admissionScript"));
+});
+
+// Part B fix: evidenceVerificationScript is the one new script that DOES
+// stay inside releaseChain (it runs in the `publish` job, verifying
+// aggregated same-run evidence before the publish step) — required
+// whenever releaseChain is configured, with its own specific error.
+test("candidate.releaseChain requires evidenceVerificationScript with a specific error", () => {
+  const windows = {
+    ...VALID_MINIMAL,
+    profile: "rust-hybrid",
+    gate: { path: "scripts/gate.sh" },
+    lanes: ["ci", "release-candidate"],
+    matrix: { ...VALID_MINIMAL.matrix, os: ["ubuntu-latest", "windows-2025"] },
+    candidate: {
+      buildScript: "ci:candidate",
+      checkScript: "ci:candidate-check",
+      admissionScript: "release:admit",
+      stageSummaryScript: "release:stage-summary",
+      artifactRoot: "widgets-unsigned",
+      os: ["windows-2025"],
+      signWindows: true,
+      releaseChain: {
+        windowsFinalizeScript: "release:finalize:win",
+        installedQualificationScript: "release:qualify:installed",
+        publishScript: "release:publish:qualified",
+        qualificationRunnerVariable: "QUALIFICATION_RUNNER_LABEL",
+      },
+    },
+  };
+  const result = validateManifest(windows);
+  assert.equal(result.valid, false);
+  assert.ok(result.errors.includes("candidate.releaseChain.evidenceVerificationScript must be one safe package script name"));
+
+  const fixed = {
+    ...windows,
+    candidate: { ...windows.candidate, releaseChain: { ...windows.candidate.releaseChain, evidenceVerificationScript: "release:verify-evidence" } },
+  };
+  assert.equal(validateManifest(fixed).valid, true, JSON.stringify(validateManifest(fixed).errors));
+});
+
 test("candidate targets permit native multi-architecture matrices independent of normal CI runners", () => {
   const multiArchitecture = {
     ...VALID_MINIMAL,
@@ -77,6 +189,8 @@ test("candidate targets permit native multi-architecture matrices independent of
     candidate: {
       buildScript: "ci:candidate",
       checkScript: "ci:candidate-check",
+      admissionScript: "release:admit",
+      stageSummaryScript: "release:stage-summary",
       artifactRoot: "widgets-unsigned",
       os: ["windows-2025", "windows-11-arm", "macos-15", "macos-15-intel"],
       targets: [

package/ownership-registration.mjs

@@ -0,0 +1,33 @@
+import path from "node:path";
+
+/** Normalize HTTPS, SSH, and SCP GitHub remotes to one immutable repository key. */
+export function normalizeRepositoryIdentity(value) {
+  if (typeof value !== "string" || !value.trim()) throw new Error("ownership registration requires a repository identity");
+  let text = value.trim();
+  const scp = text.match(/^(?:[^@/]+@)?([^:]+):([^/]+\/[^/]+)$/);
+  if (scp) text = `https://${scp[1]}/${scp[2]}`;
+  let url;
+  try { url = new URL(text); } catch { throw new Error("ownership repository identity must be a Git remote URL"); }
+  if (!["https:", "ssh:"].includes(url.protocol) || (url.username && !(url.protocol === "ssh:" && url.username === "git")) || url.password || url.search || url.hash) throw new Error("unsupported or credential-bearing ownership repository identity");
+  const host = url.hostname.toLowerCase();
+  const parts = url.pathname.replace(/\.git$/i, "").split("/").filter(Boolean);
+  if (host !== "github.com" || parts.length !== 2 || parts.some((part) => !/^[A-Za-z0-9_.-]+$/.test(part))) throw new Error("ownership repository identity must be owner/repository on github.com");
+  return `https://${host}/${parts[0].toLowerCase()}/${parts[1].toLowerCase()}`;
+}
+
+/** Resolve immutable OS-owned roots for one checkout; repo declarations can only narrow reporting, never authority. */
+export function protectedOwnershipRoots(trust, { repositoryIdentity, scanRoot, repoRoot }) {
+  if (!trust || !Array.isArray(trust.repositories)) throw new Error("protected ownership repository registry is missing");
+  const wanted = normalizeRepositoryIdentity(repositoryIdentity);
+  const matches = trust.repositories.filter((entry) => normalizeRepositoryIdentity(entry.repositoryIdentity) === wanted);
+  if (matches.length !== 1) throw new Error(matches.length ? "protected ownership registry has duplicate repository identities" : `repository is not registered for ownership enforcement: ${wanted}`);
+  const entry = matches[0];
+  if (!["public", "private"].includes(entry.visibility) || !Array.isArray(entry.roots) || !entry.roots.length) throw new Error("protected ownership registration is malformed");
+  const roots = entry.roots.map((root) => {
+    if (typeof root !== "string" || !root || root.includes("\\") || root.startsWith("/") || (root !== "." && root.split("/").some((p) => !p || p === "." || p === "..")) || /[*?]/.test(root)) throw new Error("protected ownership roots must be exact relative paths");
+    return root;
+  });
+  const relative = path.relative(repoRoot, scanRoot).replaceAll("\\", "/") || ".";
+  if (!roots.includes(relative)) throw new Error(`scan root is not registered for ${wanted}: ${relative}`);
+  return { repositoryIdentity: wanted, visibility: entry.visibility, roots };
+}

package/ownership-registration.test.mjs

@@ -0,0 +1,20 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { normalizeRepositoryIdentity, protectedOwnershipRoots } from "./ownership-registration.mjs";
+
+test("repository identity normalization collapses HTTPS, SSH, and SCP GitHub remotes", () => {
+  const expected = "https://github.com/bogusyogi/coderight";
+  for (const remote of ["https://github.com/bogusyogi/CodeRight.git", "ssh://git@github.com/bogusyogi/coderight.git", "git@github.com:bogusyogi/coderight.git"]) {
+    assert.equal(normalizeRepositoryIdentity(remote), expected);
+  }
+  assert.throws(() => normalizeRepositoryIdentity("https://user:secret@github.com/a/b.git"), /credential-bearing/);
+});
+
+test("protected registry is authoritative for exact nested roots and visibility", () => {
+  const trust = { repositories: [{ repositoryIdentity: "https://github.com/bogusyogi/coderight", roots: ["engine", "apps/ui"], visibility: "private" }] };
+  assert.deepEqual(protectedOwnershipRoots(trust, { repositoryIdentity: "git@github.com:bogusyogi/coderight.git", scanRoot: "C:/repo/engine", repoRoot: "C:/repo" }), {
+    repositoryIdentity: "https://github.com/bogusyogi/coderight", visibility: "private", roots: ["engine", "apps/ui"],
+  });
+  assert.throws(() => protectedOwnershipRoots(trust, { repositoryIdentity: "https://github.com/bogusyogi/coderight", scanRoot: "C:/repo/src", repoRoot: "C:/repo" }), /not registered/);
+  assert.throws(() => protectedOwnershipRoots({ repositories: [] }, { repositoryIdentity: "https://github.com/a/b", scanRoot: ".", repoRoot: "." }), /not registered/);
+});

package/pack-smoke.test.mjs

@@ -3,11 +3,11 @@
 // publish and runs the extracted bin with `node` — `node --test` run from
 // the source tree never notices a missing directory because the source
 // tree has every file regardless of what `files` declares. This test packs
-// for real (npm pack), extracts to a temp dir, and executes the built bin's
+// for real (pnpm pack), extracts to a temp dir, and executes the built bin's
 // --help and --version from inside that extracted tree only.
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
-import { mkdtempSync, rmSync } from "node:fs";
+import { mkdtempSync, readdirSync, rmSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -24,17 +24,17 @@ function run(command, args, options) {
 test("packaged tarball: right-git --help and --version run clean from the published files only", () => {
   const workDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-git-pack-"));
   try {
-    // shell:true — on Windows "npm" only resolves (to npm.cmd) through the
-    // shell; args here are fixed literals we construct, never user input.
-    const packResult = run("npm", ["pack", "--json", "--pack-destination", workDir], { cwd: packageRoot, shell: true });
-    assert.equal(packResult.status, 0, `npm pack failed: ${packResult.stderr}`);
-    const [packInfo] = JSON.parse(packResult.stdout);
+    // shell:true resolves pnpm.cmd on Windows; args are fixed literals.
+    const packResult = run("pnpm", ["pack", "--pack-destination", workDir], { cwd: packageRoot, shell: true });
+    assert.equal(packResult.status, 0, `pnpm pack failed: ${packResult.stderr}`);
+    const archive = readdirSync(workDir).find((name) => name.endsWith(".tgz"));
+    assert.ok(archive, `pnpm pack did not create a tarball: ${packResult.stdout}`);
 
     // Run tar FROM the temp dir on the bare filename so no absolute "C:\..."
     // path reaches tar — that colon is the only reason GNU tar's --force-local
     // was ever needed, and avoiding it keeps this portable to bsdtar (the
     // Windows built-in) and any CI host, not just a GNU-tar toolchain.
-    const extractResult = run("tar", ["-xzf", packInfo.filename], { cwd: workDir });
+    const extractResult = run("tar", ["-xzf", archive], { cwd: workDir });
     assert.equal(extractResult.status, 0, `tar extract failed: ${extractResult.stderr}`);
     // npm tarballs always nest content under a top-level "package/" directory.
     const extractedPackageDir = path.join(workDir, "package");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/git",
-  "version": "0.2.23",
+  "version": "0.2.25",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
   "license": "MIT OR Apache-2.0",
   "type": "module",