@rightkit/git 0.2.28 → 0.2.30

package/README.md

@@ -37,6 +37,20 @@ Set `qaEvidencePath` in `.rightgit.json` to upload the gate's QA output as a wor
 - `qaEvidenceRetentionDays` is an integer from 1 to 90 and defaults to 7. It requires `qaEvidencePath`.
 - Omit the key and the rendered `ci.yml` is unchanged.
 
+## Full validation on every OS (rust-hybrid)
+
+Set `"ciAllOs": true` to run the rust-hybrid `ci` gate on every `matrix.os` runner instead of one. Runners run in declared order with `fail-fast: false`. Each leg uploads its own artifact, because the QA artifact name already includes the runner label.
+
+```json
+{
+  "profile": "rust-hybrid",
+  "matrix": { "os": ["xcode-27", "windows-2025"], "node": ["26.8.1"] },
+  "ciAllOs": true
+}
+```
+
+Omit the key, or set it to `false`, and the rendered `ci.yml` keeps one runner, preferring the first `windows-*` entry. `ciAllOs: true` is rejected for other profiles.
+
 ## Entry points
 
 No importable API. The package has no `main` and no `exports` map. The supported surface is the `right-git` bin.

package/manifest.mjs

@@ -61,6 +61,7 @@ const TOP_LEVEL_KEYS = new Set([
   "rustCache",
   "qaEvidencePath",
   "qaEvidenceRetentionDays",
+  "ciAllOs",
   "candidate",
   "ownership",
 ]);
@@ -186,6 +187,16 @@ export function validateManifest(manifest) {
     }
   }
 
+  // ciAllOs (rust-hybrid ci only): run the gate on every matrix.os runner
+  // instead of one declared runner. Omitted or false keeps the single-runner ci job.
+  if (manifest.ciAllOs !== undefined) {
+    if (typeof manifest.ciAllOs !== "boolean") {
+      errors.push("ciAllOs must be a boolean");
+    } else if (manifest.ciAllOs === true && profile !== "rust-hybrid") {
+      errors.push("ciAllOs is only valid for profile 'rust-hybrid'");
+    }
+  }
+
   const rustCache = manifest.rustCache;
   if (rustCache !== undefined) {
     if (profile !== "rust-hybrid") {
@@ -1021,13 +1032,15 @@ export function ownershipStep(manifest, lane = "ci") {
   const command = name === "pnpm" ? "pnpm exec right-release ownership --app ."
     : name === "npm" ? "npm exec -- right-release ownership --app ."
       : "yarn exec right-release ownership --app .";
+  // CI stays advisory until ownership approval keys are enrolled; release-candidate stays strict.
+  const ownershipCommand = lane === "ci" ? `${command} --advisory-when-pending` : command;
   // Only release-candidate dispatches declare source_revision. Referencing
   // inputs.source_revision from other lanes makes actionlint reject their
   // generated workflows, even when guarded by an event-name expression.
   const sourceRevision = lane === "release-candidate"
     ? "\${{ inputs.source_revision }}"
     : "\${{ github.sha }}";
-  return `\n      - name: RightKit ownership (protected registry roots)\n        shell: bash\n        run: test "$(git rev-parse HEAD)" = "${sourceRevision}" && ${command}`;
+  return `\n      - name: RightKit ownership (protected registry roots)\n        shell: bash\n        run: test "$(git rev-parse HEAD)" = "${sourceRevision}" && ${ownershipCommand}`;
 }
 
 /**
@@ -1058,10 +1071,20 @@ export function buildRenderContext(manifest, repoPath, lane = "ci") {
   const rustWorkspaces = manifest.rustCache?.workspaces ?? ["engine"];
   const configuredWindowsRunner = manifest.matrix.os.find((runner) => runner.startsWith("windows-"));
   const ciOs = configuredWindowsRunner ?? manifest.matrix.os[0];
+  const ciMatrixOs = manifest.ciAllOs === true
+    ? [
+      "        # ciAllOs: the gate runs on every matrix.os runner, in declared order.",
+      `        os: ${yamlFlowStringList(manifest.matrix.os)}`,
+    ]
+    : [
+      "        # Full validation stays on one declared runner; prefer configured",
+      "        # Windows when available, otherwise preserve first configured OS.",
+      `        os: ${yamlFlowStringList([ciOs])}`,
+    ];
 
   const context = {
     OS_MATRIX: yamlFlowStringList(manifest.matrix.os),
-    CI_OS_MATRIX: yamlFlowStringList([ciOs]),
+    CI_MATRIX_OS: ciMatrixOs.join("\n"),
     NODE_MATRIX: yamlFlowStringList(manifest.matrix.node),
     NODE_PUBLISH_VERSION: JSON.stringify(String(manifest.matrix.node[0])),
     PM_NAME: pm.name,

package/manifest.schema.json

@@ -128,6 +128,11 @@
       "default": 7,
       "description": "rust-hybrid only, requires qaEvidencePath. Artifact retention in days."
     },
+    "ciAllOs": {
+      "type": "boolean",
+      "default": false,
+      "description": "rust-hybrid only. When true, the ci job runs the gate on every matrix.os runner in declared order (fail-fast: false). When false or unset, the ci job uses one runner (preferring the first windows-* entry, else the first matrix.os entry)."
+    },
     "candidate": {
       "type": "object",
       "required": ["buildScript", "checkScript", "admissionScript", "stageSummaryScript", "artifactRoot", "os"],

package/manifest.test.mjs

@@ -406,3 +406,15 @@ test("qaEvidencePath and qaEvidenceRetentionDays are optional, rust-hybrid only,
   assert.equal(validateManifest({ ...valid, qaEvidenceRetentionDays: 7 }).valid, false, "retention requires a path");
   assert.equal(validateManifest({ ...VALID_MINIMAL, qaEvidencePath: "pulse-hub-qa" }).valid, false, "node profile rejects qaEvidencePath");
 });
+
+test("ciAllOs is an optional boolean, rust-hybrid only", () => {
+  const valid = { ...VALID_MINIMAL, profile: "rust-hybrid", gate: { path: "scripts/gate.sh" } };
+  assert.equal(validateManifest(valid).valid, true);
+  assert.equal(validateManifest({ ...valid, ciAllOs: true }).valid, true);
+  assert.equal(validateManifest({ ...valid, ciAllOs: false }).valid, true);
+  for (const ciAllOs of ["true", 1, null]) {
+    assert.equal(validateManifest({ ...valid, ciAllOs }).valid, false, String(ciAllOs));
+  }
+  assert.equal(validateManifest({ ...VALID_MINIMAL, ciAllOs: true }).valid, false, "node profile rejects ciAllOs true");
+  assert.equal(validateManifest({ ...VALID_MINIMAL, ciAllOs: false }).valid, true, "false is accepted for any profile");
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/git",
-  "version": "0.2.28",
+  "version": "0.2.30",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/render.test.mjs

@@ -119,6 +119,35 @@ test("rust-hybrid ci preserves a declared macOS-only lane", () => {
   assert.doesNotMatch(content, /windows-2025/);
 });
 
+test("rust-hybrid ci runs every matrix.os runner when ciAllOs is true, in declared order", () => {
+  const base = {
+    ...FULL_MANIFEST,
+    lanes: ["ci"],
+    profile: "rust-hybrid",
+    gate: { path: "scripts/gate.sh" },
+    qaEvidencePath: "pulse-hub-qa",
+    matrix: { os: ["xcode-27", "windows-2025"], node: ["26.8.1"] },
+  };
+  const render = (manifest) => renderTemplate(
+    fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/ci.yml"), "utf8"),
+    buildRenderContext(manifest, "/repos/pulse"),
+  );
+  const all = render({ ...base, ciAllOs: true });
+  assert.match(all, /^ {8}os: \["xcode-27", "windows-2025"\]$/m);
+  assert.match(all, /runs-on: \$\{\{ matrix\.os \}\}/);
+  assert.match(all, /fail-fast: false/);
+  assert.match(all, /name: qa-evidence-\$\{\{ matrix\.os \|\| runner\.os \}\}-\$\{\{ github\.run_attempt \}\}/);
+  assert.doesNotMatch(all, /Full validation stays/);
+  // ciAllOs false and unset render the same single-runner matrix as before.
+  for (const manifest of [base, { ...base, ciAllOs: false }]) {
+    const single = render(manifest);
+    assert.match(single, /# Full validation stays on one declared runner; prefer configured\n {8}# Windows when available, otherwise preserve first configured OS\.\n {8}os: \["windows-2025"\]\n/);
+    assert.doesNotMatch(single, /xcode-27/);
+  }
+  // Unset and false produce byte-identical output.
+  assert.equal(render({ ...base, ciAllOs: false }), render(base));
+});
+
 test("rust-hybrid release candidate renders product scripts, artifact handoff, and no signing secret", () => {
   const manifest = {
     ...FULL_MANIFEST,

package/templates/profiles/rust-hybrid/ci.yml

@@ -22,9 +22,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # Full validation stays on one declared runner; prefer configured
-        # Windows when available, otherwise preserve first configured OS.
-        os: ${CI_OS_MATRIX}
+${CI_MATRIX_OS}
         node: ${NODE_MATRIX}
     runs-on: ${{ matrix.os }}
     steps: