@rightkit/git 0.2.23 → 0.2.25

package/render.test.mjs

@@ -4,7 +4,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { renderTemplate, MANAGED_MARKER } from "./render.mjs";
-import { buildRenderContext, LANE_FILENAMES, KNOWN_LANES } from "./manifest.mjs";
+import { buildRenderContext, LANE_FILENAMES, KNOWN_LANES, validateManifest } from "./manifest.mjs";
 
 const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)));
 const templatesDir = path.join(packageRoot, "templates");
@@ -73,6 +73,21 @@ test("rust-hybrid ci renders its pinned package manager and gate", () => {
   assert.doesNotMatch(content, /ubuntu-latest|macos-latest/);
 });
 
+test("every generated workflow profile runs ownership scanning independent of optional repository roots", () => {
+  const roots = ["engine", "apps/client"];
+  const manifest = { ...FULL_MANIFEST, ownership: { roots } };
+  const rendered = renderAllLanes(manifest, "C:/repos/coderight");
+  for (const [lane, content] of Object.entries(rendered)) {
+    assert.match(content, /right-release ownership --app \./, lane);
+    assert.match(content, /protected registry roots/, lane);
+  }
+  const rust = renderTemplate(fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/ci.yml"), "utf8"), buildRenderContext({ ...manifest, profile: "rust-hybrid", gate: { path: "scripts/gate.sh" } }, "C:/repos/coderight"));
+  assert.match(rust, /RightKit ownership \(protected registry roots\)/);
+  assert.match(rust, /pnpm exec right-release ownership --app \./);
+  const withoutRoots = renderAllLanes(FULL_MANIFEST, "C:/repos/widgets");
+  for (const [lane, content] of Object.entries(withoutRoots)) assert.match(content, /right-release ownership --app \./, lane);
+});
+
 test("ordinary CI templates cancel superseded runs on the same ref", () => {
   const generic = renderAllLanes(FULL_MANIFEST, "/repos/widgets").ci;
   assert.match(generic, /group: \$\{\{ github\.workflow \}\}-\$\{\{ github\.ref \}\}/);
@@ -101,7 +116,14 @@ test("rust-hybrid release candidate renders product scripts, artifact handoff, a
     lanes: ["ci", "release-candidate"],
     profile: "rust-hybrid",
     gate: { path: "scripts/gate.sh" },
-    candidate: { buildScript: "ci:candidate", checkScript: "ci:candidate-check", artifactRoot: "widgets-unsigned", os: ["macos-latest", "windows-latest"] },
+    candidate: {
+      buildScript: "ci:candidate",
+      checkScript: "ci:candidate-check",
+      admissionScript: "release:admit",
+      stageSummaryScript: "release:stage-summary",
+      artifactRoot: "widgets-unsigned",
+      os: ["macos-latest", "windows-latest"],
+    },
     templateVersion: "1.2.0",
   };
   const content = renderTemplate(
@@ -110,6 +132,8 @@ test("rust-hybrid release candidate renders product scripts, artifact handoff, a
   );
   assert.match(content, /pnpm run ci:candidate/);
   assert.match(content, /pnpm run ci:candidate-check/);
+  assert.match(content, /pnpm run release:admit/);
+  assert.match(content, /pnpm run release:stage-summary/);
   assert.match(content, /Mozilla-Actions\/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba/);
   assert.match(content, /shared-key: widgets-rust/);
   assert.doesNotMatch(content, /bash \.\/scripts\/gate\.sh/);
@@ -122,6 +146,12 @@ test("rust-hybrid release candidate renders product scripts, artifact handoff, a
   assert.doesNotMatch(content, /rust-changes|RIGHT_GIT_RUST_CHANGED/);
   assert.doesNotMatch(content, /if: steps\.rust-changes/);
   assert.match(content, /uses: dtolnay\/rust-toolchain@[a-f0-9]{40}\n        with:/);
+  // workflow_dispatch tag-last envelope: no windows-sign/macos-sign/release
+  // chain jobs render at all when signing is not configured.
+  assert.match(content, /^on:\n  workflow_dispatch:/m);
+  assert.doesNotMatch(content, /^ {2}(?:windows-sign|macos-sign|installed-qualification|publish):\s*$/m);
+  assert.doesNotMatch(content, /run: (?:pnpm|npm|yarn) run undefined\b/);
+  assert.doesNotMatch(content, /\$\{\{\s*github\.output\s*\}\}/);
 });
 
 test("rust-hybrid cache contract renders every declared Cargo workspace", () => {
@@ -151,7 +181,15 @@ test("rust-hybrid release candidate can opt into OIDC Windows signing without lo
     lanes: ["ci", "release-candidate"],
     profile: "rust-hybrid",
     gate: { path: "scripts/gate.sh" },
-    candidate: { buildScript: "ci:candidate", checkScript: "ci:candidate-check", artifactRoot: "widgets-unsigned", os: ["windows-2025"], signWindows: true },
+    candidate: {
+      buildScript: "ci:candidate",
+      checkScript: "ci:candidate-check",
+      admissionScript: "release:admit",
+      stageSummaryScript: "release:stage-summary",
+      artifactRoot: "widgets-unsigned",
+      os: ["windows-2025"],
+      signWindows: true,
+    },
     matrix: { os: ["ubuntu-24.04", "windows-2025"], node: ["22.23.2"] },
     templateVersion: "1.3.0",
   };
@@ -160,16 +198,26 @@ test("rust-hybrid release candidate can opt into OIDC Windows signing without lo
     buildRenderContext(manifest, "/repos/widgets"),
   );
   assert.match(content, /environment: release/);
-  assert.match(content, /windows-sign:\n    needs: \[candidate\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\) \|\| \(github\.event_name == 'workflow_dispatch' && inputs\.signed_qualification == true\) \}\}/);
+  // Tag-last contract: signing is gated on the admitted, same-run
+  // signed_qualification OUTPUT of the `admission` job — never on a ref/tag
+  // and never on the raw workflow_dispatch input directly.
+  assert.match(content, /windows-sign:\n    needs: \[admission, candidate\]\n    if: \$\{\{ needs\.admission\.outputs\.signed_qualification == 'true' \}\}/);
+  assert.doesNotMatch(content, /startsWith\(github\.ref, 'refs\/tags\/v'\)/);
   assert.match(content, /id-token: write/);
   assert.match(content, /azure\/login@[a-f0-9]{40}/);
   assert.match(content, /vars\.AZURE_CLIENT_ID/);
   assert.match(content, /right-release build --platform win --skip-checks/);
   assert.match(content, /Artifact Signing client hash mismatch/);
-  assert.match(content, /RIGHT_GIT_SOURCE_REVISION=\$\(git rev-parse HEAD\)/);
+  // Every downstream job (admission, candidate, and windows-sign here) checks
+  // out the exact admitted revision by SHA, never by resolving HEAD after a
+  // ref-triggered checkout.
+  assert.match(content, /windows-sign:[\s\S]*?ref: \$\{\{ needs\.admission\.outputs\.source_revision \}\}\n\s+fetch-depth: 0\n\s+persist-credentials: false/);
+  assert.match(content, /git rev-parse HEAD.*inputs\.source_revision \|\| github\.sha/);
   assert.ok(content.includes("LEGION_SOURCE_REVISION: ${{ env.RIGHT_GIT_SOURCE_REVISION }}"));
   assert.doesNotMatch(content, /LEGION_SOURCE_REVISION: \$\{\{ github\.sha \}\}/);
   assert.doesNotMatch(content, /secrets\.|client-secret|private.key/i);
+  assert.doesNotMatch(content, /run: (?:pnpm|npm|yarn) run undefined\b/);
+  assert.doesNotMatch(content, /\$\{\{\s*github\.output\s*\}\}/);
 });
 
 test("rust-hybrid release candidate can opt into protected macOS signing & notarization", () => {
@@ -178,7 +226,15 @@ test("rust-hybrid release candidate can opt into protected macOS signing & notar
     lanes: ["ci", "release-candidate"],
     profile: "rust-hybrid",
     gate: { path: "scripts/gate.sh" },
-    candidate: { buildScript: "ci:candidate", checkScript: "ci:candidate-check", artifactRoot: "widgets-unsigned", os: ["macos-15"], signMacos: true },
+    candidate: {
+      buildScript: "ci:candidate",
+      checkScript: "ci:candidate-check",
+      admissionScript: "release:admit",
+      stageSummaryScript: "release:stage-summary",
+      artifactRoot: "widgets-unsigned",
+      os: ["macos-15"],
+      signMacos: true,
+    },
     matrix: { os: ["ubuntu-24.04", "macos-15"], node: ["22.23.2"] },
     templateVersion: "1.3.0",
   };
@@ -187,17 +243,21 @@ test("rust-hybrid release candidate can opt into protected macOS signing & notar
     buildRenderContext(manifest, "/repos/widgets"),
   );
   assert.match(content, /macos-sign:/);
-  assert.match(content, /macos-sign:\n    needs: \[candidate\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\) \|\| \(github\.event_name == 'workflow_dispatch' && inputs\.signed_qualification == true\) \}\}/);
+  assert.match(content, /macos-sign:\n    needs: \[admission, candidate\]\n    if: \$\{\{ needs\.admission\.outputs\.signed_qualification == 'true' \}\}/);
+  assert.doesNotMatch(content, /startsWith\(github\.ref, 'refs\/tags\/v'\)/);
   assert.match(content, /environment: release/);
   assert.match(content, /secrets\.APPLE_CERTIFICATE_BASE64/);
   assert.match(content, /temporary keychain/i);
   assert.match(content, /right-release build --platform mac --skip-checks/);
   assert.match(content, /secrets\.APPLE_API_KEY_BASE64/);
-  assert.match(content, /RIGHT_GIT_SOURCE_REVISION=%s\\n.*git rev-parse HEAD/);
+  assert.match(content, /macos-sign:[\s\S]*?ref: \$\{\{ needs\.admission\.outputs\.source_revision \}\}\n\s+fetch-depth: 0\n\s+persist-credentials: false/);
+  assert.match(content, /git rev-parse HEAD.*inputs\.source_revision \|\| github\.sha/);
   assert.ok(content.includes("LEGION_SOURCE_REVISION: ${{ env.RIGHT_GIT_SOURCE_REVISION }}"));
   assert.doesNotMatch(content, /LEGION_SOURCE_REVISION: \$\{\{ github\.sha \}\}/);
   assert.match(content, /security delete-keychain/);
   assert.doesNotMatch(content, /pull_request_target/);
+  assert.doesNotMatch(content, /run: (?:pnpm|npm|yarn) run undefined\b/);
+  assert.doesNotMatch(content, /\$\{\{\s*github\.output\s*\}\}/);
 });
 
 test("rust-hybrid multi-architecture candidates bind every native target to exact artifacts and signing", () => {
@@ -210,6 +270,8 @@ test("rust-hybrid multi-architecture candidates bind every native target to exac
     candidate: {
       buildScript: "ci:candidate",
       checkScript: "ci:candidate-check",
+      admissionScript: "release:admit",
+      stageSummaryScript: "release:stage-summary",
       artifactRoot: "widgets-unsigned",
       os: ["windows-2025", "windows-11-arm", "macos-15", "macos-15-intel"],
       targets: [
@@ -235,10 +297,15 @@ test("rust-hybrid multi-architecture candidates bind every native target to exac
   assert.doesNotMatch(content, /bash \.\/scripts\/gate\.sh/);
   assert.match(content, /windows-sign:[\s\S]*matrix:[\s\S]*windows-11-arm/);
   assert.match(content, /macos-sign:[\s\S]*matrix:[\s\S]*macos-15-intel/);
-  assert.match(content, /name: widgets-unsigned-\$\{\{ matrix\.platform \}\}-\$\{\{ matrix\.architecture \}\}-22\.23\.2/);
-  assert.match(content, /name: widgets-signed-windows-\$\{\{ matrix\.architecture \}\}-22\.23\.2/);
-  assert.match(content, /name: widgets-signed-macos-\$\{\{ matrix\.architecture \}\}-22\.23\.2/);
-  assert.equal((content.match(/RIGHT_GIT_RELEASE_ARCHITECTURE: \$\{\{ matrix\.architecture \}\}/g) ?? []).length, 4);
+  // Every artifact name is run- and identity-bound: <prefix>-<run_id>-<run_attempt>-<kind>-...-<version>-<source_revision>.
+  assert.match(content, /name: widgets-\$\{\{ github\.run_id \}\}-\$\{\{ github\.run_attempt \}\}-candidate-\$\{\{ matrix\.platform \}\}-\$\{\{ matrix\.architecture \}\}-\$\{\{ needs\.admission\.outputs\.version \}\}-\$\{\{ needs\.admission\.outputs\.source_revision \}\}/);
+  assert.match(content, /name: widgets-\$\{\{ github\.run_id \}\}-\$\{\{ github\.run_attempt \}\}-signed-windows-\$\{\{ matrix\.architecture \}\}-\$\{\{ needs\.admission\.outputs\.version \}\}-\$\{\{ needs\.admission\.outputs\.source_revision \}\}/);
+  assert.match(content, /name: widgets-\$\{\{ github\.run_id \}\}-\$\{\{ github\.run_attempt \}\}-signed-macos-\$\{\{ matrix\.architecture \}\}-\$\{\{ needs\.admission\.outputs\.version \}\}-\$\{\{ needs\.admission\.outputs\.source_revision \}\}/);
+  // Exact-count regression guard across the candidate job's build/check/
+  // stage-summary steps and the windows-sign/macos-sign stage-summary steps.
+  assert.equal((content.match(/RIGHT_GIT_RELEASE_ARCHITECTURE: \$\{\{ matrix\.architecture \}\}/g) ?? []).length, 10);
+  assert.doesNotMatch(content, /run: (?:pnpm|npm|yarn) run undefined\b/);
+  assert.doesNotMatch(content, /\$\{\{\s*github\.output\s*\}\}/);
 });
 
 test("rust-hybrid release chain preserves signed candidate, installed qualification, then publish", () => {
@@ -250,11 +317,14 @@ test("rust-hybrid release chain preserves signed candidate, installed qualificat
     candidate: {
       buildScript: "ci:candidate",
       checkScript: "ci:candidate-check",
+      admissionScript: "release:admit",
+      stageSummaryScript: "release:stage-summary",
       artifactRoot: "widgets-unsigned",
       os: ["windows-2025", "macos-15"],
       signWindows: true,
       signMacos: true,
       releaseChain: {
+        evidenceVerificationScript: "release:verify-evidence",
         windowsFinalizeScript: "release:finalize:win",
         macosFinalizeScript: "release:finalize:mac",
         installedQualificationScript: "release:qualify:installed",
@@ -272,26 +342,201 @@ test("rust-hybrid release chain preserves signed candidate, installed qualificat
   );
   assert.match(content, /windows-sign:[\s\S]*pnpm run release:finalize:win/);
   assert.match(content, /macos-sign:[\s\S]*pnpm run release:finalize:mac/);
-  assert.match(content, /signed_qualification:\n        description: Run protected signing & installed qualification without publishing/);
-  assert.match(content, /windows-sign:[\s\S]*inputs\.signed_qualification == true/);
-  assert.match(content, /macos-sign:[\s\S]*inputs\.signed_qualification == true/);
-  assert.match(content, /installed-qualification:\n    needs: \[candidate, windows-sign\]/);
-  assert.match(content, /installed-qualification:[\s\S]*inputs\.signed_qualification == true/);
+  // Tag-last contract: every gate reads the ADMITTED, same-run outputs of
+  // the `admission` job — never the raw workflow_dispatch input directly,
+  // and never a ref/tag.
+  assert.match(content, /signed_qualification:\n        description: Run protected signing, installed qualification, & evidence verification/);
+  assert.doesNotMatch(content, /inputs\.signed_qualification == true/);
+  assert.doesNotMatch(content, /startsWith\(github\.ref, 'refs\/tags\/v'\)/);
+  assert.match(content, /windows-sign:\n    needs: \[admission, candidate\]\n    if: \$\{\{ needs\.admission\.outputs\.signed_qualification == 'true' \}\}/);
+  assert.match(content, /macos-sign:\n    needs: \[admission, candidate\]\n    if: \$\{\{ needs\.admission\.outputs\.signed_qualification == 'true' \}\}/);
+  assert.match(content, /installed-qualification:\n    needs: \[admission, candidate, windows-sign\]/);
+  assert.match(content, /installed-qualification:[\s\S]*?if: \$\{\{ always\(\) && needs\.admission\.outputs\.signed_qualification == 'true' && needs\.candidate\.result == 'success' \}\}/);
   assert.match(content, /installed_qualification_failed/);
   assert.match(content, /shell: pwsh\n        run: \|\n          throw 'installed_qualification_failed \{ reason: prerequisites_absent, detail: "same-run Windows signing\/finalization did not succeed" \}'/);
   assert.doesNotMatch(content, /^        run: throw 'installed_qualification_failed .*detail: /m);
   assert.match(content, /pnpm run release:qualify:installed/);
   assert.match(content, /installed-qualification:[\s\S]*GH_TOKEN: \$\{\{ github\.token \}\}/);
-  assert.match(content, /publish:\n    needs: \[installed-qualification, macos-sign\]/);
-  assert.match(content, /publish:[\s\S]*startsWith\(github\.ref, 'refs\/tags\/v'\)/);
-  assert.doesNotMatch(content.slice(content.indexOf("  publish:")), /inputs\.signed_qualification/);
-  assert.match(content, /needs\.macos-sign\.result == 'success'/);
+  assert.match(content, /publish:\n    needs: \[admission, installed-qualification, macos-sign\]/);
+  assert.match(content, /publish:[\s\S]*?if: \$\{\{ needs\.admission\.outputs\.publish == 'true' && needs\.installed-qualification\.result == 'success' && needs\.macos-sign\.result == 'success' \}\}/);
+  const publishJobIndex = content.search(/^ {2}publish:\n {4}needs:/m);
+  assert.ok(publishJobIndex >= 0, "publish job must be present");
+  assert.doesNotMatch(content.slice(publishJobIndex), /inputs\.signed_qualification|inputs\.publish/);
   assert.match(content, /contents: write/);
+  // Publish is the sole creator of the tag/release: it must not require a
+  // pre-existing tag anywhere in its gate.
+  assert.doesNotMatch(content.slice(publishJobIndex), /refs\/tags/);
+  assert.match(content, /pnpm run release:verify-evidence/);
+  assert.match(content, /Verify aggregated release evidence[\s\S]*?pnpm run release:verify-evidence/);
   assert.match(content, /pnpm run release:publish:qualified/);
   assert.match(content, /CLOUDFLARE_API_TOKEN: \$\{\{ secrets\.CLOUDFLARE_API_TOKEN \}\}/);
-  assert.equal((content.match(/RIGHT_GIT_SOURCE_REVISION=\$\(git rev-parse HEAD\)/g) ?? []).length, 3);
+  // Ownership scan binds to the source revision input before admission emits
+  // that same revision for every downstream job.
+  assert.match(content, /git rev-parse HEAD.*inputs\.source_revision \|\| github\.sha/);
   assert.doesNotMatch(content, /RIGHT_GIT_SOURCE_REVISION: \$\{\{ github\.sha \}\}/);
+  // candidate, windows-sign, macos-sign, installed-qualification and publish all
+  // check out the admitted revision with full history; admission checks out
+  // ${{ inputs.source_revision }} (it IS the admission job — there is no
+  // needs.admission yet). Full history is load-bearing, not cosmetic: see
+  // "every job checking out an admitted revision fetches full history".
+  assert.equal((content.match(/ref: \$\{\{ needs\.admission\.outputs\.source_revision \}\}\n\s+fetch-depth: 0\n\s+persist-credentials: false/g) ?? []).length, 5, "candidate, windows-sign, macos-sign, installed-qualification & publish should all pin the admitted revision with full history");
+  assert.doesNotMatch(content, /ref: \$\{\{ needs\.admission\.outputs\.source_revision \}\}\n\s+persist-credentials: false/, "no admitted-revision checkout may be shallow");
+  assert.match(content, /ref: \$\{\{ inputs\.source_revision \}\}\n\s+fetch-depth: 0\n\s+persist-credentials: false/, "admission must check out the exact dispatch-supplied revision");
   assert.doesNotMatch(content.slice(0, content.indexOf("  windows-sign:")), /secrets\.|id-token: write|contents: write/);
+  // Downstream download-artifact names must match exactly what windows-sign/
+  // macos-sign uploaded (see the multi-architecture test) — this is the
+  // regression guard for the artifact-name mismatch bug.
+  const windowsSignedArtifact = "widgets-${{ github.run_id }}-${{ github.run_attempt }}-signed-windows-x86_64-${{ needs.admission.outputs.version }}-${{ needs.admission.outputs.source_revision }}";
+  const macosSignedArtifact = "widgets-${{ github.run_id }}-${{ github.run_attempt }}-signed-macos-arm64-${{ needs.admission.outputs.version }}-${{ needs.admission.outputs.source_revision }}";
+  assert.equal((content.match(new RegExp(windowsSignedArtifact.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g")) ?? []).length, 2, "windows-sign upload + installed-qualification/publish download must share one artifact name");
+  assert.ok(content.includes(macosSignedArtifact), "publish must download the exact macOS artifact macos-sign uploaded");
+  assert.doesNotMatch(content, /run: (?:pnpm|npm|yarn) run undefined\b/);
+  assert.doesNotMatch(content, /\$\{\{\s*github\.output\s*\}\}/);
+});
+
+// Part E regression guard: every `run: <pm> run <script>` line in a
+// rendered full release-chain workflow must name a script the manifest
+// actually declares. This is the general form of the `pnpm run undefined`
+// class of bug — it would also catch a typo'd or stale script reference
+// even when it resolves to a real (but wrong) string, which the fail-closed
+// undefined/null check in buildRenderContext cannot.
+test("every 'run <script>' in a full release-chain workflow names a script the manifest declares", () => {
+  const manifest = {
+    ...FULL_MANIFEST,
+    lanes: ["ci", "release-candidate"],
+    profile: "rust-hybrid",
+    gate: { path: "scripts/gate.sh" },
+    candidate: {
+      buildScript: "ci:candidate",
+      checkScript: "ci:candidate-check",
+      admissionScript: "release:admit",
+      stageSummaryScript: "release:stage-summary",
+      artifactRoot: "widgets-unsigned",
+      os: ["windows-2025", "macos-15"],
+      signWindows: true,
+      signMacos: true,
+      releaseChain: {
+        evidenceVerificationScript: "release:verify-evidence",
+        windowsFinalizeScript: "release:finalize:win",
+        macosFinalizeScript: "release:finalize:mac",
+        installedQualificationScript: "release:qualify:installed",
+        publishScript: "release:publish:qualified",
+        qualificationRunnerVariable: "QUALIFICATION_RUNNER_LABEL",
+        publishSecrets: ["CLOUDFLARE_API_TOKEN"],
+      },
+    },
+    matrix: { os: ["ubuntu-24.04", "windows-2025", "macos-15"], node: ["22.23.2"] },
+    templateVersion: "1.4.0",
+  };
+  const content = renderTemplate(
+    fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
+    buildRenderContext(manifest, "/repos/widgets"),
+  );
+  const declaredScripts = new Set([
+    manifest.candidate.buildScript,
+    manifest.candidate.checkScript,
+    manifest.candidate.admissionScript,
+    manifest.candidate.stageSummaryScript,
+    manifest.candidate.releaseChain.evidenceVerificationScript,
+    manifest.candidate.releaseChain.windowsFinalizeScript,
+    manifest.candidate.releaseChain.macosFinalizeScript,
+    manifest.candidate.releaseChain.installedQualificationScript,
+    manifest.candidate.releaseChain.publishScript,
+  ]);
+  const runLines = content.match(/run: (?:pnpm|npm|yarn) run \S+/g) ?? [];
+  assert.ok(runLines.length > 0, "expected at least one package-script run line");
+  for (const line of runLines) {
+    const script = line.split(" run ").pop();
+    assert.ok(declaredScripts.has(script), `rendered step runs undeclared script: ${line}`);
+  }
+});
+
+// Downstream-consumer gap fix: the evidence verifier can only prove a stage
+// ran and succeeded if that stage produces a stage summary AND the publish
+// job actually downloads it. This test proves all four authoritative
+// stages (candidate, windows-sign, macos-sign, installed-qualification)
+// produce a summary, that installed-qualification wraps itself in
+// init/finalize like every other stage, that publish downloads the
+// complete same-run set into distinct subdirectories (no collisions
+// between candidate's two platform legs), and that evidence is bound to
+// this exact run (not merely version+source_revision) via RIGHT_GIT_RUN_ID/
+// RIGHT_GIT_RUN_ATTEMPT on both the verification and publish steps.
+test("release chain: installed-qualification has a stage summary and publish downloads the complete same-run evidence set", () => {
+  const manifest = {
+    ...FULL_MANIFEST,
+    lanes: ["ci", "release-candidate"],
+    profile: "rust-hybrid",
+    gate: { path: "scripts/gate.sh" },
+    candidate: {
+      buildScript: "ci:candidate",
+      checkScript: "ci:candidate-check",
+      admissionScript: "release:admit",
+      stageSummaryScript: "release:stage-summary",
+      artifactRoot: "widgets-unsigned",
+      os: ["windows-2025", "macos-15"],
+      signWindows: true,
+      signMacos: true,
+      releaseChain: {
+        evidenceVerificationScript: "release:verify-evidence",
+        windowsFinalizeScript: "release:finalize:win",
+        macosFinalizeScript: "release:finalize:mac",
+        installedQualificationScript: "release:qualify:installed",
+        publishScript: "release:publish:qualified",
+        qualificationRunnerVariable: "QUALIFICATION_RUNNER_LABEL",
+        publishSecrets: ["CLOUDFLARE_API_TOKEN"],
+      },
+    },
+    matrix: { os: ["ubuntu-24.04", "windows-2025", "macos-15"], node: ["22.23.2"] },
+    templateVersion: "1.4.0",
+  };
+  const content = renderTemplate(
+    fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
+    buildRenderContext(manifest, "/repos/widgets"),
+  );
+  const installedQualificationJob = content.slice(
+    content.search(/^ {2}installed-qualification:\n {4}needs:/m),
+    content.search(/^ {2}publish:\n {4}needs:/m),
+  );
+
+  // Point 1: installed-qualification wraps itself in stage-summary
+  // init/finalize like candidate/windows-sign/macos-sign, with the correct
+  // authoritative stage identifier, and finalize runs unconditionally.
+  assert.match(installedQualificationJob, /name: Initialize installed-qualification stage summary\n\s+run: pnpm run release:stage-summary\n\s+env:\n\s+RIGHT_GIT_STAGE_ACTION: init/);
+  assert.match(installedQualificationJob, /RIGHT_GIT_STAGE: installed-qualification/);
+  assert.match(installedQualificationJob, /name: Finalize installed-qualification stage summary\n\s+if: \$\{\{ always\(\) \}\}\n\s+run: pnpm run release:stage-summary\n\s+env:\n\s+RIGHT_GIT_STAGE_ACTION: finalize/);
+  assert.equal((installedQualificationJob.match(/RIGHT_GIT_STAGE: installed-qualification/g) ?? []).length, 2, "both init and finalize must carry the installed-qualification stage id");
+  assert.match(installedQualificationJob, /name: Upload installed-qualification stage summary\n\s+if: \$\{\{ always\(\) \}\}/);
+
+  const publishJob = content.slice(content.search(/^ {2}publish:\n {4}needs:/m));
+
+  // Point 2: publish downloads the complete same-run evidence set — both
+  // candidate legs (windows + macos) in distinct subdirectories, plus
+  // windows-sign, macos-sign, and installed-qualification summaries.
+  assert.match(publishJob, /Download same-run candidate \(Windows\) stage summary[\s\S]*?path: \$\{\{ runner\.temp \}\}\/right-git-release\/stage-summaries\/candidate-windows/);
+  assert.match(publishJob, /Download same-run candidate \(macOS\) stage summary[\s\S]*?path: \$\{\{ runner\.temp \}\}\/right-git-release\/stage-summaries\/candidate-macos/);
+  assert.match(publishJob, /Download same-run Windows signing stage summary[\s\S]*?path: \$\{\{ runner\.temp \}\}\/right-git-release\/stage-summaries\/windows-sign/);
+  assert.match(publishJob, /Download same-run macOS signing stage summary[\s\S]*?path: \$\{\{ runner\.temp \}\}\/right-git-release\/stage-summaries\/macos-sign/);
+  assert.match(publishJob, /Download same-run installed-qualification stage summary[\s\S]*?path: \$\{\{ runner\.temp \}\}\/right-git-release\/stage-summaries\/installed-qualification/);
+  // Distinct subdirectories: no two downloads share a path.
+  const downloadPaths = [...publishJob.matchAll(/path: (\$\{\{ runner\.temp \}\}\/right-git-release\/stage-summaries\/\S+)/g)].map((m) => m[1]);
+  assert.equal(downloadPaths.length, 5);
+  assert.equal(new Set(downloadPaths).size, 5, "every stage-summary download must use a distinct subdirectory");
+
+  // Point 3: both the evidence-verification step and the publish step carry
+  // the full run-identity contract (RIGHT_GIT_STAGE_SUMMARY_ROOT, run id,
+  // run attempt) alongside version/source_revision — evidence is bound to
+  // THIS run, not merely reusable across runs of the same version+SHA.
+  const verifyStep = publishJob.slice(publishJob.indexOf("Verify aggregated release evidence"), publishJob.indexOf("Publish qualified signed release"));
+  assert.match(verifyStep, /RIGHT_GIT_STAGE_SUMMARY_ROOT: \$\{\{ runner\.temp \}\}\/right-git-release\/stage-summaries/);
+  assert.match(verifyStep, /RIGHT_GIT_RUN_ID: \$\{\{ github\.run_id \}\}/);
+  assert.match(verifyStep, /RIGHT_GIT_RUN_ATTEMPT: \$\{\{ github\.run_attempt \}\}/);
+  const publishStep = publishJob.slice(publishJob.indexOf("Publish qualified signed release"));
+  assert.match(publishStep, /RIGHT_GIT_STAGE_SUMMARY_ROOT: \$\{\{ runner\.temp \}\}\/right-git-release\/stage-summaries/);
+  assert.match(publishStep, /RIGHT_GIT_RUN_ID: \$\{\{ github\.run_id \}\}/);
+  assert.match(publishStep, /RIGHT_GIT_RUN_ATTEMPT: \$\{\{ github\.run_attempt \}\}/);
+
+  assert.doesNotMatch(content, /run: (?:pnpm|npm|yarn) run undefined\b/);
+  assert.doesNotMatch(content, /\$\{\{\s*github\.output\s*\}\}/);
 });
 
 test("render determinism: same manifest renders byte-identical output every time", () => {
@@ -406,3 +651,172 @@ test("renderTemplate normalizes an empty final release-chain fragment to one new
   assert.equal(out, "jobs:\n");
   assert.equal((out.match(/\n/g) ?? []).length, 1);
 });
+
+// Tag-last has no tag to check out, so every stage checks out one exact admitted
+// commit SHA and HEAD is always detached. @rightkit/release only exempts a
+// detached HEAD when it can prove the commit is reachable from the dispatched
+// remote branch — and proving reachability needs history plus the
+// remote-tracking ref. A default shallow checkout has neither, so the signing,
+// qualification, and publish jobs would be refused. Every job that checks out an
+// admitted revision must therefore ask for full history.
+test("every job checking out an admitted revision fetches full history", () => {
+  const manifest = {
+    ...FULL_MANIFEST,
+    lanes: ["ci", "release-candidate"],
+    profile: "rust-hybrid",
+    gate: { path: "scripts/gate.sh" },
+    candidate: {
+      buildScript: "ci:candidate",
+      checkScript: "ci:candidate-check",
+      admissionScript: "release:admission",
+      stageSummaryScript: "release:stage-summary",
+      artifactRoot: "widgets-unsigned",
+      os: ["windows-2025", "macos-15"],
+      signWindows: true,
+      signMacos: true,
+      releaseChain: {
+        evidenceVerificationScript: "release:verify:evidence",
+        windowsFinalizeScript: "release:finalize:win",
+        macosFinalizeScript: "release:finalize:mac",
+        installedQualificationScript: "release:qualify:installed",
+        publishScript: "release:publish:qualified",
+        qualificationRunnerVariable: "QUALIFICATION_RUNNER_LABEL",
+        publishSecrets: ["CLOUDFLARE_API_TOKEN"],
+      },
+    },
+    matrix: { os: ["ubuntu-24.04", "windows-2025", "macos-15"], node: ["22.23.2"] },
+    templateVersion: "1.9.0",
+  };
+  const content = renderTemplate(
+    fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
+    buildRenderContext(manifest, "/repos/widgets"),
+  );
+  const checkouts = content
+    .split(/^ {6}- uses: actions\/checkout@/m)
+    .slice(1)
+    .map((step) => step.split(/^ {6}- /m)[0]);
+  assert.ok(checkouts.length >= 6, `expected every stage to check out; found ${checkouts.length}`);
+  for (const step of checkouts) {
+    if (!/ref: \$\{\{ (needs\.admission\.outputs\.source_revision|inputs\.source_revision) \}\}/.test(step)) continue;
+    assert.match(step, /fetch-depth: 0/, `a checkout of an admitted revision must fetch full history:\n${step}`);
+  }
+  // The four downstream stages specifically — these were the ones shipping shallow.
+  for (const job of ["windows-sign", "macos-sign", "installed-qualification", "publish"]) {
+    const body = content.split(new RegExp(`^  ${job}:$`, "m"))[1] ?? "";
+    const checkout = body.split(/^ {6}- uses: actions\/checkout@/m)[1]?.split(/^ {6}- /m)[0] ?? "";
+    assert.match(checkout, /fetch-depth: 0/, `${job} must check out with full history`);
+  }
+});
+
+// Rule 3 (release workflows have a dry run): a boolean dry_run input, runnable
+// from a branch, must thread through admission so packaging/signing/qualification
+// run while publication is skipped and artifacts carry a dry-run suffix.
+test("release-candidate template exposes a dry_run input threaded through admission", () => {
+  const manifest = {
+    ...FULL_MANIFEST,
+    lanes: ["ci", "release-candidate"],
+    profile: "rust-hybrid",
+    gate: { path: "scripts/gate.sh" },
+    candidate: {
+      buildScript: "ci:candidate",
+      checkScript: "ci:candidate-check",
+      admissionScript: "release:admission",
+      stageSummaryScript: "release:stage-summary",
+      artifactRoot: "widgets-unsigned",
+      os: ["windows-2025", "macos-15"],
+      signWindows: true,
+      signMacos: true,
+    },
+    matrix: { os: ["ubuntu-24.04", "windows-2025", "macos-15"], node: ["22.23.2"] },
+    templateVersion: "1.9.0",
+  };
+  const content = renderTemplate(
+    fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
+    buildRenderContext(manifest, "/repos/widgets"),
+  );
+  assert.match(content, /^      dry_run:\n        description: .*\n        required: false\n        type: boolean\n        default: false$/m);
+  assert.match(content, /dry_run: \$\{\{ steps\.admit\.outputs\.dry_run \}\}/);
+  assert.match(content, /artifact_suffix: \$\{\{ steps\.admit\.outputs\.artifact_suffix \}\}/);
+  assert.match(content, /RIGHT_GIT_DRY_RUN: \$\{\{ inputs\.dry_run \}\}/);
+  // The envelope only pins refs/heads/main and first-attempt for a real dispatch.
+  assert.match(content, /if \[\[ "\$\{\{ inputs\.dry_run \}\}" == "true" \]\]; then\n            \[\[ "\$GITHUB_REF" == refs\/heads\/\* \]\]/);
+});
+
+// Correction 11: Windows signing, macOS signing, installed qualification and
+// publication all shared one `release` environment, so no signing/publication
+// grant separation existed. The split is opt-in per product because the secrets
+// live in the existing environment until an operator moves them.
+function environmentManifest(environments) {
+  const manifest = {
+    schemaVersion: 1,
+    compile: "github-actions-only",
+    lanes: ["ci", "release-candidate"],
+    packageManager: "pnpm@11.24.0",
+    profile: "rust-hybrid",
+    gate: { path: "scripts/gate.sh" },
+    candidate: {
+      buildScript: "ci:candidate",
+      checkScript: "ci:candidate-check",
+      admissionScript: "release:admit",
+      stageSummaryScript: "release:stage-summary",
+      artifactRoot: "widgets-unsigned",
+      os: ["windows-2025", "macos-15"],
+      targets: [
+        { os: "windows-2025", platform: "windows", architecture: "x86_64" },
+        { os: "macos-15", platform: "macos", architecture: "arm64" },
+      ],
+      signWindows: true,
+      signMacos: true,
+      releaseChain: {
+        windowsFinalizeScript: "release:finalize-windows",
+        macosFinalizeScript: "release:finalize-macos",
+        installedQualificationScript: "release:qualify-installed",
+        publishScript: "release:publish-qualified",
+        qualificationRunnerVariable: "WIDGETS_QUALIFICATION_RUNNER",
+      },
+    },
+    matrix: { os: ["ubuntu-24.04", "windows-2025"], node: ["22.23.2"] },
+    templateVersion: "1.8.0",
+  };
+  if (environments) manifest.candidate.releaseChain.environments = environments;
+  return manifest;
+}
+
+function renderRelease(manifest) {
+  return renderTemplate(
+    fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
+    buildRenderContext(manifest, "/repos/widgets"),
+  );
+}
+
+test("release environments default to the single release environment", () => {
+  const content = renderRelease(environmentManifest(null));
+  assert.ok((content.match(/environment: release$/gm) ?? []).length >= 2);
+  assert.doesNotMatch(content, /environment: signing-authorized/);
+});
+
+test("signing and publication split into distinct protected environments", () => {
+  const content = renderRelease(environmentManifest({
+    signing: "signing-authorized",
+    publication: "release-authorized",
+    qualification: "qualification",
+  }));
+  assert.equal((content.match(/environment: signing-authorized$/gm) ?? []).length, 2);
+  assert.equal((content.match(/environment: release-authorized$/gm) ?? []).length, 1);
+  // A job that may sign must never also be the job that publishes.
+  assert.doesNotMatch(content, /environment: release$/m);
+});
+
+test("an unsafe or unknown release environment is rejected", () => {
+  assert.equal(validateManifest(environmentManifest({ signing: "bad name!" })).valid, false);
+  assert.equal(validateManifest(environmentManifest({ promotion: "x" })).valid, false);
+});
+
+test("ci.yml ownership check cannot be removed by deleting optional repo metadata", () => {
+  const manifest = { ...structuredClone(FULL_MANIFEST), ownership: { roots: [".", "engine"] } };
+  const template = fs.readFileSync(path.join(templatesDir, "ci.yml"), "utf8");
+  const withStep = renderTemplate(template, buildRenderContext(manifest, "/repos/coderight"));
+  assert.match(withStep, /RightKit ownership \(protected registry roots\)/);
+  const without = renderTemplate(template, buildRenderContext(structuredClone(FULL_MANIFEST), "/repos/widgets"));
+  assert.match(without, /RightKit ownership \(protected registry roots\)/);
+});

package/sync.test.mjs

@@ -67,11 +67,14 @@ test("sync rejects a Membrane-like release chain without root @rightkit/release"
     candidate: {
       buildScript: "release:candidate:build",
       checkScript: "release:candidate:check",
+      admissionScript: "release:admit",
+      stageSummaryScript: "release:stage-summary",
       artifactRoot: "membrane-release-candidate",
       os: ["windows-2025", "macos-15"],
       signWindows: true,
       signMacos: true,
       releaseChain: {
+        evidenceVerificationScript: "release:verify-evidence",
         windowsFinalizeScript: "release:finalize:windows",
         macosFinalizeScript: "release:finalize:macos",
         installedQualificationScript: "release:qualify:installed",

package/templates/ci.yml

@@ -47,4 +47,4 @@ ${PACKAGE_MANAGER_SETUP}
       - run: ${PM_RUN} test:random
       - run: ${PM_RUN} test:all
       - run: node scripts/ci/check-generated.mjs
-      - run: node scripts/ci/check-network-boundary.mjs
+      - run: node scripts/ci/check-network-boundary.mjs${OWNERSHIP_STEP}

package/templates/package-smoke.yml

@@ -34,4 +34,5 @@ jobs:
           package-manager-cache: false
 ${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
+${OWNERSHIP_STEP}
       - run: node scripts/test-package.mjs

package/templates/profiles/rust-hybrid/ci.yml

@@ -64,6 +64,8 @@ jobs:
           node-version: ${{ matrix.node }}
           package-manager-cache: false
 ${PACKAGE_MANAGER_SETUP}
+      - run: ${INSTALL_COMMAND}
+${OWNERSHIP_STEP}
       - uses: dtolnay/rust-toolchain@f8be11a05b1d4f3fcebe6410cc16743212b999b0
         if: steps.rust-changes.outputs.required == 'true'
         with: