@rightkit/git 0.2.27 → 0.2.29

package/README.md

@@ -37,6 +37,20 @@ Set `qaEvidencePath` in `.rightgit.json` to upload the gate's QA output as a wor
 - `qaEvidenceRetentionDays` is an integer from 1 to 90 and defaults to 7. It requires `qaEvidencePath`.
 - Omit the key and the rendered `ci.yml` is unchanged.
 
+## Full validation on every OS (rust-hybrid)
+
+Set `"ciAllOs": true` to run the rust-hybrid `ci` gate on every `matrix.os` runner instead of one. Runners run in declared order with `fail-fast: false`. Each leg uploads its own artifact, because the QA artifact name already includes the runner label.
+
+```json
+{
+  "profile": "rust-hybrid",
+  "matrix": { "os": ["xcode-27", "windows-2025"], "node": ["26.8.1"] },
+  "ciAllOs": true
+}
+```
+
+Omit the key, or set it to `false`, and the rendered `ci.yml` keeps one runner, preferring the first `windows-*` entry. `ciAllOs: true` is rejected for other profiles.
+
 ## Entry points
 
 No importable API. The package has no `main` and no `exports` map. The supported surface is the `right-git` bin.

package/manifest.mjs

@@ -61,6 +61,7 @@ const TOP_LEVEL_KEYS = new Set([
   "rustCache",
   "qaEvidencePath",
   "qaEvidenceRetentionDays",
+  "ciAllOs",
   "candidate",
   "ownership",
 ]);
@@ -83,8 +84,11 @@ const NATIVE_RUNNER_TARGETS = new Map([
   ["macos-15-intel", ["macos", "x86_64"]],
 ]);
 
+// Hosted `macos-*` runners plus the self-hosted Xcode runner labels (`xcode-27`).
+const MACOS_RUNNER_RE = /^(macos|xcode)-/i;
+
 function inferredTarget(os) {
-  const platform = /^windows-/i.test(os) ? "windows" : /^macos-/i.test(os) ? "macos" : "linux";
+  const platform = /^windows-/i.test(os) ? "windows" : MACOS_RUNNER_RE.test(os) ? "macos" : "linux";
   return { os, platform, architecture: platform === "macos" ? "arm64" : "x86_64" };
 }
 
@@ -183,6 +187,16 @@ export function validateManifest(manifest) {
     }
   }
 
+  // ciAllOs (rust-hybrid ci only): run the gate on every matrix.os runner
+  // instead of one declared runner. Omitted or false keeps the single-runner ci job.
+  if (manifest.ciAllOs !== undefined) {
+    if (typeof manifest.ciAllOs !== "boolean") {
+      errors.push("ciAllOs must be a boolean");
+    } else if (manifest.ciAllOs === true && profile !== "rust-hybrid") {
+      errors.push("ciAllOs is only valid for profile 'rust-hybrid'");
+    }
+  }
+
   const rustCache = manifest.rustCache;
   if (rustCache !== undefined) {
     if (profile !== "rust-hybrid") {
@@ -253,7 +267,7 @@ export function validateManifest(manifest) {
             if (nativeTarget && (target.platform !== nativeTarget[0] || target.architecture !== nativeTarget[1])) {
               errors.push(`candidate.targets[] must declare ${target.os} as ${nativeTarget[0]}/${nativeTarget[1]}`);
             }
-            if ((target.platform === "windows" && !/^windows-/i.test(target.os)) || (target.platform === "macos" && !/^macos-/i.test(target.os))) {
+            if ((target.platform === "windows" && !/^windows-/i.test(target.os)) || (target.platform === "macos" && !MACOS_RUNNER_RE.test(target.os))) {
               errors.push("candidate.targets[].os must match its Windows or macOS platform");
             }
             const targetKey = `${target.os}|${target.platform}|${target.architecture}`;
@@ -1055,10 +1069,20 @@ export function buildRenderContext(manifest, repoPath, lane = "ci") {
   const rustWorkspaces = manifest.rustCache?.workspaces ?? ["engine"];
   const configuredWindowsRunner = manifest.matrix.os.find((runner) => runner.startsWith("windows-"));
   const ciOs = configuredWindowsRunner ?? manifest.matrix.os[0];
+  const ciMatrixOs = manifest.ciAllOs === true
+    ? [
+      "        # ciAllOs: the gate runs on every matrix.os runner, in declared order.",
+      `        os: ${yamlFlowStringList(manifest.matrix.os)}`,
+    ]
+    : [
+      "        # Full validation stays on one declared runner; prefer configured",
+      "        # Windows when available, otherwise preserve first configured OS.",
+      `        os: ${yamlFlowStringList([ciOs])}`,
+    ];
 
   const context = {
     OS_MATRIX: yamlFlowStringList(manifest.matrix.os),
-    CI_OS_MATRIX: yamlFlowStringList([ciOs]),
+    CI_MATRIX_OS: ciMatrixOs.join("\n"),
     NODE_MATRIX: yamlFlowStringList(manifest.matrix.node),
     NODE_PUBLISH_VERSION: JSON.stringify(String(manifest.matrix.node[0])),
     PM_NAME: pm.name,

package/manifest.schema.json

@@ -128,6 +128,11 @@
       "default": 7,
       "description": "rust-hybrid only, requires qaEvidencePath. Artifact retention in days."
     },
+    "ciAllOs": {
+      "type": "boolean",
+      "default": false,
+      "description": "rust-hybrid only. When true, the ci job runs the gate on every matrix.os runner in declared order (fail-fast: false). When false or unset, the ci job uses one runner (preferring the first windows-* entry, else the first matrix.os entry)."
+    },
     "candidate": {
       "type": "object",
       "required": ["buildScript", "checkScript", "admissionScript", "stageSummaryScript", "artifactRoot", "os"],

package/manifest.test.mjs

@@ -207,6 +207,9 @@ test("candidate targets permit native multi-architecture matrices independent of
   assert.equal(validateManifest({ ...multiArchitecture, candidate: { ...multiArchitecture.candidate, targets: [{ os: "windows-2025", platform: "windows", architecture: "riscv64" }] } }).valid, false);
   assert.equal(validateManifest({ ...multiArchitecture, candidate: { ...multiArchitecture.candidate, targets: [{ os: "windows-11-arm", platform: "windows", architecture: "x86_64" }] } }).valid, false);
   assert.equal(validateManifest({ ...multiArchitecture, candidate: { ...multiArchitecture.candidate, targets: [{ os: "ubuntu-24.04", platform: "windows", architecture: "x86_64" }] } }).valid, false);
+  const xcodeRunner = { ...multiArchitecture, candidate: { ...multiArchitecture.candidate, os: ["xcode-27"], targets: [{ os: "xcode-27", platform: "macos", architecture: "arm64" }], signWindows: false } };
+  assert.equal(validateManifest(xcodeRunner).valid, true, JSON.stringify(validateManifest(xcodeRunner).errors));
+  assert.equal(validateManifest({ ...multiArchitecture, candidate: { ...multiArchitecture.candidate, os: ["ubuntu-24.04"], targets: [{ os: "ubuntu-24.04", platform: "macos", architecture: "arm64" }] } }).valid, false);
   assert.equal(validateManifest({ ...multiArchitecture, candidate: { ...multiArchitecture.candidate, targets: [{ os: "${{ secrets.X }}", platform: "windows", architecture: "x86_64" }] } }).valid, false);
   assert.equal(validateManifest({ ...multiArchitecture, candidate: { ...multiArchitecture.candidate, releaseChain: { windowsFinalizeScript: "release:finalize:win", macosFinalizeScript: "release:finalize:mac", installedQualificationScript: "release:qualify", publishScript: "release:publish", qualificationRunnerVariable: "QUALIFICATION_RUNNER_LABEL" } } }).valid, false);
 });
@@ -403,3 +406,15 @@ test("qaEvidencePath and qaEvidenceRetentionDays are optional, rust-hybrid only,
   assert.equal(validateManifest({ ...valid, qaEvidenceRetentionDays: 7 }).valid, false, "retention requires a path");
   assert.equal(validateManifest({ ...VALID_MINIMAL, qaEvidencePath: "pulse-hub-qa" }).valid, false, "node profile rejects qaEvidencePath");
 });
+
+test("ciAllOs is an optional boolean, rust-hybrid only", () => {
+  const valid = { ...VALID_MINIMAL, profile: "rust-hybrid", gate: { path: "scripts/gate.sh" } };
+  assert.equal(validateManifest(valid).valid, true);
+  assert.equal(validateManifest({ ...valid, ciAllOs: true }).valid, true);
+  assert.equal(validateManifest({ ...valid, ciAllOs: false }).valid, true);
+  for (const ciAllOs of ["true", 1, null]) {
+    assert.equal(validateManifest({ ...valid, ciAllOs }).valid, false, String(ciAllOs));
+  }
+  assert.equal(validateManifest({ ...VALID_MINIMAL, ciAllOs: true }).valid, false, "node profile rejects ciAllOs true");
+  assert.equal(validateManifest({ ...VALID_MINIMAL, ciAllOs: false }).valid, true, "false is accepted for any profile");
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/git",
-  "version": "0.2.27",
+  "version": "0.2.29",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/render.test.mjs

@@ -119,6 +119,35 @@ test("rust-hybrid ci preserves a declared macOS-only lane", () => {
   assert.doesNotMatch(content, /windows-2025/);
 });
 
+test("rust-hybrid ci runs every matrix.os runner when ciAllOs is true, in declared order", () => {
+  const base = {
+    ...FULL_MANIFEST,
+    lanes: ["ci"],
+    profile: "rust-hybrid",
+    gate: { path: "scripts/gate.sh" },
+    qaEvidencePath: "pulse-hub-qa",
+    matrix: { os: ["xcode-27", "windows-2025"], node: ["26.8.1"] },
+  };
+  const render = (manifest) => renderTemplate(
+    fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/ci.yml"), "utf8"),
+    buildRenderContext(manifest, "/repos/pulse"),
+  );
+  const all = render({ ...base, ciAllOs: true });
+  assert.match(all, /^ {8}os: \["xcode-27", "windows-2025"\]$/m);
+  assert.match(all, /runs-on: \$\{\{ matrix\.os \}\}/);
+  assert.match(all, /fail-fast: false/);
+  assert.match(all, /name: qa-evidence-\$\{\{ matrix\.os \|\| runner\.os \}\}-\$\{\{ github\.run_attempt \}\}/);
+  assert.doesNotMatch(all, /Full validation stays/);
+  // ciAllOs false and unset render the same single-runner matrix as before.
+  for (const manifest of [base, { ...base, ciAllOs: false }]) {
+    const single = render(manifest);
+    assert.match(single, /# Full validation stays on one declared runner; prefer configured\n {8}# Windows when available, otherwise preserve first configured OS\.\n {8}os: \["windows-2025"\]\n/);
+    assert.doesNotMatch(single, /xcode-27/);
+  }
+  // Unset and false produce byte-identical output.
+  assert.equal(render({ ...base, ciAllOs: false }), render(base));
+});
+
 test("rust-hybrid release candidate renders product scripts, artifact handoff, and no signing secret", () => {
   const manifest = {
     ...FULL_MANIFEST,

package/templates/profiles/rust-hybrid/ci.yml

@@ -22,9 +22,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # Full validation stays on one declared runner; prefer configured
-        # Windows when available, otherwise preserve first configured OS.
-        os: ${CI_OS_MATRIX}
+${CI_MATRIX_OS}
         node: ${NODE_MATRIX}
     runs-on: ${{ matrix.os }}
     steps: