@rightkit/git 0.2.24 → 0.2.25

package/manifest.mjs

@@ -60,6 +60,7 @@ const TOP_LEVEL_KEYS = new Set([
   "gate",
   "rustCache",
   "candidate",
+  "ownership",
 ]);
 const GATE_PATH_RE = /^(?!.*\.\.)(?!.*\s)[A-Za-z0-9][A-Za-z0-9._/-]*$/;
 const RUST_WORKSPACE_PATH_RE = /^(?:\.|(?!.*\.\.)(?!.*\s)[A-Za-z0-9][A-Za-z0-9._/-]*)$/;
@@ -264,7 +265,7 @@ export function validateManifest(manifest) {
         // above) — the full signed release chain adds evidenceVerificationScript
         // (runs before publish, verifying aggregated same-run evidence) plus the
         // finalize/qualify/publish scripts.
-        const allowedChainKeys = ["evidenceVerificationScript", "windowsFinalizeScript", "macosFinalizeScript", "installedQualificationScript", "publishScript", "qualificationRunnerVariable", "publishSecrets"];
+        const allowedChainKeys = ["evidenceVerificationScript", "windowsFinalizeScript", "macosFinalizeScript", "installedQualificationScript", "publishScript", "qualificationRunnerVariable", "publishSecrets", "environments"];
         if (chain === null || typeof chain !== "object" || Array.isArray(chain)) {
           errors.push("candidate.releaseChain must be an object");
         } else {
@@ -277,6 +278,19 @@ export function validateManifest(manifest) {
             }
           }
           if (chain.macosFinalizeScript !== undefined && (typeof chain.macosFinalizeScript !== "string" || !PACKAGE_SCRIPT_RE.test(chain.macosFinalizeScript))) {
+          if (chain.environments !== undefined) {
+            const environments = chain.environments;
+            if (environments === null || typeof environments !== "object" || Array.isArray(environments)) {
+              errors.push("candidate.releaseChain.environments must be an object");
+            } else {
+              for (const key of Object.keys(environments)) {
+                if (!["signing", "qualification", "publication"].includes(key)) errors.push(`unknown candidate.releaseChain.environments field: ${key}`);
+                else if (typeof environments[key] !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$/.test(environments[key])) {
+                  errors.push(`candidate.releaseChain.environments.${key} must be one safe GitHub environment name`);
+                }
+              }
+            }
+          }
             errors.push("candidate.releaseChain.macosFinalizeScript must be one safe package script name");
           }
           if (typeof chain.qualificationRunnerVariable !== "string" || !GITHUB_VARIABLE_RE.test(chain.qualificationRunnerVariable)) {
@@ -298,6 +312,18 @@ export function validateManifest(manifest) {
   if (profile === "rust-hybrid" && lanes.includes("release-candidate") && candidate === undefined) {
     errors.push("rust-hybrid release-candidate lane requires candidate { buildScript, checkScript, artifactRoot }");
   }
+
+  if (manifest.ownership !== undefined) {
+    if (!manifest.ownership || typeof manifest.ownership !== "object" || Array.isArray(manifest.ownership)
+      || Object.keys(manifest.ownership).some((key) => key !== "roots")) {
+      errors.push("ownership must be an object containing only roots");
+    } else if (!Array.isArray(manifest.ownership.roots) || manifest.ownership.roots.length === 0
+      || manifest.ownership.roots.some((root) => typeof root !== "string" || (root !== "." && !/^(?!.*\.\.)(?!.*\\)(?!.*\s)[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(root)) || root.startsWith("/"))) {
+      errors.push("ownership.roots must contain safe, non-empty repository-relative paths");
+    } else if (new Set(manifest.ownership.roots).size !== manifest.ownership.roots.length) {
+      errors.push("ownership.roots must not contain duplicates");
+    }
+  }
   if (profile !== "rust-hybrid" && candidate !== undefined) {
     errors.push("candidate is only valid for profile 'rust-hybrid'");
   }
@@ -464,6 +490,15 @@ const ARTIFACT_SIGNING_CLIENT_SHA256 = "74BD7D27E6CE1051409C38D9B46BC8DF0400ECD6
 const WINDOWS_SDK_BUILD_TOOLS_VERSION = "10.0.26100.4188";
 const WINDOWS_SDK_BUILD_TOOLS_SHA256 = "180DEB372659029864C10A0C04787833234D64AACD1D2C0661D2C00295D8E022";
 
+// Signing and publication credentials must be reachable behind distinct
+// protected environments, so a job that may sign cannot also publish. Products
+// opt in per environment; absent configuration keeps the single `release`
+// environment they use today, so enabling the split cannot strand secrets.
+function releaseEnvironment(manifest, role) {
+	const configured = manifest?.candidate?.releaseChain?.environments?.[role];
+	return typeof configured === "string" && configured.length > 0 ? configured : "release";
+}
+
 function windowsSigningJob(manifest, pm, artifactPrefix) {
   if (manifest.candidate?.signWindows !== true) return "";
   const nodeVersion = String(manifest.matrix.node[0]);
@@ -484,7 +519,7 @@ function windowsSigningJob(manifest, pm, artifactPrefix) {
   windows-sign:
     needs: [admission, candidate]
     if: \${{ needs.admission.outputs.signed_qualification == 'true' }}
-    environment: release
+    environment: ${releaseEnvironment(manifest, "signing")}
     strategy:
       fail-fast: false
       matrix:
@@ -497,6 +532,7 @@ ${signingMatrix(manifest, "windows")}
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: \${{ needs.admission.outputs.source_revision }}
+          fetch-depth: 0
           persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -612,7 +648,7 @@ function macosSigningJob(manifest, pm, artifactPrefix) {
   macos-sign:
     needs: [admission, candidate]
     if: \${{ needs.admission.outputs.signed_qualification == 'true' }}
-    environment: release
+    environment: ${releaseEnvironment(manifest, "signing")}
     strategy:
       fail-fast: false
       matrix:
@@ -624,6 +660,7 @@ ${signingMatrix(manifest, "macos")}
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: \${{ needs.admission.outputs.source_revision }}
+          fetch-depth: 0
           persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -789,12 +826,13 @@ function releaseChainJobs(manifest, pm, artifactPrefix) {
   installed-qualification:
     needs: [admission, candidate, windows-sign]
     if: \${{ always() && needs.admission.outputs.signed_qualification == 'true' && needs.candidate.result == 'success' }}
-    environment: release
+    environment: ${releaseEnvironment(manifest, "qualification")}
     runs-on: \${{ vars.${chain.qualificationRunnerVariable} || '${windowsRunner}' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: \${{ needs.admission.outputs.source_revision }}
+          fetch-depth: 0
           persist-credentials: false
       - name: Fail closed when protected finalization is absent
         if: \${{ needs.windows-sign.result != 'success' }}
@@ -862,7 +900,7 @@ ${runIdentityEnv}
   publish:
     needs: [admission, installed-qualification${macosDependency}]
     if: \${{ needs.admission.outputs.publish == 'true' && needs.installed-qualification.result == 'success'${macosSuccess} }}
-    environment: release
+    environment: ${releaseEnvironment(manifest, "publication")}
     runs-on: \${{ vars.${chain.qualificationRunnerVariable} || '${windowsRunner}' }}
     permissions:
       contents: write
@@ -870,6 +908,7 @@ ${runIdentityEnv}
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: \${{ needs.admission.outputs.source_revision }}
+          fetch-depth: 0
           persist-credentials: false
       - name: Download same-run finalized Windows release
         uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
@@ -950,6 +989,15 @@ export function deriveProjectName(repoPath) {
  * Build the flat placeholder -> value map used by render.mjs, from a
  * validated manifest plus the target repo's derived project name.
  */
+/** Every managed public workflow runs ownership scanning; repository metadata cannot opt it out. */
+export function ownershipStep(manifest) {
+  const { name } = parsePackageManager(manifest.packageManager);
+  const command = name === "pnpm" ? "pnpm exec right-release ownership --app ."
+    : name === "npm" ? "npm exec -- right-release ownership --app ."
+      : "yarn exec right-release ownership --app .";
+  return `\n      - name: RightKit ownership (protected registry roots)\n        shell: bash\n        run: test "$(git rev-parse HEAD)" = "\${{ github.event_name == 'workflow_dispatch' && inputs.source_revision || github.sha }}" && ${command}`;
+}
+
 export function buildRenderContext(manifest, repoPath) {
   const pm = parsePackageManager(manifest.packageManager);
   const projectName = deriveProjectName(repoPath);
@@ -976,6 +1024,7 @@ export function buildRenderContext(manifest, repoPath) {
     WINDOWS_SIGNING_JOB: windowsSigningJob(manifest, pm, artifactPrefix),
     MACOS_SIGNING_JOB: macosSigningJob(manifest, pm, artifactPrefix),
     RELEASE_CHAIN_JOBS: releaseChainJobs(manifest, pm, artifactPrefix),
+    OWNERSHIP_STEP: ownershipStep(manifest),
   };
 
   // Every key below is populated ONLY when its source manifest section is

package/manifest.schema.json

@@ -84,6 +84,19 @@
       "type": "string",
       "pattern": "^\\d+\\.\\d+\\.\\d+$"
     }
+    ,"ownership": {
+      "type": "object",
+      "required": ["roots"],
+      "additionalProperties": false,
+      "properties": {
+        "roots": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": { "type": "string", "pattern": "^(?:\\.|(?!.*\\.\\.)(?!.*\\\\)(?!.*\\s)[A-Za-z0-9][A-Za-z0-9._/-]*)$" }
+        }
+      }
+    }
     ,"profile": { "enum": ["node", "rust-hybrid"] },
     "rustCache": {
       "type": "object",

package/manifest.test.mjs

@@ -22,6 +22,13 @@ test("accepts a minimal valid manifest", () => {
   assert.deepEqual(errors, []);
 });
 
+test("ownership scan registration is explicit and supports nested package roots", () => {
+  assert.equal(validateManifest({ ...VALID_MINIMAL, ownership: { roots: ["engine", "apps/client"] } }).valid, true);
+  for (const roots of [[], ["../outside"], ["src\\escape"], [""], ["engine", "engine"]]) {
+    assert.equal(validateManifest({ ...VALID_MINIMAL, ownership: { roots } }).valid, false, JSON.stringify(roots));
+  }
+});
+
 test("rust-hybrid supports ci plus a configured unsigned release-candidate lane", () => {
   const valid = { ...VALID_MINIMAL, profile: "rust-hybrid", gate: { path: "scripts/gate.sh" } };
   assert.equal(validateManifest(valid).valid, true);

package/ownership-registration.mjs

@@ -0,0 +1,33 @@
+import path from "node:path";
+
+/** Normalize HTTPS, SSH, and SCP GitHub remotes to one immutable repository key. */
+export function normalizeRepositoryIdentity(value) {
+  if (typeof value !== "string" || !value.trim()) throw new Error("ownership registration requires a repository identity");
+  let text = value.trim();
+  const scp = text.match(/^(?:[^@/]+@)?([^:]+):([^/]+\/[^/]+)$/);
+  if (scp) text = `https://${scp[1]}/${scp[2]}`;
+  let url;
+  try { url = new URL(text); } catch { throw new Error("ownership repository identity must be a Git remote URL"); }
+  if (!["https:", "ssh:"].includes(url.protocol) || (url.username && !(url.protocol === "ssh:" && url.username === "git")) || url.password || url.search || url.hash) throw new Error("unsupported or credential-bearing ownership repository identity");
+  const host = url.hostname.toLowerCase();
+  const parts = url.pathname.replace(/\.git$/i, "").split("/").filter(Boolean);
+  if (host !== "github.com" || parts.length !== 2 || parts.some((part) => !/^[A-Za-z0-9_.-]+$/.test(part))) throw new Error("ownership repository identity must be owner/repository on github.com");
+  return `https://${host}/${parts[0].toLowerCase()}/${parts[1].toLowerCase()}`;
+}
+
+/** Resolve immutable OS-owned roots for one checkout; repo declarations can only narrow reporting, never authority. */
+export function protectedOwnershipRoots(trust, { repositoryIdentity, scanRoot, repoRoot }) {
+  if (!trust || !Array.isArray(trust.repositories)) throw new Error("protected ownership repository registry is missing");
+  const wanted = normalizeRepositoryIdentity(repositoryIdentity);
+  const matches = trust.repositories.filter((entry) => normalizeRepositoryIdentity(entry.repositoryIdentity) === wanted);
+  if (matches.length !== 1) throw new Error(matches.length ? "protected ownership registry has duplicate repository identities" : `repository is not registered for ownership enforcement: ${wanted}`);
+  const entry = matches[0];
+  if (!["public", "private"].includes(entry.visibility) || !Array.isArray(entry.roots) || !entry.roots.length) throw new Error("protected ownership registration is malformed");
+  const roots = entry.roots.map((root) => {
+    if (typeof root !== "string" || !root || root.includes("\\") || root.startsWith("/") || (root !== "." && root.split("/").some((p) => !p || p === "." || p === "..")) || /[*?]/.test(root)) throw new Error("protected ownership roots must be exact relative paths");
+    return root;
+  });
+  const relative = path.relative(repoRoot, scanRoot).replaceAll("\\", "/") || ".";
+  if (!roots.includes(relative)) throw new Error(`scan root is not registered for ${wanted}: ${relative}`);
+  return { repositoryIdentity: wanted, visibility: entry.visibility, roots };
+}

package/ownership-registration.test.mjs

@@ -0,0 +1,20 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { normalizeRepositoryIdentity, protectedOwnershipRoots } from "./ownership-registration.mjs";
+
+test("repository identity normalization collapses HTTPS, SSH, and SCP GitHub remotes", () => {
+  const expected = "https://github.com/bogusyogi/coderight";
+  for (const remote of ["https://github.com/bogusyogi/CodeRight.git", "ssh://git@github.com/bogusyogi/coderight.git", "git@github.com:bogusyogi/coderight.git"]) {
+    assert.equal(normalizeRepositoryIdentity(remote), expected);
+  }
+  assert.throws(() => normalizeRepositoryIdentity("https://user:secret@github.com/a/b.git"), /credential-bearing/);
+});
+
+test("protected registry is authoritative for exact nested roots and visibility", () => {
+  const trust = { repositories: [{ repositoryIdentity: "https://github.com/bogusyogi/coderight", roots: ["engine", "apps/ui"], visibility: "private" }] };
+  assert.deepEqual(protectedOwnershipRoots(trust, { repositoryIdentity: "git@github.com:bogusyogi/coderight.git", scanRoot: "C:/repo/engine", repoRoot: "C:/repo" }), {
+    repositoryIdentity: "https://github.com/bogusyogi/coderight", visibility: "private", roots: ["engine", "apps/ui"],
+  });
+  assert.throws(() => protectedOwnershipRoots(trust, { repositoryIdentity: "https://github.com/bogusyogi/coderight", scanRoot: "C:/repo/src", repoRoot: "C:/repo" }), /not registered/);
+  assert.throws(() => protectedOwnershipRoots({ repositories: [] }, { repositoryIdentity: "https://github.com/a/b", scanRoot: ".", repoRoot: "." }), /not registered/);
+});

package/pack-smoke.test.mjs

@@ -3,11 +3,11 @@
 // publish and runs the extracted bin with `node` — `node --test` run from
 // the source tree never notices a missing directory because the source
 // tree has every file regardless of what `files` declares. This test packs
-// for real (npm pack), extracts to a temp dir, and executes the built bin's
+// for real (pnpm pack), extracts to a temp dir, and executes the built bin's
 // --help and --version from inside that extracted tree only.
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
-import { mkdtempSync, rmSync } from "node:fs";
+import { mkdtempSync, readdirSync, rmSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -24,17 +24,17 @@ function run(command, args, options) {
 test("packaged tarball: right-git --help and --version run clean from the published files only", () => {
   const workDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-git-pack-"));
   try {
-    // shell:true — on Windows "npm" only resolves (to npm.cmd) through the
-    // shell; args here are fixed literals we construct, never user input.
-    const packResult = run("npm", ["pack", "--json", "--pack-destination", workDir], { cwd: packageRoot, shell: true });
-    assert.equal(packResult.status, 0, `npm pack failed: ${packResult.stderr}`);
-    const [packInfo] = JSON.parse(packResult.stdout);
+    // shell:true resolves pnpm.cmd on Windows; args are fixed literals.
+    const packResult = run("pnpm", ["pack", "--pack-destination", workDir], { cwd: packageRoot, shell: true });
+    assert.equal(packResult.status, 0, `pnpm pack failed: ${packResult.stderr}`);
+    const archive = readdirSync(workDir).find((name) => name.endsWith(".tgz"));
+    assert.ok(archive, `pnpm pack did not create a tarball: ${packResult.stdout}`);
 
     // Run tar FROM the temp dir on the bare filename so no absolute "C:\..."
     // path reaches tar — that colon is the only reason GNU tar's --force-local
     // was ever needed, and avoiding it keeps this portable to bsdtar (the
     // Windows built-in) and any CI host, not just a GNU-tar toolchain.
-    const extractResult = run("tar", ["-xzf", packInfo.filename], { cwd: workDir });
+    const extractResult = run("tar", ["-xzf", archive], { cwd: workDir });
     assert.equal(extractResult.status, 0, `tar extract failed: ${extractResult.stderr}`);
     // npm tarballs always nest content under a top-level "package/" directory.
     const extractedPackageDir = path.join(workDir, "package");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/git",
-  "version": "0.2.24",
+  "version": "0.2.25",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -15,9 +15,6 @@
     "*.json"
   ],
   "sideEffects": false,
-  "scripts": {
-    "test": "node --test *.test.mjs"
-  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
@@ -27,5 +24,7 @@
     "url": "git+https://github.com/bogusyogi/claude.git",
     "directory": "tools/rightkit/packages/git"
   },
-  "packageManager": "pnpm@11.24.0"
-}
+  "scripts": {
+    "test": "node --test *.test.mjs"
+  }
+}

package/render.test.mjs

@@ -4,7 +4,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { renderTemplate, MANAGED_MARKER } from "./render.mjs";
-import { buildRenderContext, LANE_FILENAMES, KNOWN_LANES } from "./manifest.mjs";
+import { buildRenderContext, LANE_FILENAMES, KNOWN_LANES, validateManifest } from "./manifest.mjs";
 
 const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)));
 const templatesDir = path.join(packageRoot, "templates");
@@ -73,6 +73,21 @@ test("rust-hybrid ci renders its pinned package manager and gate", () => {
   assert.doesNotMatch(content, /ubuntu-latest|macos-latest/);
 });
 
+test("every generated workflow profile runs ownership scanning independent of optional repository roots", () => {
+  const roots = ["engine", "apps/client"];
+  const manifest = { ...FULL_MANIFEST, ownership: { roots } };
+  const rendered = renderAllLanes(manifest, "C:/repos/coderight");
+  for (const [lane, content] of Object.entries(rendered)) {
+    assert.match(content, /right-release ownership --app \./, lane);
+    assert.match(content, /protected registry roots/, lane);
+  }
+  const rust = renderTemplate(fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/ci.yml"), "utf8"), buildRenderContext({ ...manifest, profile: "rust-hybrid", gate: { path: "scripts/gate.sh" } }, "C:/repos/coderight"));
+  assert.match(rust, /RightKit ownership \(protected registry roots\)/);
+  assert.match(rust, /pnpm exec right-release ownership --app \./);
+  const withoutRoots = renderAllLanes(FULL_MANIFEST, "C:/repos/widgets");
+  for (const [lane, content] of Object.entries(withoutRoots)) assert.match(content, /right-release ownership --app \./, lane);
+});
+
 test("ordinary CI templates cancel superseded runs on the same ref", () => {
   const generic = renderAllLanes(FULL_MANIFEST, "/repos/widgets").ci;
   assert.match(generic, /group: \$\{\{ github\.workflow \}\}-\$\{\{ github\.ref \}\}/);
@@ -196,8 +211,8 @@ test("rust-hybrid release candidate can opt into OIDC Windows signing without lo
   // Every downstream job (admission, candidate, and windows-sign here) checks
   // out the exact admitted revision by SHA, never by resolving HEAD after a
   // ref-triggered checkout.
-  assert.match(content, /windows-sign:[\s\S]*?ref: \$\{\{ needs\.admission\.outputs\.source_revision \}\}\n\s+persist-credentials: false/);
-  assert.doesNotMatch(content, /git rev-parse HEAD/);
+  assert.match(content, /windows-sign:[\s\S]*?ref: \$\{\{ needs\.admission\.outputs\.source_revision \}\}\n\s+fetch-depth: 0\n\s+persist-credentials: false/);
+  assert.match(content, /git rev-parse HEAD.*inputs\.source_revision \|\| github\.sha/);
   assert.ok(content.includes("LEGION_SOURCE_REVISION: ${{ env.RIGHT_GIT_SOURCE_REVISION }}"));
   assert.doesNotMatch(content, /LEGION_SOURCE_REVISION: \$\{\{ github\.sha \}\}/);
   assert.doesNotMatch(content, /secrets\.|client-secret|private.key/i);
@@ -235,8 +250,8 @@ test("rust-hybrid release candidate can opt into protected macOS signing & notar
   assert.match(content, /temporary keychain/i);
   assert.match(content, /right-release build --platform mac --skip-checks/);
   assert.match(content, /secrets\.APPLE_API_KEY_BASE64/);
-  assert.match(content, /macos-sign:[\s\S]*?ref: \$\{\{ needs\.admission\.outputs\.source_revision \}\}\n\s+persist-credentials: false/);
-  assert.doesNotMatch(content, /git rev-parse HEAD/);
+  assert.match(content, /macos-sign:[\s\S]*?ref: \$\{\{ needs\.admission\.outputs\.source_revision \}\}\n\s+fetch-depth: 0\n\s+persist-credentials: false/);
+  assert.match(content, /git rev-parse HEAD.*inputs\.source_revision \|\| github\.sha/);
   assert.ok(content.includes("LEGION_SOURCE_REVISION: ${{ env.RIGHT_GIT_SOURCE_REVISION }}"));
   assert.doesNotMatch(content, /LEGION_SOURCE_REVISION: \$\{\{ github\.sha \}\}/);
   assert.match(content, /security delete-keychain/);
@@ -355,18 +370,17 @@ test("rust-hybrid release chain preserves signed candidate, installed qualificat
   assert.match(content, /Verify aggregated release evidence[\s\S]*?pnpm run release:verify-evidence/);
   assert.match(content, /pnpm run release:publish:qualified/);
   assert.match(content, /CLOUDFLARE_API_TOKEN: \$\{\{ secrets\.CLOUDFLARE_API_TOKEN \}\}/);
-  // The old ref-triggered "resolve HEAD after checkout" trick is gone
-  // entirely for the releaseChain path — every job instead checks out the
-  // exact admitted SHA from the admission job's own output.
-  assert.doesNotMatch(content, /git rev-parse HEAD/);
+  // Ownership scan binds to the source revision input before admission emits
+  // that same revision for every downstream job.
+  assert.match(content, /git rev-parse HEAD.*inputs\.source_revision \|\| github\.sha/);
   assert.doesNotMatch(content, /RIGHT_GIT_SOURCE_REVISION: \$\{\{ github\.sha \}\}/);
-  // windows-sign, macos-sign, installed-qualification, publish all check out
-  // the admitted revision directly followed by persist-credentials: false;
-  // candidate does too but with a fetch-depth: 0 line between them (matched
-  // separately below), and admission checks out ${{ inputs.source_revision }}
-  // (it IS the admission job — there is no needs.admission yet).
-  assert.equal((content.match(/ref: \$\{\{ needs\.admission\.outputs\.source_revision \}\}\n\s+persist-credentials: false/g) ?? []).length, 4, "windows-sign, macos-sign, installed-qualification, publish should all pin the admitted revision");
-  assert.match(content, /ref: \$\{\{ needs\.admission\.outputs\.source_revision \}\}\n\s+fetch-depth: 0\n\s+persist-credentials: false/, "candidate must also pin the admitted revision");
+  // candidate, windows-sign, macos-sign, installed-qualification and publish all
+  // check out the admitted revision with full history; admission checks out
+  // ${{ inputs.source_revision }} (it IS the admission job — there is no
+  // needs.admission yet). Full history is load-bearing, not cosmetic: see
+  // "every job checking out an admitted revision fetches full history".
+  assert.equal((content.match(/ref: \$\{\{ needs\.admission\.outputs\.source_revision \}\}\n\s+fetch-depth: 0\n\s+persist-credentials: false/g) ?? []).length, 5, "candidate, windows-sign, macos-sign, installed-qualification & publish should all pin the admitted revision with full history");
+  assert.doesNotMatch(content, /ref: \$\{\{ needs\.admission\.outputs\.source_revision \}\}\n\s+persist-credentials: false/, "no admitted-revision checkout may be shallow");
   assert.match(content, /ref: \$\{\{ inputs\.source_revision \}\}\n\s+fetch-depth: 0\n\s+persist-credentials: false/, "admission must check out the exact dispatch-supplied revision");
   assert.doesNotMatch(content.slice(0, content.indexOf("  windows-sign:")), /secrets\.|id-token: write|contents: write/);
   // Downstream download-artifact names must match exactly what windows-sign/
@@ -637,3 +651,172 @@ test("renderTemplate normalizes an empty final release-chain fragment to one new
   assert.equal(out, "jobs:\n");
   assert.equal((out.match(/\n/g) ?? []).length, 1);
 });
+
+// Tag-last has no tag to check out, so every stage checks out one exact admitted
+// commit SHA and HEAD is always detached. @rightkit/release only exempts a
+// detached HEAD when it can prove the commit is reachable from the dispatched
+// remote branch — and proving reachability needs history plus the
+// remote-tracking ref. A default shallow checkout has neither, so the signing,
+// qualification, and publish jobs would be refused. Every job that checks out an
+// admitted revision must therefore ask for full history.
+test("every job checking out an admitted revision fetches full history", () => {
+  const manifest = {
+    ...FULL_MANIFEST,
+    lanes: ["ci", "release-candidate"],
+    profile: "rust-hybrid",
+    gate: { path: "scripts/gate.sh" },
+    candidate: {
+      buildScript: "ci:candidate",
+      checkScript: "ci:candidate-check",
+      admissionScript: "release:admission",
+      stageSummaryScript: "release:stage-summary",
+      artifactRoot: "widgets-unsigned",
+      os: ["windows-2025", "macos-15"],
+      signWindows: true,
+      signMacos: true,
+      releaseChain: {
+        evidenceVerificationScript: "release:verify:evidence",
+        windowsFinalizeScript: "release:finalize:win",
+        macosFinalizeScript: "release:finalize:mac",
+        installedQualificationScript: "release:qualify:installed",
+        publishScript: "release:publish:qualified",
+        qualificationRunnerVariable: "QUALIFICATION_RUNNER_LABEL",
+        publishSecrets: ["CLOUDFLARE_API_TOKEN"],
+      },
+    },
+    matrix: { os: ["ubuntu-24.04", "windows-2025", "macos-15"], node: ["22.23.2"] },
+    templateVersion: "1.9.0",
+  };
+  const content = renderTemplate(
+    fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
+    buildRenderContext(manifest, "/repos/widgets"),
+  );
+  const checkouts = content
+    .split(/^ {6}- uses: actions\/checkout@/m)
+    .slice(1)
+    .map((step) => step.split(/^ {6}- /m)[0]);
+  assert.ok(checkouts.length >= 6, `expected every stage to check out; found ${checkouts.length}`);
+  for (const step of checkouts) {
+    if (!/ref: \$\{\{ (needs\.admission\.outputs\.source_revision|inputs\.source_revision) \}\}/.test(step)) continue;
+    assert.match(step, /fetch-depth: 0/, `a checkout of an admitted revision must fetch full history:\n${step}`);
+  }
+  // The four downstream stages specifically — these were the ones shipping shallow.
+  for (const job of ["windows-sign", "macos-sign", "installed-qualification", "publish"]) {
+    const body = content.split(new RegExp(`^  ${job}:$`, "m"))[1] ?? "";
+    const checkout = body.split(/^ {6}- uses: actions\/checkout@/m)[1]?.split(/^ {6}- /m)[0] ?? "";
+    assert.match(checkout, /fetch-depth: 0/, `${job} must check out with full history`);
+  }
+});
+
+// Rule 3 (release workflows have a dry run): a boolean dry_run input, runnable
+// from a branch, must thread through admission so packaging/signing/qualification
+// run while publication is skipped and artifacts carry a dry-run suffix.
+test("release-candidate template exposes a dry_run input threaded through admission", () => {
+  const manifest = {
+    ...FULL_MANIFEST,
+    lanes: ["ci", "release-candidate"],
+    profile: "rust-hybrid",
+    gate: { path: "scripts/gate.sh" },
+    candidate: {
+      buildScript: "ci:candidate",
+      checkScript: "ci:candidate-check",
+      admissionScript: "release:admission",
+      stageSummaryScript: "release:stage-summary",
+      artifactRoot: "widgets-unsigned",
+      os: ["windows-2025", "macos-15"],
+      signWindows: true,
+      signMacos: true,
+    },
+    matrix: { os: ["ubuntu-24.04", "windows-2025", "macos-15"], node: ["22.23.2"] },
+    templateVersion: "1.9.0",
+  };
+  const content = renderTemplate(
+    fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
+    buildRenderContext(manifest, "/repos/widgets"),
+  );
+  assert.match(content, /^      dry_run:\n        description: .*\n        required: false\n        type: boolean\n        default: false$/m);
+  assert.match(content, /dry_run: \$\{\{ steps\.admit\.outputs\.dry_run \}\}/);
+  assert.match(content, /artifact_suffix: \$\{\{ steps\.admit\.outputs\.artifact_suffix \}\}/);
+  assert.match(content, /RIGHT_GIT_DRY_RUN: \$\{\{ inputs\.dry_run \}\}/);
+  // The envelope only pins refs/heads/main and first-attempt for a real dispatch.
+  assert.match(content, /if \[\[ "\$\{\{ inputs\.dry_run \}\}" == "true" \]\]; then\n            \[\[ "\$GITHUB_REF" == refs\/heads\/\* \]\]/);
+});
+
+// Correction 11: Windows signing, macOS signing, installed qualification and
+// publication all shared one `release` environment, so no signing/publication
+// grant separation existed. The split is opt-in per product because the secrets
+// live in the existing environment until an operator moves them.
+function environmentManifest(environments) {
+  const manifest = {
+    schemaVersion: 1,
+    compile: "github-actions-only",
+    lanes: ["ci", "release-candidate"],
+    packageManager: "pnpm@11.24.0",
+    profile: "rust-hybrid",
+    gate: { path: "scripts/gate.sh" },
+    candidate: {
+      buildScript: "ci:candidate",
+      checkScript: "ci:candidate-check",
+      admissionScript: "release:admit",
+      stageSummaryScript: "release:stage-summary",
+      artifactRoot: "widgets-unsigned",
+      os: ["windows-2025", "macos-15"],
+      targets: [
+        { os: "windows-2025", platform: "windows", architecture: "x86_64" },
+        { os: "macos-15", platform: "macos", architecture: "arm64" },
+      ],
+      signWindows: true,
+      signMacos: true,
+      releaseChain: {
+        windowsFinalizeScript: "release:finalize-windows",
+        macosFinalizeScript: "release:finalize-macos",
+        installedQualificationScript: "release:qualify-installed",
+        publishScript: "release:publish-qualified",
+        qualificationRunnerVariable: "WIDGETS_QUALIFICATION_RUNNER",
+      },
+    },
+    matrix: { os: ["ubuntu-24.04", "windows-2025"], node: ["22.23.2"] },
+    templateVersion: "1.8.0",
+  };
+  if (environments) manifest.candidate.releaseChain.environments = environments;
+  return manifest;
+}
+
+function renderRelease(manifest) {
+  return renderTemplate(
+    fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/release-candidate.yml"), "utf8"),
+    buildRenderContext(manifest, "/repos/widgets"),
+  );
+}
+
+test("release environments default to the single release environment", () => {
+  const content = renderRelease(environmentManifest(null));
+  assert.ok((content.match(/environment: release$/gm) ?? []).length >= 2);
+  assert.doesNotMatch(content, /environment: signing-authorized/);
+});
+
+test("signing and publication split into distinct protected environments", () => {
+  const content = renderRelease(environmentManifest({
+    signing: "signing-authorized",
+    publication: "release-authorized",
+    qualification: "qualification",
+  }));
+  assert.equal((content.match(/environment: signing-authorized$/gm) ?? []).length, 2);
+  assert.equal((content.match(/environment: release-authorized$/gm) ?? []).length, 1);
+  // A job that may sign must never also be the job that publishes.
+  assert.doesNotMatch(content, /environment: release$/m);
+});
+
+test("an unsafe or unknown release environment is rejected", () => {
+  assert.equal(validateManifest(environmentManifest({ signing: "bad name!" })).valid, false);
+  assert.equal(validateManifest(environmentManifest({ promotion: "x" })).valid, false);
+});
+
+test("ci.yml ownership check cannot be removed by deleting optional repo metadata", () => {
+  const manifest = { ...structuredClone(FULL_MANIFEST), ownership: { roots: [".", "engine"] } };
+  const template = fs.readFileSync(path.join(templatesDir, "ci.yml"), "utf8");
+  const withStep = renderTemplate(template, buildRenderContext(manifest, "/repos/coderight"));
+  assert.match(withStep, /RightKit ownership \(protected registry roots\)/);
+  const without = renderTemplate(template, buildRenderContext(structuredClone(FULL_MANIFEST), "/repos/widgets"));
+  assert.match(without, /RightKit ownership \(protected registry roots\)/);
+});

package/templates/ci.yml

@@ -47,4 +47,4 @@ ${PACKAGE_MANAGER_SETUP}
       - run: ${PM_RUN} test:random
       - run: ${PM_RUN} test:all
       - run: node scripts/ci/check-generated.mjs
-      - run: node scripts/ci/check-network-boundary.mjs
+      - run: node scripts/ci/check-network-boundary.mjs${OWNERSHIP_STEP}

package/templates/package-smoke.yml

@@ -34,4 +34,5 @@ jobs:
           package-manager-cache: false
 ${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
+${OWNERSHIP_STEP}
       - run: node scripts/test-package.mjs

package/templates/profiles/rust-hybrid/ci.yml

@@ -64,6 +64,8 @@ jobs:
           node-version: ${{ matrix.node }}
           package-manager-cache: false
 ${PACKAGE_MANAGER_SETUP}
+      - run: ${INSTALL_COMMAND}
+${OWNERSHIP_STEP}
       - uses: dtolnay/rust-toolchain@f8be11a05b1d4f3fcebe6410cc16743212b999b0
         if: steps.rust-changes.outputs.required == 'true'
         with:

package/templates/profiles/rust-hybrid/release-candidate.yml

@@ -23,6 +23,11 @@ on:
         required: false
         type: boolean
         default: false
+      dry_run:
+        description: Rehearse packaging, signing & installed qualification from a branch with publication skipped
+        required: false
+        type: boolean
+        default: false
 concurrency:
   group: release-${{ inputs.version }}
   cancel-in-progress: false
@@ -45,13 +50,20 @@ jobs:
       source_revision: ${{ steps.admit.outputs.source_revision }}
       signed_qualification: ${{ steps.admit.outputs.signed_qualification }}
       publish: ${{ steps.admit.outputs.publish }}
+      dry_run: ${{ steps.admit.outputs.dry_run }}
+      artifact_suffix: ${{ steps.admit.outputs.artifact_suffix }}
     steps:
       - name: Validate immutable dispatch envelope
         shell: bash
         run: |
           set -euo pipefail
-          [[ "$GITHUB_REF" == "refs/heads/main" ]]
-          [[ "$GITHUB_RUN_ATTEMPT" == "1" ]]
+          if [[ "${{ inputs.dry_run }}" == "true" ]]; then
+            [[ "$GITHUB_REF" == refs/heads/* ]]
+            [[ "${{ inputs.publish }}" != "true" ]]
+          else
+            [[ "$GITHUB_REF" == "refs/heads/main" ]]
+            [[ "$GITHUB_RUN_ATTEMPT" == "1" ]]
+          fi
           [[ "${{ inputs.version }}" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]
           [[ "${{ inputs.source_revision }}" =~ ^[a-f0-9]{40}$ ]]
           if [[ "${{ inputs.publish }}" == "true" ]]; then [[ "${{ inputs.signed_qualification }}" == "true" ]]; fi
@@ -66,6 +78,7 @@ jobs:
           package-manager-cache: false
 ${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
+${OWNERSHIP_STEP}
       - name: Admit exact main revision & version
         id: admit
         run: ${PM_RUN} ${RELEASE_ADMISSION_SCRIPT}
@@ -75,6 +88,7 @@ ${PACKAGE_MANAGER_SETUP}
           RIGHT_GIT_SOURCE_REVISION: ${{ inputs.source_revision }}
           RIGHT_GIT_SIGNED_QUALIFICATION: ${{ inputs.signed_qualification }}
           RIGHT_GIT_PUBLISH: ${{ inputs.publish }}
+          RIGHT_GIT_DRY_RUN: ${{ inputs.dry_run }}
           RIGHT_GIT_WORKFLOW_REF: ${{ github.ref }}
           RIGHT_GIT_RUN_ATTEMPT: ${{ github.run_attempt }}
   candidate:

package/templates/publish-npm.yml

@@ -40,6 +40,7 @@ jobs:
           package-manager-cache: false
 ${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
+${OWNERSHIP_STEP}
       - run: node scripts/release/build-candidate.mjs --version "${{ github.event.release.tag_name }}" --platform current --out "release/candidates/publish"
       - run: node scripts/release/check-release.mjs release/candidates/publish
       - id: tarball

package/templates/publish-package-managers.yml

@@ -79,6 +79,7 @@ jobs:
           package-manager-cache: false
 ${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
+${OWNERSHIP_STEP}
       - run: ruby -c release/homebrew/${HOMEBREW_FORMULA_NAME}.rb
       - name: Checkout Homebrew tap
         uses: actions/checkout@v5

package/templates/qualification.yml

@@ -29,6 +29,7 @@ jobs:
           package-manager-cache: false
 ${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
+${OWNERSHIP_STEP}
       - run: ${PM_RUN} test:all
   schema:
     needs: [qualification]

package/templates/release-candidate.yml

@@ -35,6 +35,7 @@ jobs:
           package-manager-cache: false
 ${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
+${OWNERSHIP_STEP}
       - run: node --test tests/release-candidate.test.mjs
       - run: node scripts/release/build-candidate.mjs --platform current --out "${{ runner.temp }}/${ARTIFACT_PREFIX}-rc"
       - run: node scripts/release/check-release.mjs "${{ runner.temp }}/${ARTIFACT_PREFIX}-rc"