@rightkit/git 0.2.3 → 0.2.5

package/README.md

@@ -38,4 +38,4 @@ Node builtins only; no runtime dependencies.
 
 ## Profiles
 
-`profile` defaults to `node`. `rust-hybrid` requires `ci`, accepts optional `release-candidate`, installs pinned Node plus `rustup stable`, then runs product-owned package scripts. Candidate configuration is `{ buildScript, checkScript, artifactRoot }`; RightGit passes an isolated `RIGHT_GIT_ARTIFACT_ROOT`, checks it, & uploads it as an unsigned handoff. It never signs, finalizes, publishes releases, or receives signing credentials.
+`profile` defaults to `node`. `rust-hybrid` requires `ci`, accepts optional `release-candidate`, installs pinned Node plus Rust, then runs product-owned package scripts. Candidate configuration is `{ buildScript, checkScript, artifactRoot, os }`; `os` selects supported release hosts from main matrix. RightGit passes isolated `RIGHT_GIT_ARTIFACT_ROOT`, checks it, & uploads it as an unsigned handoff. It never signs, finalizes, publishes releases, or receives signing credentials.

package/manifest.mjs

@@ -141,7 +141,7 @@ export function validateManifest(manifest) {
       errors.push("candidate must be an object");
     } else {
       for (const key of Object.keys(candidate)) {
-        if (!["buildScript", "checkScript", "artifactRoot"].includes(key)) errors.push(`unknown candidate field: ${key}`);
+        if (!["buildScript", "checkScript", "artifactRoot", "os"].includes(key)) errors.push(`unknown candidate field: ${key}`);
       }
       for (const key of ["buildScript", "checkScript"]) {
         if (typeof candidate[key] !== "string" || !PACKAGE_SCRIPT_RE.test(candidate[key])) {
@@ -151,6 +151,11 @@ export function validateManifest(manifest) {
       if (typeof candidate.artifactRoot !== "string" || !GATE_PATH_RE.test(candidate.artifactRoot)) {
         errors.push("candidate.artifactRoot must be one safe relative path");
       }
+      if (!Array.isArray(candidate.os) || candidate.os.length === 0 || candidate.os.some((value) => typeof value !== "string" || !SAFE_MATRIX_VALUE_RE.test(value))) {
+        errors.push("candidate.os must be a non-empty array of safe runner labels");
+      } else if (candidate.os.some((value) => !manifest.matrix?.os?.includes(value))) {
+        errors.push("candidate.os entries must also exist in matrix.os");
+      }
     }
   }
   if (profile === "rust-hybrid" && lanes.includes("release-candidate") && candidate === undefined) {
@@ -315,6 +320,7 @@ export function buildRenderContext(manifest, repoPath) {
     CANDIDATE_BUILD_SCRIPT: manifest.candidate?.buildScript,
     CANDIDATE_CHECK_SCRIPT: manifest.candidate?.checkScript,
     CANDIDATE_ARTIFACT_ROOT: manifest.candidate?.artifactRoot,
+    CANDIDATE_OS_MATRIX: yamlFlowStringList(manifest.candidate?.os ?? manifest.matrix.os),
   };
 
   if (manifest.publish?.npm) {

package/manifest.schema.json

@@ -88,12 +88,13 @@
     },
     "candidate": {
       "type": "object",
-      "required": ["buildScript", "checkScript", "artifactRoot"],
+      "required": ["buildScript", "checkScript", "artifactRoot", "os"],
       "additionalProperties": false,
       "properties": {
         "buildScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
         "checkScript": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9:_-]*$" },
-        "artifactRoot": { "type": "string", "pattern": "^(?!.*\\.\\.)(?!.*\\s)[A-Za-z0-9][A-Za-z0-9._/-]*$" }
+        "artifactRoot": { "type": "string", "pattern": "^(?!.*\\.\\.)(?!.*\\s)[A-Za-z0-9][A-Za-z0-9._/-]*$" },
+        "os": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 } }
       }
     }
   }

package/manifest.test.mjs

@@ -26,11 +26,12 @@ test("rust-hybrid supports ci plus a configured unsigned release-candidate lane"
   const candidate = {
     ...valid,
     lanes: ["ci", "release-candidate"],
-    candidate: { buildScript: "ci:candidate", checkScript: "ci:candidate-check", artifactRoot: "legion-unsigned" },
+    candidate: { buildScript: "ci:candidate", checkScript: "ci:candidate-check", artifactRoot: "legion-unsigned", os: ["ubuntu-latest"] },
   };
   assert.equal(validateManifest(candidate).valid, true);
   assert.equal(validateManifest({ ...candidate, candidate: { ...candidate.candidate, buildScript: "echo unsafe" } }).valid, false);
   assert.equal(validateManifest({ ...candidate, candidate: { ...candidate.candidate, artifactRoot: "../escape" } }).valid, false);
+  assert.equal(validateManifest({ ...candidate, candidate: { ...candidate.candidate, os: ["windows-latest"] } }).valid, false);
 });
 
 test("rejects non-object input", () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/git",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/render.test.mjs

@@ -46,6 +46,7 @@ test("rust-hybrid ci renders its pinned package manager and gate", () => {
   const manifest = { ...FULL_MANIFEST, lanes: ["ci"], profile: "rust-hybrid", gate: { path: "scripts/gate.sh" }, templateVersion: "1.1.0" };
   const content = renderTemplate(fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/ci.yml"), "utf8"), buildRenderContext(manifest, "/repos/widgets"));
   assert.match(content, /uses: pnpm\/action-setup@[a-f0-9]{40}/);
+  assert.match(content, /^name: widgets-ci$/m);
   assert.match(content, /version: 11\.24\.0/);
   assert.match(content, /toolchain: 1\.98\.0/);
   assert.match(content, /bash \.\/scripts\/gate\.sh/);
@@ -57,7 +58,7 @@ test("rust-hybrid release candidate renders product scripts, artifact handoff, a
     lanes: ["ci", "release-candidate"],
     profile: "rust-hybrid",
     gate: { path: "scripts/gate.sh" },
-    candidate: { buildScript: "ci:candidate", checkScript: "ci:candidate-check", artifactRoot: "widgets-unsigned" },
+    candidate: { buildScript: "ci:candidate", checkScript: "ci:candidate-check", artifactRoot: "widgets-unsigned", os: ["macos-latest", "windows-latest"] },
     templateVersion: "1.2.0",
   };
   const content = renderTemplate(
@@ -67,6 +68,7 @@ test("rust-hybrid release candidate renders product scripts, artifact handoff, a
   assert.match(content, /pnpm run ci:candidate/);
   assert.match(content, /pnpm run ci:candidate-check/);
   assert.match(content, /RIGHT_GIT_ARTIFACT_ROOT/);
+  assert.match(content, /os: \["macos-latest", "windows-latest"\]/);
   assert.match(content, /actions\/upload-artifact@[a-f0-9]{40}/);
   assert.doesNotMatch(content, /secrets\.|AZURE_|APPLE_|certificate|private.key/i);
 });

package/templates/profiles/rust-hybrid/ci.yml

@@ -1,6 +1,6 @@
 # Managed by right-git — do not hand-edit. Run `right-git sync` to update.
 # Template: profiles/rust-hybrid/ci.yml | Template version: ${TEMPLATE_VERSION}
-name: legion-ci
+name: ${ARTIFACT_PREFIX}-ci
 on:
   pull_request:
   push:

package/templates/profiles/rust-hybrid/release-candidate.yml

@@ -21,7 +21,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: ${OS_MATRIX}
+        os: ${CANDIDATE_OS_MATRIX}
         node: ${NODE_MATRIX}
     runs-on: ${{ matrix.os }}
     steps: