@rightkit/git 0.2.30 → 0.2.32

package/README.md

@@ -51,6 +51,35 @@ Set `"ciAllOs": true` to run the rust-hybrid `ci` gate on every `matrix.os` runn
 
 Omit the key, or set it to `false`, and the rendered `ci.yml` keeps one runner, preferring the first `windows-*` entry. `ciAllOs: true` is rejected for other profiles.
 
+## Incremental CI and dev artifacts (rust-hybrid)
+
+Both keys are opt-in; unset, the rendered `ci.yml` is byte-identical.
+
+`"ciIncremental": true` switches Rust caching to `cache-workspace-crates: true`, sets `CARGO_INCREMENTAL=1` for the ci gate, and caches `~/Library/Developer/Xcode/DerivedData` on macOS legs (key: runner + `Cargo.lock` + `Package.resolved` + `project.pbxproj` hash).
+
+`devArtifact` publishes fast development builds as workflow artifacts, separate from the release-candidate lane. It runs on push to the default branch only, never on pull requests.
+
+```json
+{
+  "profile": "rust-hybrid",
+  "matrix": { "os": ["xcode-27", "windows-2025"], "node": ["26.8.1"] },
+  "ciAllOs": true,
+  "ciIncremental": true,
+  "devArtifact": {
+    "mac": "sign",
+    "windows": "unsigned",
+    "retentionDays": 7,
+    "macAppPath": "target/release/bundle/macos/Pulse.app",
+    "windowsGlob": "target/release/*.exe"
+  }
+}
+```
+
+- `mac: "sign"` needs `macAppPath` (the built `.app`, repository-relative) and a macOS runner in the ci gate (`ciAllOs`). The unsigned app is zipped with `ditto` and handed to a separate `dev-mac-sign` job that installs the Developer ID identity from the `release` environment secrets, runs `codesign --force --deep --strict --options runtime`, verifies, zips and uploads `dev-mac-<sha>`. No notarization, admission or ownership gate. Optional `macEntitlements` passes `--entitlements`.
+- `windows: "unsigned"` needs `windowsGlob` and a `windows-*` runner in the ci gate; matched files upload as `dev-windows-<sha>`.
+- The `dev-mac-sign` job uses the `release` environment, so that environment's protection rules (required reviewers, branch policy) apply. The job only exists for pushes to the default branch.
+- Install a mac dev build with `right-release install-app --dev --zip <file>` (Developer ID-signed, not notarized).
+
 ## Entry points
 
 No importable API. The package has no `main` and no `exports` map. The supported surface is the `right-git` bin.

package/manifest.mjs

@@ -62,6 +62,8 @@ const TOP_LEVEL_KEYS = new Set([
   "qaEvidencePath",
   "qaEvidenceRetentionDays",
   "ciAllOs",
+  "ciIncremental",
+  "devArtifact",
   "candidate",
   "ownership",
 ]);
@@ -197,6 +199,17 @@ export function validateManifest(manifest) {
     }
   }
 
+  // ciIncremental (rust-hybrid ci only): opt-in incremental Rust + DerivedData caching.
+  if (manifest.ciIncremental !== undefined) {
+    if (typeof manifest.ciIncremental !== "boolean") {
+      errors.push("ciIncremental must be a boolean");
+    } else if (manifest.ciIncremental === true && profile !== "rust-hybrid") {
+      errors.push("ciIncremental is only valid for profile 'rust-hybrid'");
+    }
+  }
+
+  validateDevArtifact(manifest, profile, errors);
+
   const rustCache = manifest.rustCache;
   if (rustCache !== undefined) {
     if (profile !== "rust-hybrid") {
@@ -536,6 +549,208 @@ function releaseEnvironment(manifest, role) {
 	return typeof configured === "string" && configured.length > 0 ? configured : "release";
 }
 
+// Dev artifacts (rust-hybrid ci only): fast, non-release builds on push to the default branch.
+const DEV_ARTIFACT_DEFAULT_RETENTION_DAYS = 7;
+const DEV_ARTIFACT_MAX_RETENTION_DAYS = 90;
+const DEV_MAC_PATH_RE = /^(?!.*\.\.)[A-Za-z0-9][A-Za-z0-9._/ -]*$/;
+const DEV_WINDOWS_GLOB_RE = /^(?!.*\.\.)[A-Za-z0-9][A-Za-z0-9._/*?-]*$/;
+const CACHE_ACTION_PIN = "actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4";
+
+function effectiveCiRunners(manifest) {
+  const os = manifest.matrix?.os;
+  if (!Array.isArray(os) || os.length === 0) return [];
+  if (manifest.ciAllOs === true) return os;
+  return [os.find((runner) => typeof runner === "string" && runner.startsWith("windows-")) ?? os[0]];
+}
+
+function validateDevArtifact(manifest, profile, errors) {
+  const dev = manifest.devArtifact;
+  if (dev === undefined) return;
+  if (profile !== "rust-hybrid") {
+    errors.push("devArtifact is only valid for profile 'rust-hybrid'");
+    return;
+  }
+  if (dev === null || typeof dev !== "object" || Array.isArray(dev)) {
+    errors.push("devArtifact must be an object");
+    return;
+  }
+  for (const key of Object.keys(dev)) {
+    if (!["mac", "windows", "retentionDays", "macAppPath", "macEntitlements", "windowsGlob"].includes(key)) errors.push(`unknown devArtifact field: ${key}`);
+  }
+  if (dev.mac !== undefined && dev.mac !== "sign" && dev.mac !== "none") errors.push("devArtifact.mac must be 'sign' or 'none'");
+  if (dev.windows !== undefined && dev.windows !== "unsigned" && dev.windows !== "none") errors.push("devArtifact.windows must be 'unsigned' or 'none'");
+  if (dev.mac !== "sign" && dev.windows !== "unsigned") errors.push("devArtifact requires mac 'sign' and/or windows 'unsigned'");
+  if (dev.retentionDays !== undefined && (!Number.isInteger(dev.retentionDays) || dev.retentionDays < 1 || dev.retentionDays > DEV_ARTIFACT_MAX_RETENTION_DAYS)) {
+    errors.push(`devArtifact.retentionDays must be an integer from 1 to ${DEV_ARTIFACT_MAX_RETENTION_DAYS}`);
+  }
+  const runners = effectiveCiRunners(manifest).filter((runner) => typeof runner === "string");
+  if (dev.mac === "sign") {
+    if (typeof dev.macAppPath !== "string" || !DEV_MAC_PATH_RE.test(dev.macAppPath) || !dev.macAppPath.endsWith(".app")) {
+      errors.push("devArtifact.macAppPath must be a safe repository-relative path ending in .app when mac is 'sign'");
+    }
+    if (dev.macEntitlements !== undefined && (typeof dev.macEntitlements !== "string" || !GATE_PATH_RE.test(dev.macEntitlements))) {
+      errors.push("devArtifact.macEntitlements must be a safe repository-relative path");
+    }
+    if (!runners.some((runner) => MACOS_RUNNER_RE.test(runner))) {
+      errors.push("devArtifact.mac 'sign' needs the ci gate to run on a macOS runner (set ciAllOs and include a macos-* or xcode-* runner in matrix.os)");
+    }
+  } else if (dev.macAppPath !== undefined || dev.macEntitlements !== undefined) {
+    errors.push("devArtifact.macAppPath and macEntitlements require mac 'sign'");
+  }
+  if (dev.windows === "unsigned") {
+    if (typeof dev.windowsGlob !== "string" || !DEV_WINDOWS_GLOB_RE.test(dev.windowsGlob)) {
+      errors.push("devArtifact.windowsGlob must be a safe repository-relative glob when windows is 'unsigned'");
+    }
+    if (!runners.some((runner) => /^windows-/i.test(runner))) {
+      errors.push("devArtifact.windows 'unsigned' needs the ci gate to run on a windows-* runner");
+    }
+  } else if (dev.windowsGlob !== undefined) {
+    errors.push("devArtifact.windowsGlob requires windows 'unsigned'");
+  }
+}
+
+const DEV_PUSH_CONDITION = "github.event_name == 'push' && github.ref_name == github.event.repository.default_branch";
+
+/** ciIncremental: Xcode DerivedData cache step (leading newline; "" when unset). */
+function derivedDataStep(manifest) {
+  if (manifest.ciIncremental !== true) return "";
+  return [
+    "",
+    "      - name: Cache Xcode DerivedData",
+    "        if: ${{ runner.os == 'macOS' }}",
+    `        uses: ${CACHE_ACTION_PIN}`,
+    "        with:",
+    "          path: ~/Library/Developer/Xcode/DerivedData",
+    "          key: ${{ runner.os }}-${{ matrix.os }}-deriveddata-${{ hashFiles('**/Cargo.lock', '**/Package.resolved', '**/*.xcodeproj/project.pbxproj') }}",
+    "          restore-keys: |",
+    "            ${{ runner.os }}-${{ matrix.os }}-deriveddata-",
+  ].join("\n");
+}
+
+/**
+ * Dev artifact steps appended to the ci job (unsigned, no secrets) plus the
+ * separate signing job. Returns "" when devArtifact is unset.
+ */
+export function devArtifactCi(manifest) {
+  const dev = manifest.devArtifact;
+  if (dev === undefined) return "";
+  const retention = dev.retentionDays ?? DEV_ARTIFACT_DEFAULT_RETENTION_DAYS;
+  const parts = [];
+  if (dev.windows === "unsigned") {
+    parts.push([
+      "      - name: Upload unsigned dev build (Windows)",
+      `        if: \${{ ${DEV_PUSH_CONDITION} && runner.os == 'Windows' }}`,
+      `        uses: ${UPLOAD_ARTIFACT_PIN}`,
+      "        with:",
+      "          name: dev-windows-${{ github.sha }}",
+      `          path: ${dev.windowsGlob}`,
+      `          retention-days: ${retention}`,
+      "          if-no-files-found: error",
+      "",
+    ].join("\n"));
+  }
+  if (dev.mac === "sign") {
+    parts.push([
+      "      - name: Package unsigned dev app (macOS)",
+      `        if: \${{ ${DEV_PUSH_CONDITION} && runner.os == 'macOS' }}`,
+      "        shell: bash",
+      "        env:",
+      `          DEV_APP_PATH: ${JSON.stringify(dev.macAppPath)}`,
+      "        run: |",
+      "          set -euo pipefail",
+      "          test -d \"$DEV_APP_PATH\"",
+      "          mkdir -p \"$RUNNER_TEMP/dev-unsigned\"",
+      "          ditto -c -k --keepParent \"$DEV_APP_PATH\" \"$RUNNER_TEMP/dev-unsigned/app.zip\"",
+      "      - name: Upload unsigned dev app for signing (macOS)",
+      `        if: \${{ ${DEV_PUSH_CONDITION} && runner.os == 'macOS' }}`,
+      `        uses: ${UPLOAD_ARTIFACT_PIN}`,
+      "        with:",
+      "          name: dev-unsigned-mac-${{ github.sha }}",
+      "          path: ${{ runner.temp }}/dev-unsigned/app.zip",
+      "          retention-days: 1",
+      "          if-no-files-found: error",
+      "",
+    ].join("\n"));
+  }
+  let text = parts.join("");
+  if (dev.mac === "sign") text += devMacSigningJob(manifest, dev, retention);
+  return text;
+}
+
+function devMacSigningJob(manifest, dev, retention) {
+  const runner = effectiveCiRunners(manifest).find((os) => MACOS_RUNNER_RE.test(os));
+  const entitlements = dev.macEntitlements ? ` --entitlements "$GITHUB_WORKSPACE/${dev.macEntitlements}"` : "";
+  const checkout = dev.macEntitlements
+    ? `      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: \${{ github.sha }}
+          persist-credentials: false
+`
+    : "";
+  return `
+  dev-mac-sign:
+    # Push to the default branch only. The release environment's protection
+    # rules (required reviewers, branch policy) apply to this job.
+    needs: [ci]
+    if: \${{ ${DEV_PUSH_CONDITION} }}
+    environment: ${releaseEnvironment(manifest, "signing")}
+    runs-on: ${runner}
+    permissions:
+      contents: read
+    steps:
+${checkout}      - name: Download unsigned dev app
+        uses: actions/download-artifact@${DOWNLOAD_ARTIFACT_SHA} # v4.3.0
+        with:
+          name: dev-unsigned-mac-\${{ github.sha }}
+          path: \${{ runner.temp }}/dev-unsigned
+      - name: Install Apple signing identity in temporary keychain
+        shell: bash
+        env:
+          APPLE_CERTIFICATE_BASE64: \${{ secrets.APPLE_CERTIFICATE_BASE64 }}
+          APPLE_CERTIFICATE_PASSWORD: \${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_KEYCHAIN_PASSWORD: \${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
+        run: |
+          set -euo pipefail
+          certificate_path="$RUNNER_TEMP/apple-signing.p12"
+          keychain_path="$RUNNER_TEMP/apple-signing.keychain-db"
+          printf '%s' "$APPLE_CERTIFICATE_BASE64" | base64 --decode > "$certificate_path"
+          security create-keychain -p "$APPLE_KEYCHAIN_PASSWORD" "$keychain_path"
+          security set-keychain-settings -lut 21600 "$keychain_path"
+          security unlock-keychain -p "$APPLE_KEYCHAIN_PASSWORD" "$keychain_path"
+          security import "$certificate_path" -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain_path"
+          security set-key-partition-list -S apple-tool:,apple: -k "$APPLE_KEYCHAIN_PASSWORD" "$keychain_path"
+          security list-keychain -d user -s "$keychain_path"
+      - name: Developer ID sign dev app (no notarization)
+        shell: bash
+        env:
+          APPLE_DEVELOPER_ID: \${{ vars.APPLE_DEVELOPER_ID }}
+        run: |
+          set -euo pipefail
+          work="$RUNNER_TEMP/dev-sign"
+          rm -rf "$work" && mkdir -p "$work"
+          ditto -x -k "$RUNNER_TEMP/dev-unsigned/app.zip" "$work"
+          app="$(find "$work" -maxdepth 1 -name '*.app' -print -quit)"
+          test -n "$app"
+          codesign --force --deep --strict --options runtime --timestamp${entitlements} --sign "$APPLE_DEVELOPER_ID" "$app"
+          codesign --verify --deep --strict "$app"
+          mkdir -p "$RUNNER_TEMP/dev-signed"
+          ditto -c -k --keepParent "$app" "$RUNNER_TEMP/dev-signed/$(basename "$app").zip"
+      - name: Upload signed (not notarized) dev app
+        uses: ${UPLOAD_ARTIFACT_PIN}
+        with:
+          name: dev-mac-\${{ github.sha }}
+          path: \${{ runner.temp }}/dev-signed/*.zip
+          retention-days: ${retention}
+          if-no-files-found: error
+      - name: Remove Apple signing material
+        if: \${{ always() }}
+        shell: bash
+        run: |
+          security delete-keychain "$RUNNER_TEMP/apple-signing.keychain-db" 2>/dev/null || true
+          rm -f "$RUNNER_TEMP/apple-signing.p12"
+`;
+}
+
 function windowsSigningJob(manifest, pm, artifactPrefix) {
   if (manifest.candidate?.signWindows !== true) return "";
   const nodeVersion = String(manifest.matrix.node[0]);
@@ -1032,8 +1247,9 @@ export function ownershipStep(manifest, lane = "ci") {
   const command = name === "pnpm" ? "pnpm exec right-release ownership --app ."
     : name === "npm" ? "npm exec -- right-release ownership --app ."
       : "yarn exec right-release ownership --app .";
-  // CI stays advisory until ownership approval keys are enrolled; release-candidate stays strict.
-  const ownershipCommand = lane === "ci" ? `${command} --advisory-when-pending` : command;
+  // Every lane stays advisory until ownership approval keys are enrolled (Adrian, 2026-10-09);
+  // once enrolled, the flag is inert and findings block again.
+  const ownershipCommand = `${command} --advisory-when-pending`;
   // Only release-candidate dispatches declare source_revision. Referencing
   // inputs.source_revision from other lanes makes actionlint reject their
   // generated workflows, even when guarded by an event-name expression.
@@ -1101,7 +1317,10 @@ export function buildRenderContext(manifest, repoPath, lane = "ci") {
     MACOS_SIGNING_JOB: macosSigningJob(manifest, pm, artifactPrefix),
     RELEASE_CHAIN_JOBS: releaseChainJobs(manifest, pm, artifactPrefix),
     OWNERSHIP_STEP: ownershipStep(manifest, lane),
-    QA_EVIDENCE_STEP: qaEvidenceStep(manifest),
+    QA_EVIDENCE_STEP: qaEvidenceStep(manifest) + devArtifactCi(manifest),
+    CI_CACHE_WORKSPACE_CRATES: manifest.ciIncremental === true ? "true" : "false",
+    CI_CARGO_INCREMENTAL: manifest.ciIncremental === true ? "1" : "0",
+    CI_DERIVED_DATA_STEP: derivedDataStep(manifest),
   };
 
   // Every key below is populated ONLY when its source manifest section is

package/manifest.schema.json

@@ -133,6 +133,24 @@
       "default": false,
       "description": "rust-hybrid only. When true, the ci job runs the gate on every matrix.os runner in declared order (fail-fast: false). When false or unset, the ci job uses one runner (preferring the first windows-* entry, else the first matrix.os entry)."
     },
+    "ciIncremental": {
+      "type": "boolean",
+      "default": false,
+      "description": "rust-hybrid only. When true, the ci job uses Swatinem/rust-cache with cache-workspace-crates, CARGO_INCREMENTAL=1, and caches Xcode DerivedData on macOS legs."
+    },
+    "devArtifact": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "rust-hybrid only. Dev builds on push to the default branch (never PRs). mac 'sign' Developer ID-signs (no notarization) in a separate job using the release environment; windows 'unsigned' uploads built files as-is.",
+      "properties": {
+        "mac": { "enum": ["sign", "none"] },
+        "windows": { "enum": ["unsigned", "none"] },
+        "retentionDays": { "type": "integer", "minimum": 1, "maximum": 90, "default": 7 },
+        "macAppPath": { "type": "string", "pattern": "^(?!.*\\.\\.)[A-Za-z0-9][A-Za-z0-9._/ -]*\\.app$", "description": "Repository-relative path of the built .app (required when mac is 'sign')." },
+        "macEntitlements": { "type": "string", "pattern": "^(?!.*\\.\\.)(?!.*\\s)[A-Za-z0-9][A-Za-z0-9._/-]*$", "description": "Optional repository-relative entitlements plist for codesign." },
+        "windowsGlob": { "type": "string", "pattern": "^(?!.*\\.\\.)[A-Za-z0-9][A-Za-z0-9._/*?-]*$", "description": "Repository-relative glob of built files to upload (required when windows is 'unsigned')." }
+      }
+    },
     "candidate": {
       "type": "object",
       "required": ["buildScript", "checkScript", "admissionScript", "stageSummaryScript", "artifactRoot", "os"],

package/manifest.test.mjs

@@ -418,3 +418,42 @@ test("ciAllOs is an optional boolean, rust-hybrid only", () => {
   assert.equal(validateManifest({ ...VALID_MINIMAL, ciAllOs: true }).valid, false, "node profile rejects ciAllOs true");
   assert.equal(validateManifest({ ...VALID_MINIMAL, ciAllOs: false }).valid, true, "false is accepted for any profile");
 });
+
+test("ciIncremental is an optional boolean, rust-hybrid only", () => {
+  const valid = { ...VALID_MINIMAL, profile: "rust-hybrid", lanes: ["ci"], gate: { path: "scripts/gate.sh" } };
+  assert.equal(validateManifest({ ...valid, ciIncremental: true }).valid, true);
+  assert.equal(validateManifest({ ...valid, ciIncremental: false }).valid, true);
+  assert.equal(validateManifest({ ...valid, ciIncremental: "yes" }).valid, false);
+  assert.equal(validateManifest({ ...VALID_MINIMAL, ciIncremental: true }).valid, false);
+});
+
+test("devArtifact validates keys, paths, and runner coverage", () => {
+  const base = {
+    ...VALID_MINIMAL,
+    profile: "rust-hybrid",
+    lanes: ["ci"],
+    gate: { path: "scripts/gate.sh" },
+    matrix: { os: ["xcode-27", "windows-2025"], node: ["26.8.1"] },
+    ciAllOs: true,
+  };
+  const full = { mac: "sign", windows: "unsigned", macAppPath: "target/release/bundle/macos/Pulse.app", windowsGlob: "target/release/*.exe", retentionDays: 7 };
+  assert.equal(validateManifest({ ...base, devArtifact: full }).valid, true);
+  assert.equal(validateManifest({ ...base, devArtifact: { windows: "unsigned", windowsGlob: "dist/*.exe" } }).valid, true);
+
+  const bad = (devArtifact, manifest = base) => validateManifest({ ...manifest, devArtifact }).valid;
+  assert.equal(bad({ mac: "none", windows: "none" }), false, "needs at least one active target");
+  assert.equal(bad({ ...full, macAppPath: undefined }), false, "mac sign needs macAppPath");
+  assert.equal(bad({ ...full, windowsGlob: undefined }), false, "windows needs windowsGlob");
+  assert.equal(bad({ ...full, macAppPath: "../Pulse.app" }), false);
+  assert.equal(bad({ ...full, macAppPath: "target/Pulse" }), false, "must end in .app");
+  assert.equal(bad({ ...full, macAppPath: "a;b.app" }), false);
+  assert.equal(bad({ ...full, windowsGlob: "${{ x }}" }), false);
+  assert.equal(bad({ ...full, retentionDays: 0 }), false);
+  assert.equal(bad({ ...full, retentionDays: 91 }), false);
+  assert.equal(bad({ ...full, mac: "notarize" }), false);
+  assert.equal(bad({ ...full, extra: 1 }), false);
+  assert.equal(bad({ windows: "unsigned", windowsGlob: "a/*.exe", macAppPath: "x.app" }), false, "macAppPath requires mac sign");
+  assert.equal(bad(full, { ...base, ciAllOs: false }), false, "single windows runner cannot build the mac app");
+  assert.equal(bad(full, { ...VALID_MINIMAL, devArtifact: full }), false);
+  assert.equal(validateManifest({ ...VALID_MINIMAL, devArtifact: full }).valid, false, "node profile rejects devArtifact");
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/git",
-  "version": "0.2.30",
+  "version": "0.2.32",
   "description": "Public-repo-only GitHub Actions workflow layer: templates, visibility gate, sync/drift/adopt/uninstall for right-git.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -21,8 +21,8 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/bogusyogi/claude.git",
-    "directory": "tools/rightkit/packages/git"
+    "url": "git+https://github.com/bogusyogi/rightkit.git",
+    "directory": "packages/git"
   },
   "scripts": {
     "test": "node --test *.test.mjs"

package/render.test.mjs

@@ -1,7 +1,9 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
+import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { renderTemplate, MANAGED_MARKER } from "./render.mjs";
 import { buildRenderContext, LANE_FILENAMES, KNOWN_LANES, validateManifest } from "./manifest.mjs";
@@ -879,3 +881,90 @@ test("rust-hybrid ci uploads QA evidence after the gate only when qaEvidencePath
   const custom = renderTemplate(template, buildRenderContext({ ...structuredClone(base), qaEvidencePath: "pulse-hub-qa", qaEvidenceRetentionDays: 30 }, "/repos/widgets"));
   assert.match(custom, /retention-days: 30\n/);
 });
+
+const INCREMENTAL_BASE = {
+  ...FULL_MANIFEST,
+  lanes: ["ci"],
+  profile: "rust-hybrid",
+  gate: { path: "scripts/gate.sh" },
+  matrix: { os: ["xcode-27", "windows-2025"], node: ["26.8.1"] },
+  ciAllOs: true,
+};
+const renderRustCi = (manifest) => renderTemplate(
+  fs.readFileSync(path.join(templatesDir, "profiles/rust-hybrid/ci.yml"), "utf8"),
+  buildRenderContext(structuredClone(manifest), "/repos/pulse"),
+);
+
+test("ciIncremental unset or false renders the legacy cache settings; true opts in", () => {
+  const unset = renderRustCi(INCREMENTAL_BASE);
+  assert.match(unset, /cache-workspace-crates: false/);
+  assert.match(unset, /CARGO_INCREMENTAL: "0"/);
+  assert.doesNotMatch(unset, /DerivedData|actions\/cache@|dev-mac|dev-windows/);
+  assert.equal(renderRustCi({ ...INCREMENTAL_BASE, ciIncremental: false }), unset);
+
+  const on = renderRustCi({ ...INCREMENTAL_BASE, ciIncremental: true });
+  assert.match(on, /cache-workspace-crates: true/);
+  assert.match(on, /CARGO_INCREMENTAL: "1"/);
+  assert.match(on, /Cache Xcode DerivedData\n        if: \$\{\{ runner\.os == 'macOS' \}\}\n        uses: actions\/cache@[0-9a-f]{40} # v4\.2\.4/);
+  assert.match(on, /hashFiles\('\*\*\/Cargo\.lock', '\*\*\/Package\.resolved'/);
+});
+
+const DEV_MANIFEST = {
+  ...INCREMENTAL_BASE,
+  devArtifact: {
+    mac: "sign",
+    windows: "unsigned",
+    retentionDays: 5,
+    macAppPath: "target/release/bundle/macos/Pulse.app",
+    windowsGlob: "target/release/*.exe",
+  },
+};
+
+test("devArtifact renders push-to-default-branch dev steps and a signing job; unset adds nothing", () => {
+  const out = renderRustCi(DEV_MANIFEST);
+  assert.match(out, /name: dev-windows-\$\{\{ github\.sha \}\}\n          path: target\/release\/\*\.exe\n          retention-days: 5/);
+  assert.match(out, /DEV_APP_PATH: "target\/release\/bundle\/macos\/Pulse\.app"/);
+  assert.match(out, /dev-mac-sign:\n[\s\S]*needs: \[ci\]\n    if: \$\{\{ github\.event_name == 'push' && github\.ref_name == github\.event\.repository\.default_branch \}\}\n    environment: release\n    runs-on: xcode-27/);
+  assert.match(out, /codesign --force --deep --strict --options runtime --timestamp --sign "\$APPLE_DEVELOPER_ID"/);
+  assert.match(out, /name: dev-mac-\$\{\{ github\.sha \}\}/);
+  assert.doesNotMatch(out, /notarytool|APPLE_API_KEY|stapler/);
+  // Signing material never reaches the PR-reachable ci job.
+  assert.doesNotMatch(out.split("  dev-mac-sign:")[0], /secrets\./);
+  // mac/windows only render the legs they declare.
+  const winOnly = renderRustCi({ ...DEV_MANIFEST, devArtifact: { windows: "unsigned", windowsGlob: "dist/*.exe" } });
+  assert.doesNotMatch(winOnly, /dev-mac-sign|dev-unsigned-mac/);
+  assert.match(winOnly, /retention-days: 7/);
+  assert.equal(renderRustCi({ ...INCREMENTAL_BASE, devArtifact: undefined }), renderRustCi(INCREMENTAL_BASE));
+});
+
+test("devArtifact entitlements add a checkout and --entitlements", () => {
+  const out = renderRustCi({ ...DEV_MANIFEST, devArtifact: { ...DEV_MANIFEST.devArtifact, macEntitlements: "build/pulse.entitlements" } });
+  assert.match(out, /--entitlements "\$GITHUB_WORKSPACE\/build\/pulse\.entitlements"/);
+  assert.match(out.split("  dev-mac-sign:")[1], /actions\/checkout@/);
+});
+
+test("rendered ciIncremental + devArtifact workflows pass actionlint", (t) => {
+  const bin = spawnSync("actionlint", ["-version"], { encoding: "utf8" });
+  if (bin.error) return t.skip("actionlint not installed");
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "right-git-actionlint-"));
+  try {
+    fs.mkdirSync(path.join(dir, ".github", "workflows"), { recursive: true });
+    fs.writeFileSync(path.join(dir, ".github", "actionlint.yaml"), "self-hosted-runner:\n  labels:\n    - xcode-*\n");
+    const samples = {
+      "ci-default.yml": INCREMENTAL_BASE,
+      "ci-incremental.yml": { ...INCREMENTAL_BASE, ciIncremental: true },
+      "ci-dev.yml": { ...DEV_MANIFEST, ciIncremental: true },
+      "ci-dev-entitlements.yml": { ...DEV_MANIFEST, devArtifact: { ...DEV_MANIFEST.devArtifact, macEntitlements: "build/pulse.entitlements" } },
+    };
+    const files = [];
+    for (const [name, manifest] of Object.entries(samples)) {
+      const file = path.join(dir, ".github", "workflows", name);
+      fs.writeFileSync(file, renderRustCi(manifest));
+      files.push(file);
+    }
+    const result = spawnSync("actionlint", ["-shellcheck=", "-pyflakes=", "-config-file", path.join(dir, ".github", "actionlint.yaml"), ...files], { encoding: "utf8" });
+    assert.equal(result.status, 0, result.stdout + result.stderr);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});

package/templates/profiles/rust-hybrid/ci.yml

@@ -63,7 +63,7 @@ ${CI_MATRIX_OS}
           package-manager-cache: false
 ${PACKAGE_MANAGER_SETUP}
       - run: ${INSTALL_COMMAND}
-${OWNERSHIP_STEP}
+${OWNERSHIP_STEP}${CI_DERIVED_DATA_STEP}
       - uses: dtolnay/rust-toolchain@f8be11a05b1d4f3fcebe6410cc16743212b999b0
         if: steps.rust-changes.outputs.required == 'true'
         with:
@@ -75,7 +75,7 @@ ${OWNERSHIP_STEP}
 ${RUST_CACHE_WORKSPACES}
           shared-key: ${ARTIFACT_PREFIX}-rust
           add-job-id-key: false
-          cache-workspace-crates: false
+          cache-workspace-crates: ${CI_CACHE_WORKSPACE_CRATES}
           cache-on-failure: true
           save-if: ${{ github.event_name != 'pull_request' }}
       - uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
@@ -88,7 +88,7 @@ ${RUST_CACHE_WORKSPACES}
           RIGHT_GIT_RUST_REQUIRED: ${{ steps.rust-changes.outputs.required }}
           SCCACHE_GHA_ENABLED: "true"
           RUSTC_WRAPPER: ${{ steps.rust-changes.outputs.required == 'true' && 'sccache' || '' }}
-          CARGO_INCREMENTAL: "0"
+          CARGO_INCREMENTAL: "${CI_CARGO_INCREMENTAL}"
           CARGO_PROFILE_DEV_DEBUG: "0"
           CARGO_PROFILE_TEST_DEBUG: "0"
 ${QA_EVIDENCE_STEP}